Federal program: All federal awards provided to subrecipients. FY/Federal Award ID#: FY2024/All federal awards provided to subrecipients. Federal agency: All federal awards provided to subrecipients. Pass thru entity: All federal awards provided to subrecipients. Criteria: per 24 CFR 574.500 -- Responsibility for grant administration: (a) General. Grantees are responsible for ensuring that grants are administered in accordance with the requirements of this part and other applicable laws. Grantees are responsible for ensuring that their respective subrecipients carry out activities in compliance with all applicable requirements. (b) Grant agreement. The grant agreement will provide that the grantee agrees, and will ensure that each subrecipient agrees, to: (1) Operate the program in accordance with the provisions of these regulations and other applicable HUD regulations; (2) Conduct an ongoing assessment of the housing assistance and supportive services required by the participants in the program; (3) Assure the adequate provision of supportive services to the participants in the program; and (4) Comply with such other terms and conditions, including recordkeeping and reports (which must include racial and ethnic data on participants) for program monitoring and evaluation purposes, as HUD may establish for purposes of carrying out the program in an effective and efficient manner. And 24 CFR 574.500 Applicability of Uniform Administrative Requirements as per 2 CFR 200.332(f) Requirements for pass-through entities. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. Condition: The Foundation is not in compliance with recordkeeping for program monitoring and evaluation, as the Foundation did not comprehensively asses all subrecipients using riskbased/ subrecipient monitoring policies and procedures. Questioned Costs: None noted. Cause: Staff were not aware of the extent of the requirements to monitor program and fiscal compliance of project sponsors and document results and evidence of compliance or non-compliance. Therefore, a number of project sponsors/subrecipients were not monitored. Effect: Granting agencies cannot determine whether the Foundation is ensuring that the project sponsor is carrying out activities in compliance with all applicable requirements. Recommendation: The Foundation provide written policies and procedures for project sponsor monitoring and oversight, create a risk analysis form/process for all funded project sponsors and create a timeline to monitor project sponsors based on the risk analysis completed. Views of Responsible Officials: The Foundation has updated its Quality Management Plan to include comprehensive subrecipient monitoring policies. The Quality Management team is working with all programming to implement a robust monitoring process, including risk assessments, adherence to grantor regulations, service delivery, and program outcomes.
Federal program: All federal awards provided to subrecipients. FY/Federal Award ID#: FY2024/All federal awards provided to subrecipients. Federal agency: All federal awards provided to subrecipients. Pass thru entity: All federal awards provided to subrecipients. Criteria: per 24 CFR 574.500 -- Responsibility for grant administration: (a) General. Grantees are responsible for ensuring that grants are administered in accordance with the requirements of this part and other applicable laws. Grantees are responsible for ensuring that their respective subrecipients carry out activities in compliance with all applicable requirements. (b) Grant agreement. The grant agreement will provide that the grantee agrees, and will ensure that each subrecipient agrees, to: (1) Operate the program in accordance with the provisions of these regulations and other applicable HUD regulations; (2) Conduct an ongoing assessment of the housing assistance and supportive services required by the participants in the program; (3) Assure the adequate provision of supportive services to the participants in the program; and (4) Comply with such other terms and conditions, including recordkeeping and reports (which must include racial and ethnic data on participants) for program monitoring and evaluation purposes, as HUD may establish for purposes of carrying out the program in an effective and efficient manner. And 24 CFR 574.500 Applicability of Uniform Administrative Requirements as per 2 CFR 200.332(f) Requirements for pass-through entities. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. Condition: The Foundation is not in compliance with recordkeeping for program monitoring and evaluation, as the Foundation did not comprehensively asses all subrecipients using riskbased/ subrecipient monitoring policies and procedures. Questioned Costs: None noted. Cause: Staff were not aware of the extent of the requirements to monitor program and fiscal compliance of project sponsors and document results and evidence of compliance or non-compliance. Therefore, a number of project sponsors/subrecipients were not monitored. Effect: Granting agencies cannot determine whether the Foundation is ensuring that the project sponsor is carrying out activities in compliance with all applicable requirements. Recommendation: The Foundation provide written policies and procedures for project sponsor monitoring and oversight, create a risk analysis form/process for all funded project sponsors and create a timeline to monitor project sponsors based on the risk analysis completed. Views of Responsible Officials: The Foundation has updated its Quality Management Plan to include comprehensive subrecipient monitoring policies. The Quality Management team is working with all programming to implement a robust monitoring process, including risk assessments, adherence to grantor regulations, service delivery, and program outcomes.
Federal program: All federal awards provided to subrecipients. FY/Federal Award ID#: FY2024/All federal awards provided to subrecipients. Federal agency: All federal awards provided to subrecipients. Pass thru entity: All federal awards provided to subrecipients. Criteria: per 24 CFR 574.500 -- Responsibility for grant administration: (a) General. Grantees are responsible for ensuring that grants are administered in accordance with the requirements of this part and other applicable laws. Grantees are responsible for ensuring that their respective subrecipients carry out activities in compliance with all applicable requirements. (b) Grant agreement. The grant agreement will provide that the grantee agrees, and will ensure that each subrecipient agrees, