Federal Agency: U.S. Department of Housing and Urban Development Federal Program Name: Section 811 - Project Rental Assistance Program Assistance Listing Number: 14.326 Federal Award Identification Number and Year: IL06RDD1201 - 2012; IL06RDD1301 - 2013; IL06RDD1901 - 2019 Pass-Through Agency: State of Illinois Pass-Through Number: IL902 Award Period: July 1, 2024 to June 30, 2025 Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2025-001 Failure to Adequately Monitor Subrecipients CONDITION The Illinois Housing Development Authority (Authority) did not follow its established policies and procedures for monitoring subrecipients of the Section 811 Project Rental Assistance (Section 811) program. The Authority has implemented procedures whereby program staff perform property inspections over subrecipient compliance with regulations applicable to the Section 811 program. The Authority’s policies require the subrecipient to have an inspection every three years. During our testing of the monitoring of subrecipients, we noted one of eight (13%) subrecipients (with expenditures of $319,404 during the year ended June 30, 2025) had not received an inspection within the required three-year period in accordance with Authority policy. The most recent inspection for this subrecipient was conducted in fiscal year 2019. This sample was not intended to be, and was not, a statistically valid sample. CRITERIA OR SPECIFIC REQUIREMENT According to 2 CFR 200.332(e), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include ensuring inspections are performed in a timely manner. CAUSE Authority management indicated there are three underlying causes for this audit finding: 1) Increased volume in required inspections - the annual volume of required inspections in fiscal year 2025 was 56% higher than the annual required inspections in fiscal year 2020 while staffing remained constant. 2) COVID-19 Waivers - In 2020, the Internal Revenue Service issued COVID-19 waivers that eliminated physical inspection requirements and allowed a calendar “reset” for Low Income Housing Tax Credit transactions until 2023. The result of the increased volume and calendar “reset” created a significant backlog of physical inspections due. 3) Inadequate controls – lack of quality control procedures to ensure the inspection reports were completed and filed appropriately. EFFECT Failure to adequately perform inspections of subrecipients may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. (Finding Code No. 2025-001) RECOMMENDATION We recommend the Authority improve its internal controls to ensure inspections are completed in accordance with established policies and procedures. AUTHORITY RESPONSE The Authority agrees with the finding. The Authority will implement additional internal controls, including quality control of completed inspection, documentation, and inspection scheduling. Additionally, the Authority recognizes that the volume of required annual inspections has increased beyond existing Full Time Equivalent (FTE) capacity; therefore, an RFP for the third-party inspection vendor has been issued to supplement internal resources and support timely completion of inspections.
Questioned Cost $ – Finding No. 2025-008: Subrecipient Monitoring (Material Weakness) State Agency: Office of Planning and Sustainable Development Federal Agency: Department of Commerce AL Number and Title: 11.419 – Coastal Zone Management Administration Awards Award Number and Award Year: NA22NOS4190022 2022 NA22NOS4190065 2022 NA23NOS4190139 2023 NA24NOSX419C0023 2024 Repeat Finding? No Condition During our audit, we tested a non-statistical sample of two subawards and found that the State did not communicate the following award information required under 2 CFR 200.332: Subrecipient’s unique entity identifier; Federal Award Date; Subaward Period of Performance Start and End Date; Subaward Budget Period Start and End Date; Assistance Listing title and number; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listing Number at the time of disbursement; Identification of whether the Federal award is for research and development; and Indirect cost rate for the Federal award (including if the de minimis rate is used in accordance with 200.414). Criteria 2 CFR Section 200.332(a) requires the State to clearly identify certain information to subrecipients at the time of the subaward, including the information specified above. Effect By not including the required information in the subaward, the State may not be providing the appropriate level of monitoring over its subrecipients. Cause and View of Responsible Officials Program personnel incorrectly classified subawards as vendor contracts. Recommendation We recommend that the management strengthen internal controls over subaward identification and monitoring subrecipients to ensure subrecipient monitoring requirements are met.
2025-004 SUBRECIPIENT MONITORING – WOIA (REPEATED) Funding agency: U.S. Department of Labor Title: Workforce Investment Act Cluster ALN Number: 17.258, 17.259, 17.278 Type of Finding: Significant Deficiency in Internal Control over Compliance; Other Non-compliance Compliance Area: Subrecipient Monitoring Award Year: Program Year 2023-2024 Question Costs: None Condition During prior year audit testing, we noted that the Department had been behind on performing monitoring controls such as quarterly desk reviews, annual on-site evaluations, and remote reviewing and testing of cost documentation. The Department had not completed fiscal or programmatic monitoring relating to Program Year 2023-2024 activity for any of its subrecipients. Due to staffing vacancies at the beginning of the fiscal year, as of January 2024, the Department had fallen approximately 2 years behind. By the beginning of fiscal year 2025, they had just completed Program Year 2022-2023 monitoring, and were thus out of compliance for a portion of the current year under audit. During the fiscal year, the Department made significant progress towards corrective action in compliance and controls over compliance for Subrecipient Monitoring over the WIOA program. Fiscal and programmatic monitoring for Program Year 2024 was substantially complete around June of 2025. We also noted that risk assessments are now being performed by the Department, rather than as selfassessments by the subrecipients. As a result of these improvements, we have lowered the type of finding from a Material Weakness to a Significant Deficiency in internal control over compliance, and from Material Non-Compliance to Other Non-Compliance. Criteria §200.332 Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the passthrough entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 Management Decision. Effect The lack of internal controls over this compliance requirement provides an opportunity for federal grant noncompliance at the subrecipient level. For monitoring controls to be wholly effective, they must be performed timely. Potential costs outside the scope of work as well as overall effective project management at the subrecipient level. There is higher risk of material misstatement, fraud, noncompliance, or errors. Cause The Department had previously not established internal controls and procedures over financial grant management to ensure compliance with applicable compliance requirements. The Department had experienced staffing turnover during prior years. These causes have since been rectified
Program: Block Grants for Community Mental Health Services Federal Financial Assistance Listing Number: 93.958 Federal Grantor: U.S. Department of Health and Human Services Pass Through: California Department of Health Care Services Award No. and Year: 68-0317191 and 2024 Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance and Instance of Noncompliance Criteria: In accordance with Title 2 U.S. Code of Federal Regulations (CFR) 200.332, pass-through entities must comply with the following: • 2 CFR Part 200.332(a), Requirements for Pass-Through Entities, states that all passthrough entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information as well as all the requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations, and the terms and conditions of the award. Condition: The following information was not provided at the time of the subaward for three (3) out of five (5) subawards selected for testing from the HCA’s Block Grants for Community Mental Health Services program • Federal Award Identification Number (FAIN) • Federal award date of award to recipient by the Federal Agency • Identification of whether or not the award is R&D • Indirect cost rate for the Federal award (including if the de-minimus rate is charged) Cause: The HCA’s procedures did not consistently ensure that the required award information and applicable requirements were communicated to the subrecipients at the time of subaward. Effect: The County’s control policies were not consistently followed which require compliance with the Subrecipient Monitoring requirements as found in 2 CFR 200.332. Questioned Costs: No questioned costs were identified as a result of our audit procedures. Context/Sampling: A nonstatistical sample of three (3) of five (5) subrecipients were sampled. The condition noted above was identified during our procedures related to subrecipient monitoring. Repeat Finding from Prior Years: No. Recommendation: We recommend that the County adhere to their policies and procedures in accordance with 2 CFR 200.332 to ensure compliance with subrecipient monitoring requirements. Views of Responsible Officials: See separately issued Corrective Action Plan.
Program: Homeland Security Grant Program Federal Financial Assistance Listing Number: 97.067 Federal Grantor: U.S. Department of Homeland Security Pass-Through Entity: California Governor’s Office of Emergency Services Award No. and Year: Multiple Compliance Requirements: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria: Title 2 of the U.S. Code of Federal Regulations (CFR), Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Section 200.332, requires that pass-through entities: • Evaluate the risk of noncompliance with a subaward to determine the appropriate monitoring. • Verify every subrecipient is audited as required by Uniform Guidance, issue management decisions for audit findings, as applicable, and ensure the subrecipient take timely corrective action on all audit findings, as applicable. • Verify whether the subrecipient is suspended, debarred, or otherwise excluded before entering into a covered transaction. Condition: For two (2) out of two (2) subrecipients selected for testing, the subrecipient risk assessments were not performed by the department and the subrecipient was not checked for suspension or debarment prior to entering into the agreement. For one (1) out of two (2) subrecipients selected for testing, evidence could not be provided to verify the County reviewed the subrecipient’s single audit report to ensure timely corrective action was taken on audit findings, as applicable. Cause: Internal controls were not in place to ensure compliance with subrecipient monitoring requirements. Effect: Ineffective controls over this area of compliance could result in noncompliance occurring for a subrecipient and not being detected. Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: A nonstatistical sample of two (2) subrecipients out of a population of two (2) was selected for testing. Repeat Finding from Prior Years: No Recommendation: We recommend the department enhance internal controls to ensure compliance with subrecipient monitoring requirements Views of Responsible Officials: See separately issued Corrective Action Plan.
U.S. DEPARTMENT OF HOMELAND SECURITY Finding Number 2025-048 Assistance Listing Number and Title 97.067 – Homeland Security Grant Program (HSGP) Compliance Requirement Subrecipient Monitoring State Entity Florida Division of Emergency Management (FDEM) Federal Grant/Contract Number and Grant Year EMW-2021-SS-00056 (2021) Statistically Valid Sample No Finding Type Noncompliance and Significant Deficiency Finding The FDEM did not always evaluate subrecipient risk to determine the appropriate subrecipient monitoring or conduct subrecipient monitoring. Criteria 2 CFR 200.332 – Requirements for pass-through entities – All pass-through entities must evaluate each subrecipient’s fraud risk and risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals and objectives are achieved. Condition According to FDEM management, subrecipients with subawards funded by the HSGP grant that closed on August 31, 2025, were to be monitored during the 2024-25 fiscal year. According to FDEM, 63 subrecipients with subawards totaling approximately $31.5 million in HSGP funds were monitored during the 2024 25 fiscal year. However, our inquiries of FDEM management and examination of FDEM monitoring records for 7 selected subrecipients disclosed that the FDEM neither evaluated fraud risk or the risk of noncompliance for 2 of the 7 subrecipients nor conducted required monitoring. Cause According to FDEM management, required risk assessment and monitoring activities were not completed due to an administrative oversight. Effect Absent an evaluation of each subrecipient’s fraud risk and risk of noncompliance, and monitoring of all subrecipients based on the results of the risk assessment, the FDEM cannot ensure that subawards are used for authorized purposes in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals and objectives are achieved. Recommendation We recommend that FDEM management enhance controls to ensure that subrecipient monitoring is performed based on an assessment of each subrecipient’s risk in accordance with Federal regulations. State Entity Response We concur. The risk assessment and monitoring activities did not occur for the 2 subrecipients identified. We will enhance internal controls to ensure monitoring is consistently performed and documented.
Condition We selected a non-statistical sample of three subrecipients and noted that the Department did not perform site-visits for two subrecipients as required by the Department’s policy and procedures. Criteria Pursuant to 2 CFR 200.332(d), pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Effect Failure to monitor subrecipients increases the risk that noncompliance at the subrecipient level goes undetected. Cause and View of Responsible Officials Although the Department has established policies and procedures in place over the application process and determination of assistance amount, there was a lack of diligence in complying with the policies and procedures. Recommendation We recommend that program management ensure that program personnel are familiar with all grant requirements, including those specified under the Criteria section above. Additionally, we recommend that the Department diligently comply with its policies and procedures.
Condition We selected a non-statistical sample of three subrecipients and noted that in each case, the Department did not perform required during-the-award monitoring of its subrecipients. In addition, the Department did not verify that that subrecipients were audited if required by 2 CFR Part 200, Subpart F. Criteria Pursuant to 2 CFR 200.332(d), pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pursuant to 2 CFR 200.332(f), pass through entities must verify that subrecipients expected to be audited as required by 2 CFR Part 200, Subpart F, met this requirement. Effect Failure to monitor subrecipient activities or verify that subrecipients have completed their required Single Audits increases the risk that noncompliance at the subrecipient level goes undetected. Cause and View of Responsible Officials The issue occurred during a period of staff transition, during which roles were assumed without the benefit of documented procedures, formal training, or established prior practices. Recommendation We recommend that the Department establish formal written policies and procedures to ensure that the required during-the-award monitoring is performed and the required subrecipient Single Audit reports are obtained and reviewed, including appropriate follow up on any relevant audit findings.
Finding 2025-001 Subrecipients Federal Agency: United States Department of Justice Federal Program: Edward Bryne Memorial Justice Assistance Grant Program Assistance Listing Number: 16.738 Award Identification Number: 2019-YA-BX-K002 Criteria or Specific Requirement: CFR § 200.332, "Requirements for pass-through entities", requires pass-through entities to evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Condition: During our audit, we noted that the pre-award risk assessment was not performed until November 2024, subsequent to the subaward being signed with the subawardee. Based on our discussions with management, the process for performing pre-award risk assessment for subrecipients and determining and documenting the appropriate level of ongoing monitoring for subrecipients was implemented in November 2024. We also noted that the Association did not perform the FFATA (Federal Funding Accountability and Transparency Act) reporting requirements. Cause: During 2025, the Association's finance department turned over significantly, resulting in oversight of the compliance requirement. Effect or Potential Effect: The Association could inadvertently engage in relationships with subrecipients of higher risk without the appropriate level of oversight (i.e. monitoring) to ensure subrecipients are expending funds in accordance with the provisions and terms of the subaward. Questioned Costs: None noted. Context: Our audit procedures in this area consisted of substantive testwork over a sample of subrecipient expenditures that were selected based on a defined threshold. We consider our sample to be representative of the populations, and thus, is a statistically valid sample. The issue is deemed to be systemic. Identification as a Repeat Finding, if Applicable: 2024-001 Recommendation: We recommend that the Association strictly adhere to its current subaward policy and ensure the risk assessment procedures over all of its subrecipients are performed and documented prior to engagement. Based on these risk assessments, the Association should assign a risk level to each, and then determine the monitoring tools to apply based on these risk levels.
Finding Number - 2025-006 Late vendor credits Agency Department of Health & Human Services Federal Program Medicaid Cluster ALN 93.778 Compliance Requirement Cost Principles Type of Finding Internal Control over Compliance / Compliance Category Other Criteria In accordance with the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, 2 CFR §200.305(b)(1) requires that pass-through entities ensure payments to subrecipients are made in a timely manner, generally within a reasonable period after receipt of a valid request for payment. Federal guidance and established administrative practice interpret a reasonable period for purposes of cash management compliance to mean no later than 30 calendar days following receipt of a proper payment request, unless the pass-through entity reasonably determines the request to be improper. This requirement applies regardless of whether the federal award operates on a reimbursement basis and is intended to ensure compliance with federal cash management standards and minimize the time between disbursement of funds and federal reimbursement. Criteria – (continued) For Medicaid program (Assistance Listing 93.778), CMS regulations further require that expenditures claimed for Federal Financial Participation (FFP) be based on actual, incurred, and properly documented costs in accordance with 42 CFR §433.32 and applicable CMS financial management guidance. CMS oversight emphasizes timely payment and proper cash management practices to ensure that expenditures are valid and that federal funds are drawn only for allowable and properly incurred costs. Additionally, 2 CFR §200.332(a) requires pass-through entities to monitor subrecipients and ensure compliance with applicable federal requirements, including adherence to cash management provisions. Condition During testing of subrecipient disbursements, it was noted that six (6) payments included in the sample of 178 were made more than 30 calendar days after the pass-through entity received a valid request for payment from the subrecipient. The delays ranged from 46 to 150 days beyond the regulatory requirement. Item No. Check Date (Voucher id) Invoice Date Audited Amount 1 1/24/2025 00536685 12/4/2024 $ 1,458 2 5/23/2025 00553562 12/23/2024 $ (1,321,563) 3 5/23/2025 00553519 12/23/2024 $ 2,111 4 5/23/2025 00553562 4/1/2025 $ (220,261) 5 7/23/2024 00515301 6/7/2024 $ 5,876 6 7/23/2024 00515303 6/7/2024 $ 8,911 Also, we identified two (2) instances in which vendor credits related to previously issued invoices were not applied to the corresponding invoices until approximately one (1) to three (3) months after the original drawdown was requested. Item No. Invoice number Invoice date Credit amount Drawdown not including credit Date credit return Days 1 RF VITAL 25-003 12/27/2024 $ (1,321,563) 1/13/2025 6/3/2025 -141 2 RF VITAL 25-006 4/10/2025 $ (220,261) 4/28/2025 6/3/2025 -36 Cause The delays in payment were primarily attributable to internal cash management and administrative practices, including the practice of awaiting the receipt of federal funds or internal approvals prior to issuing payment to the subrecipient. These practices were not aligned with the timing requirements established under Uniform Guidance. Management indicated that the Program waits until sufficient positive fund balances are available before processing the return of outstanding credits. As a result, certain credit balances may remain pending until adequate funds are available to complete the reimbursement. This practice may delay the timely return of funds in accordance with applicable requirements. Effect Failure to remit payment to subrecipients within the required 30-day timeframe. Continued noncompliance may increase the risk of: a) Audit findings under the Uniform Guidance, b) Increased federal oversight, c) Potential questioned costs, and d) Strained financial operations for subrecipients due to delayed reimbursement. The delayed application of credits resulted in temporary overstatements of expenditures used to support Federal drawdowns. Although the credits were eventually applied, the timing difference may result in noncompliance with cash management requirements under 2 CFR §200.305, as Federal funds may have been drawn in excess of immediate cash needs. Questioned Costs None Perspective Information This finding was identified during the audit of the Medicaid program (Assistance Listing 93.778) for the fiscal year ended 2025. The payments tested related to expenditures incurred and invoiced by a state agency acting as a subrecipient under an interagency agreement. Although both the pass-through entity and the subrecipient are agencies within the same state government, federal regulations treat them as distinct entities for purposes of cash management compliance. Prior Year Audit Finding This is not a prior year finding Recommendation It is recommended that the pass-through entity strengthens internal controls over subrecipient payments to ensure that all valid requests for payment are processed and paid within the 30-calendar-day timeframe required by 2 CFR §200.305(b)(1). Management should also ensure that payment procedures are not contingent upon the timing of federal drawdowns and that any delays are adequately documented and communicated to the subrecipient. We recommend that management strengthen internal controls over the drawdown process by implementing a formal review procedure to verify that all outstanding vendor credits have been identified and applied prior to submitting a Federal draw request. Views of Responsible Officials and Planned Corrective Actions The PRDH’s management agrees with this finding. Please refer to the corrective action on pages 57-60.
Finding Number: 2025-012 State/Educational Agency(s): Arkansas Department of Commerce – Arkansas Economic Development Commission Pass-Through Entity: Not applicable AL Number(s) and Program Title(s): 21.029 – Coronavirus Capital Project Funds Federal Awarding Agency: U.S. Department of Treasury Federal Award Number(s): CPFFN0186 Federal Award Year(s): 2022 Compliance Requirement(s) Affected: Allowable Cost/Cost Principles Type of Finding: Noncompliance Repeat Finding: Not applicable Criteria: In accordance with 2 CFR § 200.332(b), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward. The following is a partial listing of the information a pass-through entity must provide when available: (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient’s unique entity identifier (UEI). Condition and Context: ALA reviewed five broadband infrastructure projects totaling $39,789,080, from a total of 20 broadband infrastructure projects totaling $127,227,854, and noted the grant awards had been issued to internet service providers (ISPs) with a unique entity identifier; however, the ISP was not always the entity that would construct and own the broadband network. Several of these ISPs were wholly owned subsidiaries of electric cooperatives, which have a different unique entity identifier. ALA reviewed 247 invoices associated with 15 reimbursement requests and noted 173 invoices totaling $10,793,988 in which the expenses submitted for reimbursement were incurred and paid by the electric cooperative instead of the ISP. ALA also noted 6 instances totaling $3,364,595 in which the reimbursement payments related to these invoices were made to the electric cooperative instead of the ISP. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Arkansas State Broadband Office (ASBO) did not execute the grant agreements with the party that would have ownership of the broadband network when the project was complete. Effect: Failure to ensure grant agreements are executed with the appropriate subrecipient could lead to the submission of expenses and payments that are improper. Recommendation: ALA staff recommend the Agency ensure the subrecipient in the grant agreement is the party that will construct and own the broadband network when it is complete. Doing so will ensure the subrecipient is able to submit and be reimbursed for expenses incurred and place the liability for completion of the project with the appropriate party. Views of Responsible Officials and Planned Corrective Action: ASBO acknowledges the auditor’s observation regarding the execution of subaward agreements with ISP entities that are wholly owned subsidiaries of electric cooperatives and the related affiliate payment structure. Subaward agreements were executed with legally distinct ISP entities holding unique entity identifiers (UEIs) and responsible for performance under the Capital Projects Fund (CPF) award. In certain instances, affiliated parent entities processed invoice payments as part of established intercompany accounting practices. These arrangements reflected corporate structure and operational efficiencies rather than an intent to shift accountability or bypass program requirements. ASBO notes that no questioned costs were identified and that project deliverables were completed in accordance with the terms of the award. The ISP entities remained responsible for reporting, certification, and compliance under the executed agreements. ASBO recognizes, however, that clearer documentation of intercompany payment flows would strengthen audit traceability and reduce ambiguity regarding which legal entity incurred and paid specific costs. To enhance documentation clarity, ASBO will require subrecipients with affiliated entities to maintain documented intercompany reconciliations where applicable and will update subaward templates to further clarify entity-level responsibility for payment, ownership, and record retention. Internal review procedures will also be reinforced to ensure alignment between invoicing practices and designated subrecipient entities. Anticipated Completion Date: June 30, 2026 Contact Person: Glen Howie State Broadband Director Arkansas State Broadband Office 1 Commerce Way Little Rock, AR 72202 (501) 683-6000 broadband@arkansas.gov
Finding Number: 2025-014 State/Educational Agency(s): Arkansas Department of Commerce – Arkansas Economic Development Commission Pass-Through Entity: Not applicable AL Number(s) and Program Title(s): 21.029 – Coronavirus Capital Project Funds Federal Awarding Agency: U.S. Department of the Treasury Federal Award Number(s): CPFFN0186 Federal Award Year(s): 2022 Compliance Requirement(s) Affected: Matching, Level of Effort, and Earmarking Type of Finding: Noncompliance Repeat Finding: Not applicable Criteria: In accordance with 2 CFR § 200.332(b)(2), a pass-through entity must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes all requirements of the subaward, including requirements imposed by federal statutes, regulations, and the terms and conditions of the federal award. Arkansas State Broadband Office (ASBO) procedures also require any special conditions to be disclosed in the grant agreement. Condition and Context: Federal guidelines do not require cost sharing or matching funds; however, ASBO procedures require a minimum match of 25%. The specific amount of matching required above can vary with each project. A proposed matching amount is submitted by each applicant for a project and evaluated as part of the award process. ASBO did not include the final required matching amount in the grant agreement. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: ASBO management did not include required matching amounts in the grant agreement. Effect: Failure to include all significant terms in the grant agreement could result in a subrecipient’s noncompliance due to lack of knowledge and understanding of required responsibilities. Recommendation: ALA staff recommend the Agency include all significant terms (including required matching amounts) in the grant agreement. Views of Responsible Officials and Planned Corrective Action: ASBO acknowledges the auditor’s observation regarding the inclusion of required matching amounts in the executed grant agreements. The Capital Projects Fund (CPF) program does not require cost sharing or matching funds under federal guidance. However, the Arkansas State Broadband Office (ASBO) incorporated a minimum match expectation as part of its state-level program design and evaluation process. Proposed match commitments were submitted by applicants and evaluated during the award process. ASBO recognizes that the final required match amount was not expressly stated in the executed grant agreement. While match expectations were documented during application review and award evaluation, ASBO agrees that explicitly including the finalized match requirement in the executed agreement would provide greater clarity and reduce ambiguity. ASBO notes that no questioned costs were identified in connection with this finding. ASBO will update its grant agreement templates to ensure that any state-imposed matching requirements are explicitly incorporated into the final executed agreement. This enhancement will ensure alignment between program evaluation criteria and formal award documentation going forward. Anticipated Completion Date: June 30, 2026 Contact Person: Glen Howie State Broadband Director Arkansas State Broadband Office 1 Commerce Way Little Rock, AR 72202 (501) 683-6000 broadband@arkansas.gov
Finding Number: 2025-016 State/Educational Agency(s): Arkansas Department of Commerce – Arkansas Economic Development Commission Pass-Through Entity: Not applicable AL Number(s) and Program Title(s): 21.029 – Coronavirus Capital Project Funds Federal Awarding Agency: U.S. Department of the Treasury Federal Award Number(s): CPFFN0186 Federal Award Year(s): 2022 Compliance Requirement(s) Affected: Subrecipient Monitoring Type of Finding: Noncompliance Repeat Finding: Not applicable Criteria: In accordance with 2 CFR § 200.332(e), a pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward. As outlined in the Uniform Guidance at 2 CFR Part 200, Subpart E regarding Cost Principles, allowable costs must meet the following criteria: (1) be necessary, reasonable, and allocable for the performance of the federal award, (2) be accorded consistent treatment as either a direct cost or indirect cost, and (3) be adequately documented. Condition and Context: The broadband infrastructure grants are for the construction and deployment of broadband infrastructure projects designed to deliver, upon project completion, service that reliably meets or exceeds symmetrical download and upload speeds of 100 Mbps. When construction and deployment are completed, the subrecipient notifies the Arkansas State Broadband Office (ASBO) in writing. ASBO has contracted with a third-party vendor to perform a technical close-out, which involves field visits and the issuance of a letter to confirm the work has been completed in accordance with the grant agreement. ALA reviewed 5 of 20 projects and noted that 1 project reviewed was not properly closed out. The project was completed in October 2024, and a technical close-out letter was issued in December 2024. In October 2025, the subrecipient requested permission to perform equipment upgrades to the network, and the third-party contractor rescinded the close-out letter, allowing additional expenses of $2,096,990 to be submitted for reimbursement. As indicated in the technical close-out letter issued in December 2024, these upgrades were not necessary for completion of the network in accordance with the grant agreement. Once the network has been completed, any further costs incurred are considered maintenance costs and are the responsibility of the subrecipient. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $2,096,990 Cause: ASBO management did not ensure that only expenses necessary for performance of the federal award were included as allowable costs. Effect: Failure to properly close-out grants in compliance with Agency procedures could result in reimbursement of expenses that are unallowable. Recommendation: ALA staff recommend the Agency follow close-out procedures and ensure maintenance expenses incurred after the completion of the project are not included as allowable costs. Views of Responsible Officials and Planned Corrective Action: ASBO acknowledges the auditor’s observation regarding the sequencing of the technical close-out letter and subsequent expenditures for one project. ASBO respectfully clarifies that a Technical Close-Out Letter reflects that the primary network infrastructure has been constructed and service capability established. It does not necessarily signify final project completion for all eligible cost components under the grant agreement. Project completion for reporting purposes occurs upon final reporting to the U.S. Department of the Treasury. In October 2025, the subrecipient requested approval to perform additional network equipment upgrades using remaining grant funds. ASBO obtained written confirmation from the U.S. Department of the Treasury Senior Federal Program Officer that the identified OLT upgrade constituted an eligible network component necessary to deliver service and was not maintenance. No additional grant funds were awarded for this work; the proposal involved remaining grant balances. It should be noted that as of the date of audit review, no expenses had been incurred related to the proposed upgrade. As such, ASBO does not concur that the identified $2,096,990 represents ongoing maintenance costs or unallowable expenditures. In fact, all reimbursements to date include eligible network build-out costs incurred prior to “technical closeout” but financially processed after that date, or fiber-to-the-home (FTTH) drops. FTTH drops have been an allowable expense in the Arkansas CPF Program following technical closeout yet prior to reporting the project complete to U.S. Treasury. The misclassification of these costs as maintenance appears to stem from an assumption that they were related to the proposed network upgrade, when in actuality, they were not. To avoid ambiguity in future projects, ASBO will formalize procedures clarifying the distinction between technical close-out, formal project completion, and eligible use of remaining funds. Any Treasury-approved scope clarifications or post-close-out adjustments will be formally documented prior to reimbursement to ensure alignment between technical certification and financial reporting. Anticipated Completion Date: June 30, 2026 Contact Person: Glen Howie State Broadband Director Arkansas State Broadband Office 1 Commerce Way Little Rock, AR 72202 (501) 683-6000 broadband@arkansas.gov
Finding Number: 2025-017 State/Educational Agency(s): Arkansas Department of Commerce – Arkansas Economic Development Commission Pass-Through Entity: Not applicable AL Number(s) and Program Title(s): 21.029 – Coronavirus Capital Project Funds Federal Awarding Agency: U.S. Department of the Treasury Federal Award Number(s): CPFFN0186 Federal Award Year(s): 2022 Compliance Requirement(s) Affected: Subrecipient Monitoring Type of Finding: Noncompliance Repeat Finding: Not applicable Criteria: In accordance with 2 CFR § 200.332(e), a pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward. Condition and Context: Arkansas State Broadband Office (ASBO) procedures require subrecipients to maintain an irrevocable standby letter of credit equal to 100% of the grant award amount disbursed. The irrevocable standby letter of credit must be accompanied by an opinion letter from the subrecipient’s legal counsel stating the letter of credit and its proceeds will not be subject to a Chapter 11 bankruptcy proceeding. The letter of credit must remain in place until the project is completed. In lieu of a letter of credit, the subrecipient may furnish a performance bond in an amount equal to the grant award. ALA reviewed 5 of 20 projects to determine if the letter of credit or performance bond for the appropriate amount was properly maintained by the subrecipient. ALA noted that a letter of credit was not maintained for the required amount for 1 of the 5 projects reviewed. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: ASBO management did not adequately monitor subrecipients to ensure compliance with letter of credit requirements. Effect: Failure to properly monitor subrecipients could result in noncompliance with federal laws and regulations. Recommendation: ALA staff recommend the Agency ensure subrecipients maintain a letter of credit in accordance with ASBO requirements. Views of Responsible Officials and Planned Corrective Action: ASBO acknowledges the auditor’s observation that, for one project reviewed, the required irrevocable standby letter of credit was not maintained at the full amount required under ASBO procedures. ASBO recognizes that ongoing monitoring of letter of credit requirements is an important safeguard to ensure subrecipient compliance and protect program funds. No questioned costs were identified in connection with this matter. ASBO has implemented enhanced monitoring procedures to verify and document that required letters of credit or performance bonds are maintained at the appropriate level throughout the project period. This includes periodic verification and documented review to ensure continued compliance with program requirements. Anticipated Completion Date: June 30, 2026 Contact Person: Glen Howie State Broadband Director Arkansas State Broadband Office 1 Commerce Way Little Rock, AR 72202 (501) 683-6000 broadband@arkansas.gov
Finding 2025-005: CDBG Subrecipient Monitoring At Metro Government’s Office of Housing and Community Development (“OHCD”) Needs Improvement Federal Program: ALN 14.218 Community Development Block/Entitlement Grants Name of Federal Agency: U.S. Department of Housing and Urban Development Award Identification Number and Year: B-21-MC-21-0008, B-22-MC-21-0008, B-20-MC-21-0008, B-18-MC-0008, B-23-MC-21-0008, and B-24-MC-211-008 Name of pass-through entity: N/A COVID Identification: No Amount of Questioned Costs: N/A Compliance Requirement: Subrecipient monitoring Criteria:The Metro Government Subrecipient Management Policy Manual states, “Title 2 CFR 200.332 requires all pass-through entities to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations and the terms and conditions of the subaward to determine the appropriate monitoring needed to ensure Federal funds are used properly. Passthrough entities are not required to complete a risk assessment on contractors. Metro agencies must complete risk assessments on all subrecipients no less than annually.” 2 CFR 200.332(c) states, “Evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient’s risk, a pass-through entity should consider the following: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also received Federal awards directly from the Federal agency).” Condition: During FY 2025, a total of $9,780,961 in CDBG funds were distributed to 21 subrecipients by Metro Government. Monitoring these subrecipients was conducted by two offices. The Office of Social Services (“OSS”) monitored 11 subrecipients totaling $5,306,082. The Office of Housing and Community Development (“OHCD”) was responsible for monitoring 10 subrecipients totaling $4,474,879. OSS is responsible for monitoring the subrecipients that have subawards for CDBG operating and service projects. OSS completes the following procedures when monitoring their subrecipients: completing a risk assessment spreadsheet, maintaining a historic log documenting the dates of when each subrecipient was monitored, and desk reviews and/or site visits. High risk subrecipients are monitored more frequently compared to those assessed at a lower risk. Subrecipients are required to be monitored at least once every three years. The OHCD is responsible for monitoring subrecipients that have subawards for CDBG capital projects. OHCD conducts informal, undocumented risk assessments of subrecipients. No site visits were conducted in fiscal year 2025. Effect: The OHCD did not adequately monitor its subrecipients during fiscal year 2025. Cause: The OHCD did not have a designated individual responsible for subrecipient monitoring during fiscal year 2025. Recommendation: We recommend the OHCD adopt the procedures and documentation practices established by OSS. Specifically, this includes conducting site visits, assessing each subrecipient’s risk of noncompliance, performing desk reviews and site visits, and maintaining comprehensive documentation of risk assessment and monitoring activities.
Finding #2025-001: #84.048 -Career and Technical Education - Basic Grants to States Federal Grantor Agency: U.S. Department of Education Compliance Requirement: Subrecipient Monitoring Condition: During our audit procedures, we noted that the District does not have formal, written procedures governing subrecipient monitoring. Although the District reviews supporting documentation—such as invoices—submitted by subrecipient schools prior to submitting claims to the Department of Public Instruction (DPI), these practices are not documented in an established policy or procedure. Criteria: Uniform Guidance (2 CFR 200.331–200.332) requires pass-through entities to establish and implement written procedures for monitoring subrecipients to ensure compliance with federal program requirements and achievement of performance goals. Cause: The District has not developed or implemented formal written policies and procedures for subrecipient monitoring. Effect: In the absence of formalized procedures, the District’s monitoring practices may be applied inconsistently, increasing the risk of unallowable costs, noncompliance with federal requirements, or misunderstandings between the District and its subrecipients. This could lead to questioned costs or administrative issues during oversight by DPI or other regulatory bodies. Recommendation: We recommend that the District develop and adopt formal written procedures outlining its subrecipient monitoring activities. These procedures should clearly describe monitoring responsibilities, required documentation, review steps, communication expectations, and follow-up actions. Implementing a formalized process will help ensure consistent oversight and compliance with federal regulations. Grantee Response: The District will develop and implement written procedures that outline the required monitoring steps, documentation standards, communication protocols, and follow-up expectations for subrecipient oversight. These procedures will align with the requirements of Uniform Guidance and DPI expectations.
Federal Agency: U.S. Department of Housing and Urban Development Federal Program Name: Home Investment Partnerships Program Assistance Listing Number: 14.239 Federal Award Identification Number and Year: M24-MC-51-0001, 2024 Award Period: 10/1/2023 to 9/30/2033 Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control, Other Matter Criteria or Specific Requirement: Internal Control: Per 2 CFR Section 200.303(a), a non-Federal entity must: Establish and maintaineffective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and theterms and conditions of the Federal award. These internal controls should comply with guidance in“Standards for Internal Control in the Federal Government” issued by the Comptroller General of theUnited States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance: 2 CFR §200.332(a) - Requirements for Pass-Through Entities states, in part, that all passthrough entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward: (i) Subrecipient's name (must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated in the subaward; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity; (xii) Assistance Listings title and number; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement; (xiii) Identification of whether the Federal award is for research and development; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is used in accordance with § 200.414). Condition: The City did not furnish the information below to subrecipients at the time the subawards were issued: a. Federal Award Identification Number (FAIN) b. Subaward Budget Period Start and End Date c. Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA) d. Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity e. Assistance Listings title and number f. the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement g. Identification of whether the Federal award is for research and development. Questioned Costs: None Context: The City failed to include the required information as noted above in the subrecipient agreements. Cause: The City failed to include all required information in the subrecipient agreements. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about program-specific regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in subrecipients’ Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Repeat Finding: No Recommendation: The City should review and enhance its internal controls and procedures to ensure that all required information is included in subawards at the time of issuance and maintained in subsequent modifications. Views of Responsible Officials: There is no disagreement with the audit finding and the City will undertake additional training for departments in FY 2026, to include providing departments with a grants responsibility checklist.
2025-004-Subrecipient Monitoring Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Assistance Listing Number: 21.027 Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance (Modified Opinion) Criteria: Per 2 CFR sections 200.332(d) through (f), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves the performance goals. Per 2 CFR section 200.502(a), the determination of when a Federal award is expended must be based on when the activity related to the Federal award occurs which is generally expenditure/expense transactions associated with awards. Condition: During our testing over subrecipient monitoring, the County was unable to provide subrecipient monitoring support. Questioned Costs: None Context: We selected a sample of 7 subrecipients as part of our testing over Subrecipient Monitoring. Of the 7 subrecipients selected, the County was unable to provide adequate support for the subrecipients selected. Cause: The County has policies that require departments to conduct subrecipient monitoring to ensure compliance with grant requirements. However, the policy does not include documentation of these monitoring activities, such as site visits, financial reviews, or performance evaluations. This lack of documentation results in an inability to verify that subrecipient monitoring is being performed effectively and consistently. Effect: Without proper oversight, subrecipients may fail to achieve program goals and objectives, leading to poor performance and outcomes for the funded programs. Repeat Finding: Yes Recommendation: We recommend that the County implement procedures to ensure that federal guidance is followed related to subrecipient monitoring and provide training on these procedures, including maintaining documentation of the review performed by the County. View of Responsible Officials: There is no disagreement with the audit finding.
2025-001 Subrecipient Monitoring Program Information Federal Organization U.S Department of Health and Human Services Assistance Listing Number 93.912 Rural Health Care Services Outreach, Rural Health Network Development, and Small Health Care Provider Quality Improvement Award Numbers GA1RH33517, G28RH46280 Criteria [X] Compliance Finding [ ] Significant Deficiency [X] Material Weakness Title 2 U.S. Code of Federal Regulations (CFR) 200.332 requires that passthrough entities monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward. Pass-through entities must review financial and performance reports, to ensure the goals and objectives of the awards are achieved and are required to verify that subrecipients are audited as required by Uniform Guidance, when applicable. Condition During our testing of subrecipient monitoring, we noted that the Network does not have any documented policies and procedures regarding the monitoring of subrecipients. Monitoring activities performed were not sufficient to ensure subrecipient compliance with federal statutes, regulations, and the terms and conditions of the subawards. This finding appears to be a systemic problem. Cause Management does not have a documented policy for monitoring its subrecipients and ensuring the requirements for pass-through entities are met. Effect Without a documented policy to monitor subrecipients, there is an increased risk that noncompliance or performance issues at subrecipients may not be timely identified, addressed, or documented. This may result in the Network being noncompliant with Uniform Guidance and could result in questioned costs and adversely impact the Network’s federal funding. Questioned Costs None noted. Context In a sample of 2 out of 7 subrecipients, we noted that the Network’s monitoring procedures were limited to the review and approval of expenditures based on subrecipient invoice submissions and quarterly performance reports provided by the subrecipients. Recommendation We recommend that the Network develop and implement formal written policies for monitoring subrecipients. These policies should specify both financial and programmatic monitoring procedures, including annual risk assessments for all subrecipients. Based on the assessed level of risk, the Network should perform additional monitoring activities as appropriate, such as trainings, site visits, or enhanced oversight. In addition, we recommend that the Network establish procedures to track, document, and follow up on all monitoring activities, including audit findings and related corrective actions. Views of responsible officials and planned corrective action Management agrees with 2025-001 Subrecipient Monitoring on the schedule of findings and questioned costs. KCHN did not consistently perform and/or document required subrecipient monitoring activities.
Finding Number: 2025-002 Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Pass-through Entity: N/A- Direct Award Federal Agency: Department of Housing and Urban Development Federal Award Year: July 1, 2024 – June 30, 2025 Compliance Requirement: Subrecipient Monitoring Type of finding: Material weakness and material noncompliance Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City has not implemented the designed controls and procedures to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated and level of monitoring is determined. • Appropriate monitoring and review of the subrecipient based on their risk of noncompliance. • Ensure that subrecipients are not suspended or debarred prior to entering into a contract with the City. Cause The City does not have formal written policies, procedures, and internal controls in place to ensure that all required subrecipient monitoring procedures are performed.Proper perspective During our audit, we noted that four of the four subrecipients selected for testing did not have a completed risk assessment to determine their risk of noncompliance. As such, we were unable to determine that the proper level of monitoring was completed throughout the fiscal year over the contracted subrecipient. Additionally, there was no evidence that the City ensured the subrecipient was not suspended or debarred from working under a federal engagement prior to entering into the contract. Possible asserted effect Lack of effective controls over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned costs None Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding Yes, 2024-003 Recommendation We recommend the City establish a checklist or formal documentation to assess each subrecipient and their risk of non compliance prior to entering into a formal contract. The City should then use this risk assessment to determine the level of monitoring that is required throughout the term of the contract. Views of responsible officials and corrective actions The City has established a Risk Assessment tool that rates each HOPWA subrecipient across nine factors: 1) award amount, 2) timeliness of reporting, 3) timeliness of invoicing, 4) quality of reporting, 5) program complexity, 6) staff capacity, 7) staff turnover, 8) management changes, and 9) grantee history. The City will use this tool to determine the appropriate level and frequency of monitoring for each subrecipient.
Finding Number: 2025-005 Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Pass-through Entity: N/A- Direct Award Federal Agency: U.S. Department of Treasury Federal Award Year: July 1, 2024–June 30, 2025 Compliance Requirement: Subrecipient Monitoring Type of finding: Material weakness and material noncompliance Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have effective controls in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated and level of monitoring is determined. • Verification and review that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. • All required elements of the subrecipient contracts are included during execution. Cause The City’s lack of effective internal controls which caused the following noncompliance and control exceptions.Proper perspective During the audit, we noted that six of the nine subrecipient selections did not contain all the required elements of the contract. Additionally, for nine of the nine selections, the City did not complete a risk assessment or conclude on the subrecipient's risk of noncompliance. We also noted that for two of the subrecipients that required a single audit, there was no evidence to support the nature and extent of the City's review of those audit reports. Therefore, we were unable to determine, based on the subrecipient's risk assessment and single audit reports, the proper level of monitoring procedures to be performed. Possible asserted effect Lack of effective controls over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned costs None Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding Yes, 2024-009 Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining and reviewing the documentation. The City should then conclude on and document the subrecipient’s risk of noncompliance based on the checklist to ensure the proper level of monitoring occurs throughout the year. Views of responsible officials and corrective actions The city already established a well-designed internal control manual of policies and procedures over the ARPA grant's full cycle grant management, as well as various templates to evaluate the subrecipients' risks and monitoring their performances. In FY26, the city will implement its internal control by conducting timely subrecipient monitoring activities with signed documents
Finding No. 2025-043 Federal Awarding Agency: USDOC Impact: Significant Deficiency, Noncompliance AL Number and Title: 11.438 PCSRT Federal Award Number: NA24NMFX438G0056 Applicable Compliance Requirement: Subrecipient Monitoring Condition: A review of six FY 25 PCSRT subrecipients’ subaward agreements found that one did not include an accurate unique entity identifier (UEI) that matched the subrecipient’s name. Context: All federal award recipients are required to have a UEI. DFG enters into awards with subrecipients using a subaward agreement. The subaward agreement lists the federal requirements that pertain to the subaward and must identify the subrecipient’s UEI. The audit reviewed six subaward agreements, and found that one contained an incorrect UEI. Cause: The finding was caused by human error. In preparing the subaward agreement, staff copied and pasted the UEI from a different subrecipient’s information. Supervisory review procedures were insufficient to detect and correct the error. Criteria: Title 2 CFR 200.332 requires pass-through entities to ensure that every subaward includes the required information at the time of the subaward. Required information includes the subrecipient’s name, which must match the name associated with the subrecipient’s UEI. Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the State is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Effect: Not providing the correct UEI number hampers subaward reporting and may limit federal oversight of the PCSRT program. Questioned Costs: None Recommendation: DFG’s Commercial Fisheries Division director should strengthen supervisory review procedures to ensure federally required information is accurately identified in PCSRT subaward agreements. Views of Responsible Officials: ADFG disagrees with this finding. During the audit, it was noted that the UEI listed in the subaward agreement contained a copy-and-paste error. This discrepancy was promptly corrected once identified. Under 2 CFR 170, the official compliance requirement for subaward reporting is the Federal Funding Accountability and Transparency Act (FFATA) submission through SAM.gov. In this case: The correct UEI was verified in SAM.gov. The FFATA report contained the correct UEI and was submitted timely. The correct subrecipient was paid, and supporting documentation confirmed the subrecipient’ s identity. These facts demonstrate that the federal reporting requirement was met and that the error was limited to the internal agreement. The issue did not result in improper payments, misreporting to federal systems, or a breakdown in internal controls. This was an isolated clerical error that was promptly corrected during the audit. It does not represent a significant deficiency or material weakness. This seems more appropriately categorized as a minor observation or management comment regarding document review processes. Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise the finding. DFG management asserts the unique entity identifier number incorrectly recorded in the subaward agreement was correctly reported to sam.gov. However, the reporting of the subaward to sam.gov is a reporting requirement. DFG management is responsible for complying with federalsubrecipient monitoring requirements. We reaffirm the finding.
Finding No. 2025-031 Prior Audit Finding: 2024-037 Federal Awarding Agency: USDHS Impact: Material Weakness, Material Noncompliance AL Number and Title: 97.036 Disaster Grants 97.036 Disaster Grants – COVID-19 Federal Award Number: 4533DRAKP00000001, 4730DRAKP00000001 Applicable Compliance Requirement: Subrecipient Monitoring Condition: A review of 21 FY 25 Disaster Grants subrecipient obligating award documents (OAD) found that three did not include an accurate unique entity identifier (UEI) that matched the subrecipient’s name and one did not provide a UEI. Context: DMVA enters into awards with subrecipients using the OAD as the subgrant agreement. The subrecipient’s name and UEI are recorded on the OAD. An assurances and agreement form accompanies the OAD that includes additional federal requirements not included in the OAD. Subrecipients sign the OAD and the assurances and agreement forms certifying and agreeing to the federal requirements. According to DHSEM management, due to the high number of State disasters and a lack of staff resources, contractors were hired to help evaluate applicant eligibility, make subawards, conduct risk assessments, and monitor accordingly. The audit reviewed a random sample of 20 of 100 subrecipient OADs and one judgmentally selected OAD, including assurances and agreement forms, and found two OADs for one subrecipient in which the subrecipient’s name did not match the name associated with the UEI number provided; one OAD reported a UEI number that did not match the name and address when verified with the federal reporting website; and one OAD did not include a UEI number. Cause: According to DHSEM management, due to competing priorities and inadequate supervisory review procedures, DHSEM staff and contractors did not ensure subrecipient’s OADs included a UEI number or an accurate UEI number. Criteria: Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal control over the federal award that provides reasonable assurance that the State is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the grant awards. Title 2 CFR 200.332 requires pass-through entities ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the required information at the time of the subaward. Required information includes the subrecipient’s name, which must match the name associated with the subrecipient’s UEI. Effect: Not providing the UEI number or correct UEI number hampers subaward reporting and may impact federal oversight of the Disaster Grants program. Questioned Costs: None Recommendation: DMVA’s DHSEM director should strengthen review procedures to adequately monitor contractors to ensure subrecipient information in award documents is accurate. Views of Responsible Officials: Management agrees with this finding.
Finding No. 2025-033 Federal Awarding Agency: USDHS Impact: Material Weakness, Material Noncompliance AL Number and Title: 97.036 Disaster Grants 97.036 Disaster Grants – COVID-19 Federal Award Number: 4533DRAKP00000001, 4730DRAKP00000001 Applicable Compliance Requirement: Subrecipient Monitoring Condition: DMVA staff did not document a risk assessment for two Disaster Grants subrecipients. Context: DMVA receives funding applications from state, local, tribal, and private not-for-profit entities once a disaster has been presidentially declared. Prior to entering into an agreement with an applicant, DHSEM staff perform a risk assessment of the applicant to determine the extent of subrecipient monitoring. DHSEM staff evaluate the applicant by completing a risk assessment checklist, and apply safeguards if the subrecipient is considered high risk. DHSEM staff also complete a payment request checklist, prior to making subrecipient payments to confirm that risk assessments have been performed. According to DHSEM management, due to the high number of State disasters and a lack of staff resources, contractors were hired to help evaluate applicant eligibility, make subawards, conduct risk assessments, and monitor accordingly. The audit reviewed a random sample of eight of 47 subrecipients. One of the eight subrecipients did not have a risk assessment. During allowable cost testing, one additional subrecipient was identified that did not have risk assessment performed. Cause: Due to competing priorities and inadequate supervisory review procedures, DHSEM staff and contractors did not consistently obtain risk assessments and DHSEM management did not adequately monitor contractors to ensure risk assessments were performed. Criteria: Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal control over the federal award that provides reasonable assurance that the State is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the grant awards. Title 2 CFR 200.332(c) requires the State to assess each subrecipient’s risk of noncompliance to determine the appropriate subrecipient monitoring. Effect: The lack of risk assessments may lead to inadequate monitoring of subrecipients increasing the risk of unallowable use of federal funds. Questioned Costs: None Recommendation: DMVA’s DHSEM director should strengthen supervisory review procedures to adequately monitor contractors and ensure risk assessments are performed. Views of Responsible Officials: Management agrees with this finding.
FINDING 2025-015 Federal Program Information: Research and Development Cluster (various ALN #’s) Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): C. Cash Management - per 2 CFR Part 200.305(b)(3), when the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the federal agency or pass-through entity reasonably believes the request to be improper. M. Subrecipient Monitoring – per 2 CFR Part 200.332(e)(1), a pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must review financial and performance reports. Additionally, in accordance with 2 CFR 200.332(g), a pass-through entity must verify that a subrecipient is audited as required by Subpart F of Part 200. Condition: The University’s procedures failed to minimize the time elapsing between the transfer of federal funds to the subrecipient and the disbursement of such funds for program purposes by the subrecipient. The University was unable to provide documentation evidencing appropriate, annual review of its subrecipients’ Single Audit reports. Cause: Administrative oversight and insufficient internal controls. Effect or Potential Effect: The University was not in compliance with the requirements for pass-through entities. Questioned Costs: None. Context: • For 3 of 23 subrecipient payments tested, the University was unable to provide documentation evidencing appropriate review by the principal investigator. • For 6 of 23 subrecipients payments tested, payment was not made within the required timeframe. • For 7 of 7 subrecipients tested, the University was unable to evidence its verification of whether an audit had been performed. Identification as a Repeat Finding: This is a repeat of prior year finding 2024-013. Recommendation We recommend that the University enhance subrecipient monitoring controls by implementing documented invoice review protocols and enforcing annual audit verification procedures for all subrecipients. Management should define responsibilities for these reviews, document oversight activities performed, and implement monitoring controls to ensure compliance with federal subrecipient monitoring requirements. Views of Responsible Officials: In response to the auditor’s recommendation to enhance internal controls and ensure timely review of invoice protocols and subrecipient monitoring, Howard University is implementing the following: • The University is currently piloting a new Supplier Invoice Portal, launched jointly by the Sponsored Programs Office and the Office of Procurement, to improve invoicing efficiency and compliance. Under this new process, subrecipients will be required to submit invoices electronically in accordance with the terms and conditions of their subawards. The portal will support a streamlined review and approval process, with invoices routed through an automated workflow to ensure timely review and disbursement. • To support completion of the University’s annual audit verification requirements for subrecipients, oversight will occur at multiple stages throughout the subaward lifecycle. This includes reviewing audit reports at the proposal development stage, during which subrecipients are required to complete a Subrecipient Commitment Form (implemented September 2025) prior to proposal submission. • At the award stage, refreshed due diligence will be conducted, including a re-review of the subrecipient’s Single Audit and/or financial statements. Finally, the Post Award Compliance team will perform an annual review of subrecipients’ audit reports and complete audit follow up procedures as necessary.
Reference Number: 2025-019 Prior Year Finding: 2024-014 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (4/1/2022 – 6/30/2025) 23A55AY000020 (4/2/2023 – 6/30/2026) 23A55AT000036 (7/1/2023 – 6/30/2026) 23A55AW000048 (7/1/2023 – 6/30/2026) 24A55AY000057 (4/1/2024 – 6/30/2027) 24A55AT000067 (7/1/2024 – 6/30/2027) 24A55AW000097 (7/1/2024 – 6/30/2027) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued to their subrecipients. Context: For six of six subawards selected for testing, the subaward agreement did not include the federal award date for when the Federal agency awarded the funds to the prime recipient. Cause: The Department’s procedures and internal controls were not sufficient to ensure that subawards included all required information in accordance with 2 CFR section 200.332. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program information and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. In its FY 2024 corrective action plan, the Department indicated that it had revised its documented internal controls and procedures to correct the prior year finding. We recommend that the Department revisit its procedures and controls and update as needed to ensure that the federal award date is included in all subaward agreements. Views of responsible officials: There is no disagreement with the finding.
Reference Number: 2025-023 Prior Year Finding: 2024-018 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Aging and Independence Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2201MAOAPH (10/1/2021 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2201MAOANS (10/1/2021 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) 2301MAOAPH (10/1/2022 - 9/30/2025) 2301MAOASS (10/1/2022 - 9/30/2024) 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOACM (10/1/2023 - 9/30/2025) 2401MAOAHD (10/1/2023 - 9/30/2025) 2501MAOANS (10/1/2024 - 9/30/2026) 2501MAOASS (10/1/2024 - 9/30/2026) 2501MAOACM (10/1/2024 - 9/30/2026) 2501MAOAHD (10/1/2024 - 9/30/2026) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Per 2 CFR section 200.332(e) and (g), pass-through entities must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must review financial and performance reports, ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward, issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity, resolve audit findings specifically related to the subaward, and verify that a subrecipient is audited as required by Subpart F. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Aging and Independence (Department) issued subawards that did not contain all required federal award information, and it failed to properly monitor subrecipients. Context: Exceptions were found for eight of eight subawards selected for testing. Subawards were missing one or more required federal award identification elements and were not properly monitored. Specifically, we noted the following: • 4 of 8 subawards were missing one or more required award identification elements including the Federal Award Date, the Federal Award Identification Number (FAIN), the name of the Federal agency, the Assistance Listing number (ALN) and the federal award title, the dollar amount made available under each ALN, and the federal award project description as required by the Federal Funding Accountability and Transparency Act (FFATA). • 2 of 8 subrecipients selected for testing were not properly monitored by the Department. The Department was unable to provide documentation that it had proper monitoring procedures in place nor that monitoring procedures were followed for these subrecipients. • For 1 of 8 subrecipients, the Department did not obtain a copy of the subrecipient’s annual single audit report. Therefore, the Department did not verify that its annual single audit had been conducted, nor did it issue a management decision on audit findings. Questioned costs: Undetermined. Cause: The Department’s procedures and internal controls were not sufficient to ensure that the Department provided all required federal information to subrecipients at the time of the subaward nor that subrecipient monitoring was completed in accordance with the requirements of the federal programs. Auditors noted that the Department’s corrective action plan from the prior audit had not been completed. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. The Department should review and enhance internal controls and procedures to ensure that it includes all required information in the subaward agreements. We also recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal programs. Views of responsible officials: There is no disagreement with the finding.
Reference Number: 2025-027 Prior Year Finding: 2024-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 19NU50CK000518 (8/1/2022 – 7/31/2027) 24NU51CK000343 (8/1/2024 – 7/31/2025) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Per 2 CFR section 200.332(e) and (g), pass-through entities must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must review financial and performance reports, ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward, issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity, resolve audit findings specifically related to the subaward, and verify that a subrecipient is audited as required by Subpart F. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not properly monitor subrecipients and the Department omitted required federal award information from subawards. Context: Eight subawards issued to eight subrecipients were selected for testing. Specifically, we noted the following exceptions: • For eight of eight subrecipients selected for testing, the Department did not adequately monitor the subrecipients. It did not obtain a copy of the subrecipients’ annual single audit report. Therefore, the Department did not verify that the annual single audits had been conducted, nor did it issue a management decision on any audit findings. • For eight of eight subawards selected for testing, the Federal Award Identification Number (FAIN) was omitted from the subaward agreements. Cause: The Department’s procedures were not sufficient to ensure that subrecipients were properly monitored, nor that subawards included all required information. Internal controls did not detect or prevent the errors. The Department had not completed implementation of its corrective action plan from the prior year. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Questioned costs: None. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. We recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal program. The Department should review and enhance internal controls and procedures to ensure that it includes all required information in the subaward agreements. Views of responsible officials: There is no disagreement with the finding.
Reference Number: 2025-035 Prior Year Finding: 2024-036 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: 1H79TI085778 (9/30/2021 – 9/29/2024) 5H79TI085778 (9/30/2022 – 9/29/2024) 6H79TI085778 (9/30/2023 – 9/30/2025) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Per 2 CFR section 200.332(e) and (g), pass-through entities must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must review financial and performance reports, ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward, issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity, resolve audit findings specifically related to the subaward, and verify that a subrecipient is audited as required by Subpart F. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not properly monitor subrecipients and the Department omitted required federal award information from subawards. Context: Thirteen subawards issued to thirteen subrecipients were selected for testing. Specifically, we noted the following exceptions: • 1 of 13 subawards was missing the Federal Award Identification Number (FAIN). • For 2 of 13 subrecipients selected for testing, the Department did not adequately monitor the subrecipients. The Department did not obtain a copy of the subrecipients’ annual single audit report. Therefore, the Department did not verify that the annual single audits had been conducted, nor did it issue a management decision on audit findings. Cause: The Department had not yet fully implemented its corrective action plan from the prior year. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program requirements and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Questioned costs: None. Recommendation: We recommend the Department complete its corrective action plan from the prior year. The Department should verify that its internal controls and procedures are sufficient to ensure subrecipient monitoring is performed in compliance with the requirements of the federal program and that all required information is included in subaward agreements. Views of responsible officials: There is no disagreement with the finding.
Finding 2025-007: Pre-Award Risk Assessment for Sub-Recipient (Significant Deficiency) Federal Agency: National Institute of Health Federal Program: All of Us Research Program Assistance Listing Number: 93.368 Criteria: As stated in 2 CFR 200.331 part (b), all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures to prescribe to each individual subrecipient. Condition: During our testing performed over subrecipient expenditures, we were unable to obtain evidence that pre-award risk assessment procedures were performed over subrecipients, consistent with 2 CFR §200.332(b). As such, the Foundation did not adequately determine appropriate monitoring procedures over the sub-recipients. Cause: The Foundation does not have established internal controls or policies regarding subrecipients. Effect or Potential Effect: The Organization could inadvertently be engaged in relationships with subrecipients of higher risk without the appropriate level of oversight to ensure subrecipients are expending funds in accordance with the provisions and terms of the subaward. Questioned Costs: None noted as this compliance requirement is a administrative reporting requirement that does not impact cost eligibility. Context: Our audit procedures consisted of substantive testwork over a sample of subrecipients. We consider our sample to be representative of the population. The samples were made using statistical sampling and we believe the condition appeared to be systematic in nature. Identification as a Repeat Finding: Not a repeat finding. Recommendation: We recommend the Foundation formalize internal control procedures and policies with respect to sub-recipient pre-award risk assessment. The risk assessments should be conducted in order to establish appropriate monitoring procedures.
Subrecipient Monitoring Program Name: Crime Victim Assistance (Assistance Listing 16.575) Federal Award Agency: Department of Justice Award Years: Federal Fiscal Years 2021, 2022, and 2023 Federal Award Numbers: 15POVC-21-GG-00615-ASSI, 15POVC-22-GG-00715-ASSI, and 15 POVC-23-GG-00433-ASSI Background The Crime Victim Assistance program provides financial support and various services and resources to crime victims, including crisis counseling, criminal justice support and advocacy, shelter, and therapy. The Judicial Branch provides grants to subrecipients to provide these services. Title 28 U.S Code of Federal Regulations (CFR) Part 94.118 provides that subrecipients shall contribute not less than 20% of the total cost of each project. Subrecipients shall derive these contributions from non-federal sources. Each subrecipient shall maintain records that clearly show the source and amount of the matching contributions.Criteria Title 2 CFR Part 200.303 requires the non-federal entity to establish and maintain effective internal control over federal awards that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 2 CFR Part 200.332(e) provides that the pass-through entity shall monitor subrecipient activities as necessary to ensure that they comply with federal statutes, regulations, and the terms and conditions of the subaward. Title 28 CFR Part 94.106 provides that the state administering agency shall conduct regular desk monitoring of all subrecipients as well as on-site monitoring of all subrecipients at least once every two years during the award period. The state shall maintain a copy of site visit results and other documents related to compliance. Title 2 CFR Part 200.306(b) provides that the pass-through entity must accept any cost sharing funds as part of the subrecipient’s contributions to a program when the funds are verifiable in the subrecipient’s records. Condition The Judicial Branch did not perform regular subrecipient desk reviews or site visits at least once every two years during the award period as required by federal regulations. The branch does not complete reviews until the award period ends. As a result, it did not promptly examine subrecipients’ underlying documentation such as invoices, timesheets, or support for expenditures or matching contributions. The branch’s monitoring process was limited to monthly reviews of budget-to-actual summaries. Context During the fiscal year ended June 30, 2025, the branch made $8,759,482 in reimbursements to 40 subrecipients.Questioned Costs $0Effect The Judicial Branch has limited assurance that subrecipients used federal funds for allowable activities and met the mandatory matching requirements. This could potentially lead to future disallowed costs and federal repayment obligations.Cause Due to a lack of adequate staffing, the Judicial Branch prioritized reviewing supporting documentation for prior award periods rather than the current period. Prior Audit Finding We have not previously reported this finding.Recommendation The Judicial Branch should strengthen internal controls to ensure it complies with federal subrecipient monitoring requirements for the Crime Victim Assistance program. Views of Responsible Officials “The Judicial Branch Office of Victim Services (OVS) agrees to strengthen its internal controls as described below to comply with federal subrecipient monitoring requirements for the Victims of Crime Act Assistance (VOCA) Program. In 2025, OVS performed site visits for four VOCA-funded programs and completed financial-desk reviews of monthly or quarterly financial reports for all programs. That year, OVS experienced personnel turnover in its three-employee Fiscal Services Unit, notably the separation from state service of a Program Manager and a Court Planner, who together performed OVS’ programmatic site visits of VOCA-funded programs. Also, there was a significant increase in workload resulting from OVS’ contributions to the 2024-2025 VOCA request-for-proposal process. In response, staff outside the unit contributed while managing other assigned duties, a Program Manager and Grants and Contract Specialist were hired to restore the unit to its three-employee configuration, the new employees received training on subrecipient monitoring policies and procedures, and a revised subrecipient site visit plan was developed and has begun being implemented. To strengthen internal controls, OVS has developed a revised site visit plan for the remaining VOCA-funded programs scheduled to receive site visits in 2025. April 15, 2026, is the anticipated date for OVS to complete the site visits. OVS has completed sending letters to the subrecipients operating the VOCA-funded programs. The letters request supporting documentation, which is programmatic and financial in nature, in accordance with OVS administrative policy and procedure. Also, the letters inform subrecipients that site visits will commence in accordance with a revised site visit plan.”
Subrecipient Monitoring Program Name: Temporary Assistance for Needy Families (TANF) (Assistance Listing 93.558) Federal Award Agency: United States Department of Health and Human Services Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Numbers: 2401CTTANF and 2501CTTANF Background The Department of Social Services (DSS) is the designated single state agency to administer Temporary Assistance for Needy Families (TANF) in accordance with Title 45 U.S. Code of Federal Regulations (CFR) Part 205.100. Connecticut administers certain aspects of TANF through several state agencies including the Department of Children and Families (DCF). DSS and DCF have a memorandum of understanding (MOU) which specifies each agency's responsibilities for administering programs in the TANF State Plan. DSS claims the state's use of federal TANF funds for home and community-based services provided to DCF's TANF-eligible clients. DCF enters into agreements with these subrecipients and pays them quarterly advances. DCF makes payments to Youth Service Bureaus claimed under the TANF program. Criteria Title 2 CFR Part 200.332(g) requires the pass-through entity to verify that subrecipients met their audit requirements for the fiscal year. Condition Our review of subrecipient monitoring over ten subrecipients that received $6,672,958 in TANF funds disclosed that DCF did not complete four annual fiscal reviews to ensure that subrecipients met their audit requirements for the fiscal year. Two of the ten subrecipients and two of the four exceptions were Youth Service Bureaus. Further review disclosed that DCF lacked procedures to perform annual reviews for Youth Service Bureau subrecipients. Context During the fiscal year ended June 30, 2025, DSS claimed $52,557,463 in DCF expenditures for various home and community-based services provided to 132 subrecipients, including $3,785,630 in expenditures for 102 Youth Service Bureau subrecipients. The sample was not statistically valid. Questioned Costs $0 Effect DSS and DCF have limited assurance that federal funds were used for allowable activities. Cause DCF experienced staffing limitations and competing priorities. DCF lacked management oversight over Youth Service Bureau subrecipients. Prior Audit Finding We previously reported this as finding 2024-024 and in two prior audits. Recommendation The Department of Children and Families should develop procedures to monitor payments to Youth Service Bureaus and strengthen internal controls to ensure compliance with the federal regulations for monitoring subrecipients of the Temporary Assistance for Needy Families program. As the lead agency for TANF, the Department of Social Services should strengthen procedures to ensure that supporting state agencies fulfill their responsibilities in their memorandum of understanding and comply with all federal TANF requirements. Views of Responsible Officials Response provided by the Department of Children and Families: “DCF agrees with this finding and will improve its internal review process to include Youth Services Bureaus and capture all subrecipients' federal single audits.” Response provided by the Department of Social Services: “The Department agrees with this finding. As the lead agency for TANF, DSS will strengthen procedures by requiring DCF to complete and share activities that verify subrecipients meet their audit requirements each fiscal year. DSS worked with an outside agency to review and enhance its subrecipient monitoring procedures. The outcome of this collaboration included training for DSS staff on subrecipient monitoring requirements, communicating expectations to subrecipients about monitoring expectations, a standardized data request, and the creation of a subrecipient monitoring toolkit to be utilized by DSS and its partners.”
Subrecipient Monitoring Program Name: Low-Income Home Energy Assistance Program (LIHEAP) (Assistance Listing 93.568) Federal Award Agency: United States Department of Health and Human Services Award Years: Federal Fiscal Years 2023, 2024, and 2025 Federal Award Numbers: 2301CTLIEA, 2301CTLIEE, 2401CTLIEA, 2401CTLIEI, 2501CTLIEA, and 2501CTLIEI Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.332 provides that the pass-through entity shall monitor subrecipient activities as necessary to ensure that they comply with federal statutes, regulations, and the subaward’s terms and conditions and ensure that they achieve performance goals and objectives. This includes a review of a pass-through entity’s required financial and performance reports. Condition Our review of subrecipient monitoring over nine Low-Income Home Energy Assistance Program (LIHEAP) subrecipients disclosed that the Department of Social Services (DSS) did not conduct annual fiscal reviews for one subrecipient. Context During the fiscal year ended June 30, 2025, DSS provided nine subrecipients with $75,417,156 of LIHEAP funds to administer the program. Questioned Costs $0 Effect DSS has limited assurance that federal funds were used for allowable activities. Cause Low staffing levels hindered the department. DSS lacks proper subrecipient monitoring procedures. Prior Audit Finding We previously reported this as finding 2024-022 and in one prior audit. Recommendation The Department of Social Services should strengthen internal controls to ensure it complies with federal subrecipient monitoring requirements for the Low-Income Home Energy Assistance Program. Views of Responsible Officials “The Department agrees with this finding and is in the process of hiring an additional staff member to assist with subrecipient monitoring. The LIHEAP unit is developing collaboration and cross-training by incorporating program liaisons to monitor portions of the financial requirements which coincide with program fuel slip monitoring reviews. The Department is creating a financial review tool to ensure consistency in the review of data to document in the financial report output.”
Subrecipient Monitoring Program Name: HIV Care Formula Grants (Ryan White HIV/AIDS Program Part B) (Assistance Listing 93.917) Federal Award Agency: United States Department of Health and Human Services Award Year: Federal Fiscal Year 2024 Federal Award Numbers: 5 X07HA00022-33-00 and 6 X07HA00022-34-01 Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.332(e) provides that the pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subrecipient used the subaward for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward and ensure that they achieve performance goals. This includes reviewing financial and performance reports required by the pass-through entity. The Ryan White HIV/AIDS Program Part B Manual requires an annual on-site financial review of all subrecipients to ensure compliance with federal and state requirements and the terms and conditions of the department’s contract. Condition Our review of the Department of Public Health (DPH) monitoring procedures for six not-for-profit and one for-profit subrecipients disclosed that the department did not conduct annual on-site financial review visits for any of the six not-for-profit subrecipients. Context During the fiscal year ended June 30, 2024, DPH provided $4,262,325 to six not-for-profit subrecipients and $21,633,283 to a for-profit subrecipient for AIDS health care and support services. We selected all seven fiscal year 2024 subrecipients for review as DPH had not completed the monitoring site visits for fiscal year 2025 funds. During the fiscal year 2025, the department provided $13,216,793 to subrecipients. Questioned Costs $0 Effect DPH had reduced assurance that its subrecipients used federal funds for allowable activities. Cause The department did not complete the financial reviews for fiscal year 2024 because staff lacked proper training, which was necessary due to new federal compliance requirements and DPH’s recent implementation of new audit software. Prior Audit Finding We previously reported this as finding 2024-201 and in one prior audit. Recommendation The Department of Public Health should strengthen internal controls to ensure compliance with federal requirements for monitoring subrecipients of the Ryan White HIV/AIDS Program Part B. Views of Responsible Officials “We agree with this finding. With the implementation of the new auditing software, Management Assurance will create a comprehensive, trackable financial review program and will ensure the reviews are completed in accordance with Federal guidance. We anticipate having the software fully implemented and the financial review program operational by March 01, 2026; the financial reviewer will be trained on the software and the program requirements no later than May 01, 2026. The financial reviews will begin as soon as possible after the reviewer completes their training; we intend to have a completed financial review for all Ryan White regional leads by year-end 2026.”
Federal Grantor: Department of Housing and Urban Development Program: COVID-19 Community Development Block Grants/Entitlement Grants (CDBG) Program Award No. and Year: B20-MW-19-0003 and 2020, B23-MC-19-0003 and 2023, B24-MC-19-0003 and 2024, B25-MC-19-0003 and 2025 Federal Financial Assistance Listing Number: 14.218 Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria: CFR Section 200.303(a), Internal Controls, states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. CFR Appendix A to Part 170I(a)(2), Reporting Requirements, states the recipient must report each subaward to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the end of the month following the month in which the subaward was issued. Condition: During our testing of the City’s compliance with reporting requirements, we noted the City did not have any formal controls in place over the review and approval of reports. Reports were prepared, certified and submitted by the same individual. Additionally, during our testing, we noted for two (2) subaward reports submitted to FSRS, the information was not submitted timely. Cause: The City did not have a formal review process in place over the reports under the program. Additionally, the City did not have a process in place to ensure reports were submitted to FSRS timely. Effect: Reports could be submitted with inaccurate information. Additionally, reports were not submitted to FSRS in accordance with the reporting requirements per Appendix A to Part 170I(a)(2). Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: A nonstatistical sample of six (6) of eleven (11) reports were selected. The condition above was identified during our testwork of the City’s internal controls over reporting. Repeat Finding from Prior Years: No. Recommendation: We recommend that the City adhere to their policies and procedures in accordance with 2 CFR 200.332 to ensure compliance with subrecipient monitoring requirements. Views of Responsible Officials: Management agrees with the finding. See separate corrective action plan.
FINDING REFERENCE NUMBER 2025-011 FEDERAL PROGRAM (ALN 84.287) TWENTY-FIRST CENTURY COMMUNITY LEARNING CENTERS U.S. DEPARTMENT OF EDUCATION AWARD NUMBERS S287C200039C (07/01/2020 – 09/30/2021); S287C220039C (07/01/2022 – 09/30/2023); S287C220039C (07/01/2022 – 09/30/2023) COMPLIANCE REQUIREMENT SUBRECIPIENT MONITORING TYPE OF FINDING INTERNAL CONTROL AND COMPLIANCE – MATERIAL WEAKNESS AND MATERIAL NONCOMPLIANCE CRITERIA In accordance with 2 CFR § 200.332(f), pass-through entities are required to monitor the activities of subrecipients as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In additions to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by terms and conditions of the award, subaward monitoring must include the following: Reviewing financial and programmatic (performance and special reports) required by PTE, following-up and ensuring that the subrecipients takes timely and appropriate action on all deficiencies pertaining to the Federal award, provide the subrecipient from the PTE detected through audits, on site reviews, and other means, issuing a management decision for audits findings pertaining to the Federal award provided to the subrecipient from the PTE as requires by 2 CFR 200.521(c). STATEMENT OF CONDITION As part of our procedures on subrecipient requirements, based on the subrecipient monitoring procedures established by the PRDE in the “Manual de Programa 21st CCLC”, we requested the risk analysis that established the monitoring plan for a period of three (3) years, this information was not provided for our evaluation. Based on this monitoring plan they established the type of monitoring that they will perform to the subrecipient, site reviews, desk reviews or closing reviews. Based on the terms and conditions of the award all subrecipients are required to submit their Single Audit Reports, for review and evaluation. As part of our audit procedures, we obtained the list of subrecipients active during the fiscal year 2024-2025 with a total of eighteen (18) subrecipients. We selected a sample of four (4) subrecipients to test internal controls and compliance with the subrecipient monitoring requirement related to the submission of Single Audit Reports. During our test we noted the following deficiencies: 1. For one (1) subrecipient the management decision for the audit’s findings reported in the subrecipient Single Audit was not provided for our evaluation. 2. For one (1) subrecipient, they notify that the program expenditures were not included in the entity Schedule of Expenditures of Federal Awards, but no evidence of follow-up about this matter was provided for our evaluation. QUESTIONED COSTS None PERSPECTIVE INFORMATION The PRDE does not maintain an internal control process that provides reasonable assurance of complying with the requirement of receipt, evaluation and issuance of management decisions as required by Federal regulations and the required corrections of any findings and disposition of questioned costs within the required timeframes of the Federal regulations from audit or monitoring process. This is a systemic deficiency. The sampling was a statistically valid sample. STATEMENT OF CAUSE The PRDE did not adequate documentation related to the procedures to comply with the subrecipient monitoring requirements. Although procedures are established in the “Manual de Programa 21st CCLC” no evidence was provided to ensure compliance with the procedures established in the manual. POSSIBLE ASSERTED EFFECT Failure to review subrecipient monitoring requirement increases the risk that audit findings or noncompliance at the subrecipient level may go undetected and unaddressed. This may lead to improper use of Federal funds and noncompliance with Federal requirements. IDENTIFICATION AS A REPEAT FINDING This is a repeat finding (Finding Reference Number 2024-012). RECOMMENDATION We recommend that the PRDE establish and implement formal procedures to: Identify all subrecipients subject to Single Audit requirements, obtain and review their audit reports in a timely manner, follow up on relevant audit findings, and maintain documentation of all monitoring activities performed.
EMERGENCY RENTAL ASSISTANCE PROGRAM – 21.023 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: ERAE0006 Administered by: Rhode Island Department of Administration (DOA), Pandemic Recovery Office (PRO) CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – 21.027 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: SLFRP0136 Administered by: Rhode Island Department of Administration (DOA), Pandemic Recovery Office (PRO) Compliance Requirements: Subrecipient Monitoring; Allowable Costs/Cost Principles SUBRECIPIENT PAYMENTS AND MONITORING Subrecipient monitoring procedures were insufficient to ensure subrecipient audit reports are obtained and reviewed. Monitoring procedures were not in place to ensure adequate documentation was obtained regarding the use of payment advances. Background: The Pandemic Recovery Office, as the administering agency of both the Emergency Rental Assistance Program (ERA) and the State Fiscal Recovery Fund (SFRF), executes memoranda of understanding with the various departments and agencies to conduct projects under the allowable uses of the program. The departments and agencies then often execute subawards within the scope of the specific project. In fiscal 2025, expenditures related to these subawards were primarily executed by the Executive Office of Housing. Criteria: 2 CFR §200.332(e) Requirements for pass-through entities requires that all pass-through entities must “monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved.” That monitoring must include (1) reviewing financial and performance reports, (2) following up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means, (3) issuing a management decision for audit findings pertaining to the Federal award, and (4) resolving audit findings specifically related to the subaward. Uniform Guidance cost principles dictate that, in order to be allowable under Federal awards, costs must be adequately documented (2 CFR §200.403(g)). 2 CFR §200.332(b)(1) requires that subawards clearly identify certain federal award identification information to the subrecipient. Condition: For SFRF, our sample consisted of 34 subawards executed with 20 unique subrecipients. For ERA, our sample consisted of 29 subawards executed with 15 unique subrecipients. In fiscal 2025, subrecipient Single Audit Reports were not obtained and reviewed by the pass-through entity for 19 of the 20 SFRF subrecipients or any of the 15 ERA subrecipients. Note: Between ERA and SFRF, there were 27 unique subrecipients; eight subrecipients received funding from the Executive Office of Housing under both programs. Subrecipients noted under both programs were issued separate subawards for ERA and SFRF. As part of our testing, we performed an independent review of Single Audit Reports submitted to the Federal Audit Clearinghouse (FAC) for each sampled subrecipient to identify if there were any findings reported. While we did not note any findings related to the subawards sampled (i.e. no findings reported on ERA or SFRF), we did note several subrecipient entities with findings reported on internal control over financial reporting and/or internal control over compliance with federal awards on other programs that could be of interest to the pass-through entity in evaluating the level of monitoring necessary for each subrecipient. Additionally, many of these subrecipients receive funding on a periodic basis. Of 34 SFRF subrecipient payments reviewed, 4 were payment advances to subrecipients for which no additional documentation or reconciliation was available to support subrecipient expenditures related to those prepayments. We noted several other subrecipient reimbursement payments for SFRF that were lacking adequate support for the expenditures being reimbursed. We did not note any deficiencies in the review of reimbursement requests for ERA. The Executive Office of Housing (responsible for 32 of the 34 sampled subawards and 18 of the 20 subrecipients under SFRF and all subawards under ERA) made several improvements to its subrecipient monitoring procedures in fiscal year 2026, including periodic site visits (depending on the nature of the project) and requiring subrecipients to submit their Single Audit Report or financial audit report when requesting annual funding. Monitoring deficiencies in fiscal 2025 were significantly impacted by organization restructuring and related resource constraints. We also noted several subawards that were missing certain required federal award identifying information; subawards include an appendix that details the required information. For ERA, we noted 1 subaward that appeared to include the incorrect entity name in the appendix, 1 subaward that was missing the Federal Award Identification Number (FAIN), Assistance Listing Number (ALN), and program title, and 2 instances where a subrecipient had differing Unique Entity IDs (UEIs) between their respective subawards. For SFRF, we noted 4 subawards that did not include the UEI, 3 subawards that did not include the FAIN, 5 subawards that did not include the ALN and program title, and 6 subawards that did not include the federal award date. Cause: Subrecipient monitoring procedures are not in place to ensure audit reports are reviewed and management decisions are issued, as required by Uniform Guidance. Other monitoring procedures were inadequate to ensure that subrecipients appropriately utilized the funds provided to support program objectives. Effect: Noncompliance with program guidelines and/or federal regulations at the subrecipient level could go undetected and unresolved. Questioned Costs: Undetermined Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-039a Enhance internal control procedures to ensure timely review of audit reports and issuance of management decisions in accordance with Uniform Guidance. Ensure review of reports is adequately documented, including notation of findings unrelated to the subaward, which could have an indirect impact on the administration of the subaward. 2025-039b Enhance controls to ensure adequate documentation of monitoring procedures performed and support for subrecipient expenditures is obtained. Document any meetings and/or conversations with the subrecipients and discussion had therein. 2025-039c Continue to strengthen and improve subrecipient monitoring procedures to ensure subrecipient compliance with terms and conditions of the grant award and subaward. 2025-039d Enhance controls to ensure all award identifying information required by 2 CFR §200.332(b)(1) is accurately included in the subaward.
CORONAVIRUS CAPITAL PROJECTS FUND – 21.029 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2022-2027 Federal Award Number: CPFFN0169 Administered by: Rhode Island Department of Administration (DOA), Pandemic Recovery Office (PRO) Compliance Requirement: Subrecipient Monitoring REVIEW OF SUBRECIPIENT AUDIT REPORTS Review of subrecipient audit reports under the Coronavirus Capital Projects Fund can be enhanced to provide detailed documentation of deficiencies that directly or indirectly impact the subawards. Background: Under the Coronavirus Capital Projects Fund (CPF), the State awarded funding to cities and towns to invest in multipurpose community facility projects that directly and jointly enable work, education, and health monitoring. Twenty-one facility projects were awarded to eighteen municipalities across the State. Criteria: 2 CFR §200.332(e) Requirements for pass-through entities requires that all pass-through entities must “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved.” That monitoring must include (1) reviewing financial and performance reports, (2) following up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means, (3) issuing a management decision for audit findings pertaining to the Federal award, and (4) resolving audit findings specifically related to the subaward. Condition: The PRO obtained and documented its review of subrecipient audit reports during fiscal 2025, however, the review did not document the pertinent information related to the CPF subawards. This would include the amount of CPF expenditures, whether the program was audited as major, if any findings were reported and any management decisions issued from PRO if findings existed specific to the subaward. Additionally, any other reported findings that could have an indirect impact on the subrecipient’s administration of the CPF subawards (e.g., a finding on cash management related to a different federal award could indicate an underlying issue that may affect CPF) were not documented. As part of our testing, we performed an independent review of Single Audit Reports submitted to the Federal Audit Clearinghouse (FAC) for each subrecipient to identify if there were any findings reported. No findings were reported on CPF subawards and therefore, no additional follow-up was necessary from the PRO as the pass-through entity. Cause: The scope of subrecipient audit report reviews did not focus on the subaward or other aspects related to the administration of federal programs. Effect: Lack of thorough review could result in reported findings related to CPF subawards not being resolved, as required by Uniform Guidance. Lack of documentation of other findings could impact extent of other monitoring procedures to mitigate risks that may indirectly impact CPF subawards. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-042 Improve documentation of subrecipient audit report reviews to include notation of whether any findings pertained to the CPF subaward that require issuance of a management decision in accordance with Uniform Guidance and whether any other findings reported could indirectly impact the administration of the subaward.
Federal Program: Research and Development Cluster Criteria The College, as a pass-through entity, is required to monitor the activities of subrecipients as necessary to ensure subawards are used for authorized purposes and in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. Such monitoring includes reviewing financial and programmatic reports, following up on identified deficiencies, ensuring timely corrective action, and maintaining adequate documentation evidencing the performance of monitoring and oversight procedures. Condition During testing of subrecipient monitoring procedures for the Research and Development Cluster, the College was unable to provide documentation evidencing that required subrecipient monitoring confirmations and related monitoring procedures were performed for one of their subrecipients during the period July 1, 2024 through June 30, 2025. Management indicated that due to staffing turnover within the Grants & Contracts Office, the College could not verify whether monitoring confirmations were requested or received during the audit period. In addition, supporting documentation evidencing the performance of monitoring activities was not maintained or available for audit review. Cause The College experienced staffing turnover within the Grants & Contracts Office which resulted in a breakdown in controls over subrecipient monitoring documentation retention and oversight procedures. Effect The College was unable to demonstrate compliance with subrecipient monitoring requirements in accordance with 2 CFR §200.332. As a result, there is an increased risk that noncompliance by subrecipients may not be identified, monitored, or addressed in a timely manner. Questioned Costs None. Recommendation We recommend the College strengthen controls over subrecipient monitoring by: implementing formalized monitoring procedures and documentation retention requirements, maintaining centralized records of monitoring activities and confirmations, assigning clear responsibility for monitoring oversight, and implementing supervisory review controls to ensure compliance with Uniform Guidance requirements. Views of Responsible Officials See Management Corrective Action Plan. The College had no prior year findings reported.
Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster State Administering Department: California Department of Aging ALN: 93.044, 93.045, 93.053 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401CAOACM; October 1, 2023 – September 30, 2025 2401CAOAHD; October 1, 2023 – September 30, 2025 2401CAOANS; October 1, 2023 – September 30, 2025 2401CAOASS; October 1, 2023 – September 30, 2025 2501CAOACM; October 1, 2024 – September 30, 2026 2501CAOAHD; October 1, 2024 – September 30, 2026 2501CAOANS; October 1, 2024 – September 30, 2026 2501CAOASS; October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. §200.332 Requirements for passthrough entities (2 CFR 200.332): All pass-through entities must: (a) Verify that the subrecipient is not excluded or disqualified in accordance with §180.300. Verification methods are provided in §180.300, which include confirming in SAM.gov that a potential subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal funds. Condition: Audit procedures included a review of eight subrecipient agreements to determine whether the Department complied with federal suspension and debarment requirements for covered transactions. The subrecipient agreements reviewed did not contain a suspension and debarment certification clause indicating that the subrecipient was not suspended or debarred from participation in federally funded programs. Furthermore, the Department was unable to provide documentation demonstrating that suspension and debarment verification procedures, such as a review of the System for Award Management (SAM), had been performed prior to entering into the covered transactions. As part of audit procedures, we independently verified the suspension and debarment status of all subrecipients tested through a review of the SAM Exclusions database and noted that none were suspended or debarred at the time of our testing. Questioned costs: None Context: See “Condition.” Cause: Controls designed to ensure compliance with federal suspension and debarment requirements were not operating with sufficient precision to verify and document the eligibility of subrecipients prior to entering into covered transactions. Specifically, personnel responsible for administering the program had not established or consistently performed procedures to verify suspension and debarment status through SAM or obtain required certifications, resulting in unsupported compliance with 2 CFR §200.214 and 2 CFR Part 180. Effect: Failure to verify and document suspension and debarment status prior to entering into covered transactions results in noncompliance with 2 CFR §180.300 and increases the risk that federal funds could be awarded to subrecipients that are suspended or debarred from participation in federally funded programs. Although the audit's independent verification determined that none of the subrecipients tested were suspended or debarred, the lack of documented verification procedures prevents the Department from demonstrating compliance with federal requirements and increases the risk that ineligible parties could be engaged in future transactions. Repeat finding: No Recommendation: The Department should review and strengthen its procedures for verifying the suspension and debarment status of subrecipients before entering into any agreement involving federal funds and ensure that the verification documentation is maintained. Alternatively, incorporate a clause in subrecipient contracts certification of their suspension or debarment status. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.
Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Epidemiology and Laboratory Capacity for ProgramInfectious Diseases (ELC) State Administering Department: California Department of Public Health ALN: 93.323 Pass-Through Agency: Heluna Health Pass-Through Number(s): 95-2557063 Award Number and Period: NU50CK000539; August 1, 2019 – July 31, 2027 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). § 200.302 – Financial management (b) The recipient's and subrecipient's financial management system must provide for the following: (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. (3) Maintaining records that sufficiently identify the amount, source, and expenditure of Federal funds for Federal awards. These records must contain information necessary to identify Federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. § 200.332 – Requirements for pass-though entities A pass-through entity must: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the information provided below. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes: (1) Federal award identification. (i) Subrecipient's name (must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated in the subaward; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity; (xii) Assistance Listings title and number; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement; (xiii) Identification of whether the Federal award is for research and development; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is used in accordance with § 200.414). Condition: Audit procedures included a review of eleven subrecipient agreements to determine whether the pass-through entity included the information required to be communicated to subrecipients in accordance with Uniform Guidance. Of the eleven agreements tested, all eleven (100%) did not contain one or more required federal award identification elements. Specifically, the agreements omitted the subrecipient’s Unique Entity Identifier (UEI), the Federal Award Identification Number (FAIN), the Federal award date, the applicable Assistance Listing Number (ALN), identification of whether the award was designated as research and development (R&D), and the applicable indirect cost rate for the federal award, including whether the de minimis indirect cost rate authorized under 2 CFR §200.414 was being used. As a result, the subrecipient agreements did not include all information required to be provided to subrecipients under 2 CFR §200.332(b). Questioned costs: None Context: See “Condition.” Cause: Controls designed to ensure the inclusion of all federally required award identification information in subrecipient agreements were not operating with sufficient precision to identify and prevent the omission of required elements prior to execution of the agreements. As a result, agreements were issued without all information required under 2 CFR §200.332(b), including the UEI, FAIN, Federal award date, ALN, identification of whether the award was designated as R&D, and the applicable indirect cost rate. Effect: The omission of required federal award information from subrecipient agreements may limit subrecipients' understanding of applicable federal award requirements and increase the risk of noncompliance with federal regulations. Incomplete award information may also result in inaccurate or inconsistent administration, monitoring, and reporting of federal awards by subrecipients and the pass-through entity. Repeat finding: Yes – 2024-009 Recommendation: Public Health should ensure every subaward includes all requirements imposed on the subrecipient so that the federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the federal award. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.
Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care and Development Fund State Administering Department: California Department of Social Services (CDSS) ALN: 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101CACDC6; October 1, 2020 – September 30, 2024 2334CACCDD; October 1, 2022 – September 30, 2025 2334CACCDF; October 1, 2022 – September 30, 2025 2334CACCDM; October 1, 2022 – September 30, 2025 2434CACCDD; October 1, 2023 – September 30, 2026 2434CACCDF; October 1, 2023 – September 30, 2026 2434CACCDM; October 1, 2023 – September 30, 2025 2534CACCDD; October 1, 2024 – September 30, 2027 2534CACCDF; October 1, 2024 – September 30, 2027 2534CACCDM; October 1, 2024 – September 30, 2026 2534CACCDY; December 21, 2024 – September 30, 2028 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Complianceand Material Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). § 200.302 – Financial management (b) The recipient's and subrecipient's financial management system must provide for the following: (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. (3) Maintaining records that sufficiently identify the amount, source, and expenditure of Federal funds for Federal awards. These records must contain information necessary to identify Federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. §200.328 Financial reporting (c) The recipient or subrecipient must submit financial reports as required by the Federal award. Reports submitted annually by the recipient or subrecipient must be due no later than 90 calendar days after the reporting period. Reports submitted quarterly or semiannually must be due no later than 30 calendar days after the reporting period. (d) The final financial report submitted by the recipient must be due no later than 120 calendar days after the conclusion of the period of performance. A subrecipient must submit a final financial report to a pass-through entity no later than 90 calendar days after the conclusion of the period of performance. § 200.329 Monitoring and reporting program performance (a) Monitoring by the recipient and subrecipient The recipient and subrecipient are responsible for the oversight of the Federal award. The recipient and subrecipient must monitor their activities under Federal awards to ensure they are compliant with all requirements and meeting performance expectations. Monitoring by the recipient and subrecipient must cover each program, function, or activity. See also § 200.332. Title 45 – Public Welfare Subtitle A – Department of Health and Human Services Subchapter A – General Administration Part 98 – Child Care and Development Fund Subpart G – Financial Management § 98.60 – Availability of funds (d) The following obligation and liquidation provisions apply to States and Territories: (1) Discretionary Fund allotments shall be obligated in the fiscal year in which funds are awarded or in the succeeding fiscal year. Unliquidated obligations as of the end of the succeeding fiscal year shall be liquidated within one year. (2)(i) Mandatory Funds for States requesting Matching Funds per § 98.55 shall be obligated in the fiscal year in which the funds are granted and are available until expended. (4) Both the Federal and non-Federal share of the Matching Fund shall be obligated in the fiscal year in which the funds are granted and liquidated no later than the end of the succeeding fiscal year. (5) Determination of whether funds have been obligated and liquidated will be based on State or local law or, if there is no applicable State or local law, the regulation at 2 CFR 200.1, Expenditures and Obligations. § 98.65 Audits and financial reporting (a) Each Lead Agency shall have an audit conducted after the close of each program period in accordance with 2 CFR part 200, subpart F, and the Single Audit Act Amendments of 1996. (b) Lead Agencies are responsible for ensuring that subgrantees are audited in accordance with appropriate audit requirements. (c) Not later than 30 days after the completion of the audit, Lead Agencies shall submit a copy of their audit report to the legislature of the State or, if applicable, to the Tribal Council(s). Lead Agencies shall also submit a copy of their audit report to the HHS Inspector General for Audit Services, as well as to their cognizant agency, if applicable. (d) Any amounts determined through an audit not to have been expended in accordance with these statutory or regulatory provisions, or with the Plan, and that are subsequently disallowed by the Department shall be repaid to the Federal government, or the Secretary will offset such amounts against any other CCDF funds to which the Lead Agency is or may be entitled. (e) Lead Agencies shall provide access to appropriate books, documents, papers and records to allow the Secretary to verify that CCDF funds have been expended in accordance with the statutory and regulatory requirements of the program, and with the Plan. (f) The audit required in paragraph (a) of this section shall be conducted by an agency that is independent of the State, Territory or Tribe as defined by generally accepted government auditing standards issued by the Comptroller General, or a public accountant who meets such independent standards. (g) Lead Agencies shall submit financial reports, in a manner specified by ACF, quarterly for each fiscal year until funds are expended. (h) At a minimum, a State or territorial Lead Agency's quarterly report shall include the following information on expenditures under CCDF grant funds, including Discretionary (which includes realloted funding and any funds transferred from the TANF block grant), Mandatory, and Matching Funds (which includes redistributed funding); and State Matching and Maintenance-of- Effort (MOE) Funds: (1) Child care administration; (2) Quality activities, including any sub-categories of quality activities as required by ACF; (3) Direct services for both grant or contracted slots and certificates; (4) Non-direct services, including: (i) Establishment and maintenance of computerized child care information systems; (ii) Certificate program cost/eligibility determination; (iii) All other non-direct services; and (5) Such other information as specified by the Secretary. § 98.67 – Fiscal requirements (c) Fiscal control and accounting procedures shall be sufficient to permit: (1) Preparation of reports required by the Secretary under this subpart and under subpart H; and (2) The tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part. Condition: Audit procedures included a review of the entire population of ACF-696 financial reports submitted for the CCDF Cluster. Our testing identified that certain reported amounts did not agree or reconcile to the underlying general ledger, resulting in a total variance of $491,119,535. Additionally, audit procedures identified that internal controls over reporting were not operating effectively to ensure the accurate submission of reports. Specifically, certain reports contained inaccuracies at the time of submission, and controls were not performed with sufficient precision to verify that reported information was complete and accurate in accordance with federal reporting requirements. Questioned costs: None Context: See “Condition.” Cause: The controls over the preparation and review of ACF-696 reports were not performed with sufficient precision to identify and resolve discrepancies between reported amounts and the underlying general ledger. Specifically, controls were not designed or operating at a level precise enough to ensure that reported data was accurate, reconciled, and submitted in a timely manner in accordance with federal requirements. As a result, variances and reporting errors were not detected or corrected prior to submission. Effect: Without a documented reconciliation between the ACF-696 reports and the general ledger, the Department cannot demonstrate that reported expenditures were accurate, complete, and supported by accounting records. This increases the risk that expenditures, obligations, liquidations, unobligated balances, or expenditure categories reported to ACF may be misstated. Inaccurate ACF-696 reporting may affect ACF’s ability to monitor compliance with CCDF spending, obligation, liquidation, and availability requirements. Repeat finding: Yes – 2024-015 Recommendation: Management should establish a formal reconciliation process to ensure that ACF-696 expense reports align with the general ledger. This process should include assigning responsibility to a designated finance team member for performing and documenting reconciliations, implementing a monthly reconciliation schedule, and promptly investigating and resolving any variances with documented approvals. Additionally, financial reporting policies should be updated to incorporate reconciliation requirements, and staff should receive training on compliance and reconciliation procedures to strengthen internal controls and reduce the risk of reporting inaccuracies. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report. Response to views of responsible officials: We acknowledge management's explanation that variances between the ACF-696 reports and the general ledger resulted from timing differences associated with subsequent cost allocations, accruals, and other adjustments. However, the issue identified during the audit was not the existence of timing differences, but that the reconciliation process did not adequately identify, explain, and support significant variances. Audit testing identified unreconciled variances totaling $491,119,535 between the ACF-696 reports and the general ledger. Although management indicated that adjustments were reported in subsequent quarters, documentation supporting a complete and accurate reconciliation was not available at the time of report preparation and submission. As a result, controls did not operate with sufficient precision to ensure reported amounts were accurate, complete, and supported by the Department's accounting records. Accordingly, we continue to conclude that the finding is valid as presented. We appreciate management's planned corrective actions to formalize the reconciliation process and strengthen oversight of ACF-696 reporting.
Special Tests and Provisions Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care and Development Fund State Administering Department: California Department of Social Services (CDSS) ALN: 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2434CACCDD; October 1, 2023 - September 30, 2026 2434CACCDF; October 1, 2023 - September 30, 2026 2434CACCDM; October 1, 2023 - September 30, 2025 2534CACCDD; October 1, 2024 - September 30, 2027 2534CACCDF; October 1, 2024 - September 30, 2027 2534CACCDM; October 1, 2024 - September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). § 200.329 Monitoring and reporting program performance (a) Monitoring by the recipient and subrecipient The recipient and subrecipient are responsible for the oversight of the Federal award. The recipient and subrecipient must monitor their activities under Federal awards to ensure they are compliant with all requirements and meeting performance expectations. Monitoring by the recipient and subrecipient must cover each program, function, or activity. See also § 200.332. Title 45 – Public Welfare Subtitle A – Department of Health and Human Services Subchapter A – General Administration Part 98 – Child Care and Development Fund Subpart B – General Application Procedures § 98.11 – Administration under contracts and agreements Lead Agencies have broad authority to administer and operate the CCDF program through other governmental, nongovernmental, or public or private local agencies; however, the Lead Agency must retain overall responsibility for the administration of the program and ensure that administrative and implementation responsibilities undertaken by agencies other than the Lead Agency are governed by written agreements specifying the mutual roles and responsibilities of the Lead Agency and other agencies in meeting CCDF requirements. The approved FFY 2025–2027 CCDF State Plan identifies CDSS as the Lead Agency and states that activities performed by agencies other than CDSS are governed through written agreements, including contracts and grant award notifications, that include required elements such as tasks to be performed, schedules for completing tasks, budgets, and performance measures. The State Plan further describes CDSS’s monitoring process for contractors, including standard review instruments, corrective action follow-up, fiscal and program reporting, and contractor review requirements. Condition: Audit procedures included testing a sample of 60 CCDF contractors to determine whether CDSS performed on-site monitoring visits in accordance with the contractor review cycle specified in the approved State Plan and related monitoring procedures. Of the 60 contractors tested, 2 contractors did not receive an on-site monitoring visit within the required review period. Specifically, the contractors had not received an on-site visit within four years, although the State Plan and related monitoring procedures require contractor reviews to be performed within a three-year cycle. As a result, CDSS did not consistently perform required monitoring procedures within the timeframe established for oversight of CCDF contractors. Questioned costs: None Context: See “Condition.” Cause: CDSS did not maintain internal controls that operated with sufficient precision to ensure all CCDF contractors were scheduled for and received required on-site monitoring visits within the established review cycle. Specifically, monitoring controls were not designed or performed at a level sufficient to identify overdue contractor reviews, track the status of required visits, and ensure timely completion of on-site monitoring for all applicable contractors. Effect: Failure to perform timely on-site monitoring visits reduces CDSS’s ability to determine whether contractors are operating in accordance with written agreements, State Plan requirements, and applicable CCDF program requirements. Untimely monitoring increases the risk that contractor noncompliance, performance deficiencies, or unsupported program activities are not identified and corrected promptly, which may affect CDSS’s ability to retain effective oversight and overall responsibility for the CCDF program. Repeat finding: No Recommendation: We recommend that CDSS strengthen internal controls over CCDF contractor monitoring by implementing procedures to ensure all contractors are scheduled for and receive required on-site monitoring visits within the review cycle established in the approved State Plan and related monitoring procedures. These procedures should include maintaining a complete monitoring schedule, tracking the date of each contractor’s last review, identifying upcoming and overdue reviews, and requiring documented supervisory review to ensure monitoring visits are completed timely. CDSS should also establish a process to periodically reconcile the monitoring schedule to the population of active CCDF contractors and promptly follow up on overdue reviews. These controls should help ensure CDSS performs contractor oversight consistently, documents compliance with written agreement monitoring requirements, and retains effective responsibility for CCDF administration. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report. Response to views of responsible officials: We acknowledge CDSS's response regarding resource constraints, risk-based prioritization, and its interpretation of the "as resources permit" language in Title 5, California Code of Regulations, Section 18023(b). However, the approved State Plan and related monitoring procedures in effect during the audit period established a three-year review cycle for contractor monitoring. Audit testing identified that 2 of 60 CCDF contractors did not receive an on-site monitoring visit for more than four years. While CDSS employed a risk-based approach to prioritize monitoring activities, the required reviews were not completed within the established review cycle for the contractors identified in our testing. Accordingly, the finding is based on CDSS's failure to consistently perform monitoring reviews within the established review cycle and the lack of controls to ensure overdue reviews were identified, tracked, and completed timely. Therefore, we continue to conclude that the finding is valid as presented.
2025-001 U.S. Department of the Treasury COVID-19 – Coronavirus State and Local Fiscal Recovery Fund – ALN 21.027 Compliance Finding and Material Weakness in Internal Controls Over Compliance Criteria: 2 CFR section 200.332, provides the requirements for pass-through entities to communicate subaward information to the subrecipient and to monitor the activities of the subrecipient. Condition: The City did not maintain risk assessments to evaluate each subrecipients risk of noncompliance and level of monitoring required and did not maintain any documentation indicating that monitoring occurred for five subrecipients. Context: The above condition applied to each of the five subrecipients selected for testing. As a result, we were unable to determine the extent of any monitoring that may have occurred. The sample was not a statistically valid sample. Cause: The City experienced turnover in the grant administrator position and did not follow its documented internal controls for subrecipient monitoring. Effect: Lack of controls over subrecipient monitoring could result in the City’s noncompliance with grant requirements. Questioned Costs: None. Repeat Finding from Prior Year: No. Recommendation: The City should require all persons charged with managing federal grants to review the City’s documented internal controls for federal grant compliance. Regarding subrecipient monitoring, the City should ensure that risk assessments are performed to evaluate each subrecipients risk of noncompliance and to develop the appropriate subrecipient monitoring procedures to be employed. All records of subrecipient monitoring should be maintained to document grant compliance. Views of Responsible Official: Management agrees with the finding
Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Federal Financial Assistance Listing Number: 21.027 Federal Grantor: U.S. Department of the Treasury Award Number and Year: 2021 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance and Material Non-Compliance Criteria: In accordance with Title 2 U.S. Code of Federal Regulations (CFR) 200.332, pass-through entities must comply with the following: • 2 CFR Part 200.332(a), Requirements for Pass-Through Entities, states that all passthrough entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information as well as all the requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations, and the terms and conditions of the award. • 2 CFR 200.332(b) – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors listed in 2 CFR 200.332(b)(1) through (4). • 2 CFR 200.332(d)- Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include the information at 2 CFR 200.332(d)(1) through (4). • 2 CFR 200.332(f) – Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 200.501. • 2 CFR section 200.303(a), Internal Controls, states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: We noted for three (3) of three (3) subrecipients selected for testwork, the City did not perform any of the required subrecipient monitoring procedures as required under 2 CFR 200.332 (a. through i.). As a result, we were unable to perform audit procedures over Subrecipient Monitoring compliance requirements. Cause: The City did not have adequate policies and procedures in place to monitor subrecipient in accordance with 2 CFR 200.332. Effect: The City did not have procedures in place requiring compliance with the Subrecipient Monitoring requirements in 2 CFR 200.332 and as such did not comply with subrecipient monitoring requirements related to the program. Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: A nonstatistical sample of three (3) of three (3) subrecipients were sampled. Repeat Finding from Prior Year: No. Recommendation: The City should implement policies and procedures to ensure that subrecipients are properly identified at the time of award and accurately reported on the SEFA. Additionally, the City should establish and perform ongoing subrecipient monitoring procedures in accordance with Federal requirements, including risk assessments and documentation of monitoring activities. Views of Responsible Officials and Planned Corrective Action: Management agrees. See separately issued Corrective Action Plan.
Material Weakness Finding No. 2025-002: Subrecipient Monitoring U.S. Department of Health and Human Services Substance Abuse and Mental Health Services Federal Assistance Listing Number 93.243. U.S. Department of Health and Human Services Health Care for Native Hawaiians Federal Assistance Listing Number 93.932. Criteria Pursuant to Title 2, Subtitle A Chapter II, Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (the Uniform Guidance), “a non-Federal entity may concurrently receive Federal awards as a recipient, subrecipient, and a contractor, depending on the substance of its agreements with the Federal awarding agencies and pass-through entities. Therefore, a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor.”Condition We noted that the Organization did not make case-by-case determinations of each agreement with parties to which the Organization passed through Federal program funds to determine whether they were deemed to be either subrecipients or contractors. Cause Management had not updated its policies and procedures to incorporate the relevant Uniform Guidance subrecipient monitoring and management policies. Effect The lack of subrecipient monitoring and management policies of the Uniform Guidance could result in noncompliance by the Organization with the stipulated requirements for pass-through entities, as well as noncompliance of subrecipient requirements by the entities receiving the pass-through funds from the Organization. Identification of Repeat Finding This finding was reported as a federal award finding in the immediate previous audit as Finding No. 2024-002. Recommendation We again recommend that the Organization incorporate the subrecipient monitoring and management provisions of 2 CFR §200.331 and 2 CFR §200.332 of the Uniform Guidance to their policies and procedures manual to ensure compliance with Federal standards.Views of Responsible Officials and Planned Corrective Action The Organization acknowledges 2 CFR§ 200.331 and 2 CFR §200.332 of the Uniform Guidance, and its subrecipient monitoring and management provisions emphasizing accountability and compliance in managing federal funds and subrecipients. The Organization concurs with the prior year (2024-002) and current year renumbered recommendation (2025-002) and highlights its ongoing progressive and corrective implementation of policy and process actions.For context, the Organization’s progressive and corrective actions as of the fiscal year ended (FYE) June 30, 2024 report included the following: A. Subrecipient Monitoring and Management. Implemented internal process changes, effective November 1, 2024, specifically, prospectively, and consistently the: 1. Use of a checklist, to comprehensively assess risk of determining subrecipient or contractor classification, before entering into any subrecipient agreement; 2. Provision of identification details such as CFDA number, amount of federal funds obligated, and the award period for determined subrecipient awards; 3. Submission of programmatic and financial reports as specified in the subrecipient agreement; 4. Review of a single audit in accordance with 2 CFR Part 200, Subpart F for subrecipients that expend $750,000 or more in federal funds during a fiscal year, if applicable; and 5. Review of their audit report(s) and addressing any finding(s) related to their federal award(s), including the related appropriate corrective actions, when applicable. B. Retroactive Subrecipient Portfolio Risk Assessment and Correction(s). Performed a risk assessment of the existing subrecipient portfolio to identify risks, for the audit periods July 1, 2022 – June 30, 2023, and July 1, 2023 – June 30, 2024. The objective of this risk assessment was to identify, evaluate, and prioritize risks that could adversely impact the Organization’s ability to achieve its strategic, operational, compliance and quality assurance goals. The completion of the Organization’s portfolio risk assessment resulted in correction of identified non-compliant subrecipient agreement(s). C. Subrecipient Policies and Procedures. Updated, by December 31, 2024, the implemented financial policies and procedures aligned to the subrecipient monitoring and management provision of 2 CFR §200.331 and 2 CFR §200.332 of the Uniform Guidance, including checklists, flowcharts, samples, data sheets, data sharing agreements, etc. For the year ended June 30, 2025, to the period of the audit report date, the Organization continued the prospective implementation of the above policies and processes, including the following reflective contract review work: A. Reviewed all contracts executed between July 1, 2024 to June 30, 2025. B. Discussed with respective program director(s), the implementation of initiation, consideration, decision, documentation and monitoring phased activities. C. Worked with respective program director(s) to document in memorandum(s) to file (MTF), the basis for decision and documentation on a contract-by-contract basis. D. Initiated work with respective program contract monitors to implement and document consistent Organization wide contract monitoring processes and activities (e.g., contract, term, billing, deliverables, eligible expenditures, data input, frequency).Although as of June 30, 2025 the implementation of the resolution was not completed, the implementation continues and is expected to be fully implemented by the next audit report date.
Finding 2025-082 Federal Program Name CCDF Cluster (CCDF) (COVID-19) Federal Awarding Agency U.S. Department of Health and Human Services State Agency Department of Public Health and Human Services (department) ALN # 93.575 and 93.596 Grant # 2401MTCCDD Compliance Requirement M. Subrecipient Monitoring Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.332(a)(1), identifies fourteen required elements that must be communicated to subrecipients to properly identify a federal award. Federal regulation, 45 CFR 75.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department's internal controls were insufficient to ensure all required information related to the federal award disclosures was provided to subrecipients and that it was accurate in fiscal year 2024. We identified multiple contracts with incomplete or inaccurate information. Context: The department contracts with subrecipients to administer the Best Beginnings Scholarship program, through which providers are paid for childcare services rendered to eligible children. Subrecipients determine applicant eligibility, approve payments, and support providers. Contracts outline responsibilities and are executed each fall. The department had six subrecipients through September 30, 2024, and two beginning October 1, 2024. We reviewed three contracts executed in fall 2023 and found the same missing information in all three: the Federal Award Date and the Assistance Listing Title. Additionally, the department intended to report the total federal award amount but instead reported the amount obligated to the subrecipient. Because the missing and incorrect items were consistent, we did not review the remaining three contracts from the same period. We also reviewed the two contracts executed in fall 2024. All required information was present and correct. Repeat Finding: Montana's Single Audit for the two fiscal years ended June 30, 2023, included recommendation 2023-059, which directed the department to implement controls to ensure all required information is communicated to subrecipients. Effect: By not providing complete and accurate information to subrecipients, the department is not in compliance with federal subrecipient monitoring requirements. Cause: Failure to provide all required information to subrecipients was the subject of prior audit recommendation 2023-059. The department developed a new contract template that included all required elements; however, it was not implemented before the fall 2023 contracts were executed. For the incorrect amounts in the contracts, the department attributed the incorrect contract amounts to human error. Because the department took corrective action and the fall 2024 contracts contained all required information, this finding should be resolved if the department continues to follow its updated process. Recommendation: We recommend the Department of Public Health and Human Services: A. Continue to follow its improved contracting process to ensure all required federal award information is provided to subrecipients as required by federal regulations. B. Comply with federal regulations by providing complete and accurate federal award information to subrecipients. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-061 Federal Program Name Special Education Cluster (IDEA) (COVID 19) Federal Awarding Agency U.S. Department of Education State Agency Office of Public Instruction (office) ALN # 84.027A, 84.027X, 84.173A, and 84.173X Grant # H027A230096, H027A240096, H173A230099, H173A240099 Compliance Requirement A. Activities Allowed or Unallowed B. Allowable Costs/Cost Principles M. Subrecipient Monitoring Type of Finding Material Weakness and Material Noncompliance Questioned Costs $6,149,159 Criteria: Federal regulation, 2 CFR 200.332 (d), requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Federal regulation, 2 CFR 200.403(a) and (g), states costs are allowable when they are necessary and reasonable for the performance of the federal award and adequately documented. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The office reimbursed Local Education Agencies (LEAs), which are generally schools or school districts, without receiving sufficient documentation to determine whether the claimed costs were allowable under the Special Education program. The office’s internal controls did not ensure adequate documentation was on file before issuing reimbursements. Questioned Costs: We question $6,149,159 in Special Education reimbursements that were not adequately supported at the time of payment. Additional unsupported reimbursements likely exist in the populations. Context: In fiscal years 2024 and 2025, the office paid over $89 million to LEAs based on reimbursement requests for the Special Education program. We tested 20 of the largest reimbursement requests, ten from each fiscal year, from different LEAs. Nine requests in fiscal year 2024, and one request in fiscal year 2025, lacked sufficient documentation to determine the allowability of the reimbursed expenditures. Testing exceptions included an absence of dates associated with the compensation, people, or positions for which reimbursement was sought, or details on how supplies or repairs related to the Special Education program. Effect: The office reimbursed schools for Special Education costs that were not adequately supported at the time of reimbursement. The office’s subrecipient monitoring procedures were not sufficient to comply with federal regulations. As a result, the office paid at least $6,149,159 in claims that may have included unallowable costs. Cause: Prior to early 2025, the office’s cash request reviews were minimal and focused primarily on comparing requests to budget line items. While budget comparisons provide some assurance of allowability, they are not sufficient on their own. For example, they do not confirm that personal service costs are for individuals who worked on the Special Education grant, or that work occurred within the period of performance of the grant. The office implemented a new cash request review process in early 2025. However, this change occurred during the audit period and does not address Special Education reimbursements already made. If the office continues to operate under its new procedures, this recommendation should be resolved. Recommendation: We recommend the Office of Public Instruction: A. Continue to use enhanced internal controls to ensure schools submit adequate documentation with reimbursement requests prior to payment. B. Reimburse schools only when documentation is sufficient to confirm that costs are allowable under the Special Education program. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-101 Federal Program Name Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Federal Awarding Agency U.S. Department of Homeland Security State Agency Department of Military Affairs (department) ALN # 97.036 Grant # 4508DRMTP00000001, 4608DRMTP00000001, 4623DRMTP00000001, 4655DRMTP00000001, 4726DRMTP00000001, 4745DRMTP00000001, 4801DRMTP00000001, 4813DRMTP00000001 Compliance Requirement M. Subrecipient Monitoring Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.332(d), requires pass-through entities to monitor subrecipient activities. Monitoring must ensure subrecipients take timely, appropriate action on all award deficiencies and resolve related audit findings. As of October 2024, these same requirements are now in 2 CFR 200.332(e). Federal regulations, 2 CFR 200.332(d)(3) and 2 CFR 200.521, require pass-through entities to issue management decisions for audit findings applicable to Federal awards passed to subrecipients. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacked sufficient internal controls to ensure it performed all required subrecipient monitoring in fiscal years 2024 and 2025. We identified multiple instances of noncompliance with subrecipient monitoring requirements during the audit period. Context: When a disaster is declared in Montana, the department subgrants federal funds to cities, counties, and nonprofits to support local recovery. Federal regulations require the department to monitor subrecipients to ensure funds are spent properly and issues are resolved promptly. During the audit period, the department paid $53,947,993 to subrecipients for 187 projects across 8 disasters. The department did not begin reviewing subrecipient audit reports until May 2025 and had not completed all reviews as of July 30, 2025. Of 24 subrecipients who should have had an audit reviewed during the audit period: • 10 were not included on the monitoring spreadsheet • 2 were listed but had no audits reviewed • 12 had only one audit reviewed Federal regulations further require the department to issue management decisions for audit findings applicable to the department’s sub-granted federal awards. We identified three subrecipients with findings tied to the Disaster Grants program. Although the department corresponded with these subrecipients about the findings, no management decisions were issued. Repeat Finding: Montana's Single Audit for the two fiscal years ended June 30, 2023 included recommendation #2023-074, directing the department to implement controls to obtain and review subrecipient audit reports and to obtain and review audit reports of entities receiving grants. Effect: Without adequate subrecipient monitoring, the department is unaware of findings related to its grants or similar federal programs. This increases the risk of misspent federal funds and the department providing additional funds to a subrecipient who has already mishandled federal funds. It also means the department cannot determine when management decisions, corrective action plans, or additional monitoring are needed to ensure subrecipient compliance. Cause: The failure to review audit reports was previously identified as recommendation #2023-074. The department began developing a review process in August 2024 following that finding, but implementation was slow, and reviews of audit reports only began in late spring 2025. Additionally, department staff knew that management decisions are required for applicable findings but were unaware of the specific required elements or deadlines and believed their email correspondence was sufficient. Recommendation: We recommend the Department of Military Affairs: A. Strengthen internal controls to ensure subrecipient monitoring is performed as required by federal regulations. B. Obtain and review audit reports for all entities receiving subgrants from the department. C. Issue management decisions for all audit findings applicable to federal awards sub-granted by the department. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-102 Federal Program Name Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Federal Awarding Agency U.S. Department of Homeland Security State Agency Department of Military Affairs (department) ALN # 97.036 Grant # 4508DRMTP00000001, 4608DRMTP00000001, 4623DRMTP00000001, 4655DRMTP00000001, 4726DRMTP00000001, 4745DRMTP00000001, 4801DRMTP00000001, 4813DRMTP00000001 Compliance Requirement B. Allowable Costs/Cost Principles M. Subrecipient Monitoring N. Special Tests and Provisions Type of Finding Material Weakness and Material Noncompliance Questioned Costs $7,814,126 in total questioned costs: $1,528,856 known and $6,285,270 likely. Criteria: Federal regulation, 2 CFR 200.403(c), requires costs to be consistent with policies and procedures applied uniformly to both federally financed and other activities of the recipient or subrecipient to be allowable. Federal regulation, 2 CFR 200.403(g), requires that costs be adequately documented to be allowable. Federal regulation, 2 CFR 200.332, requires pass-through entities to monitor subrecipient activities. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacked internal controls to ensure costs were supported and documented before making payments on Disaster Grant projects. We identified multiple subrecipient projects with unsupported or inadequately documented costs. Questioned Costs: We identified $7,814,126 in total questioned costs: $1,528,856 known and $6,285,270 likely. We calculated likely questioned costs by analyzing a selection of project invoices and found that 32% were supported and 68% were not. We then projected that 68% rate to the remaining project costs. Context: During the audit period, the department paid $53,947,993 to subrecipients for 187 projects across 8 disasters. We planned to test a nonrandom, nonstatistical sample of 19 projects but stopped after finding errors in 2 of the first 5 projects tested. The first project provided emergency protective measures during the COVID-19 public health emergency, primarily temporary medical staffing. The second project repaired and replaced more than 100 miles of fencing damaged by wildfire. Across the two projects, we identified known questioned costs via the following documentation errors: • $153,240 paid with no invoices on file. • $868,709 paid when the contract lacked personnel rates needed to calculate payment. • $33,962 paid when invoices lacked sufficient detail to support the payment. • $39,920 paid over the contract limit. • $345,213 paid for materials without a required contract or other procurement documentation showing the subrecipient had followed their procurement policy. • $87,813 for Tribal Employment Rights Office fees paid twice, once by the contractors and once by the Federal Emergency Management Agency (FEMA). Additionally, $6,285,270 in likely questioned costs stemmed from the same lack of personnel rates in the contract. Effect: The department did not comply with federal regulations, resulting in more than $7.8 million in questioned costs for the program. Cause: Both projects were fully validated and closed through FEMA's large project closeout and Validate As You Go (VAYGO) processes. The department is uncertain how the documentation gaps occurred and believes the completed validation indicates costs were reviewed and deemed allowable, even if certain documents were absent from the files at the time of the audit. In the instance where no contract was executed by the subrecipient when it should have been under the subrecipient’s procurement policy, the department and subrecipient believed no contract was needed because materials were purchased as the project progressed. However, even when each of the seven purchases is considered individually, five would require at least some procurement documentation, and two would require a formal contract based on dollar amount alone. Considered together as a single project to replace 100+ miles of fence, all purchases would have required a contract under the subrecipient's procurement policy. Recommendation: We recommend the Department of Military Affairs: A. Strengthen internal controls to ensure subaward costs are adequately supported and retain supporting documents, as required by federal regulations. B. Comply with federal regulations by paying only allowable project costs to subrecipients. Views of Responsible Officials: The department partially concurs with the recommendation. Management agrees there is an opportunity to improve project documentation retention. However, they reiterate the reviewed projects were validated and deemed allowable through both the department and FEMA. Rebuttal of Views of Responsible Officials: We considered the department’s partial concurrence. While the projects were closed and validated by both the department and FEMA, we are required to include closed projects within the scope of our audit procedures, as requested and required by FEMA. Closed projects must be adequately documented. As a result, our recommendation stands.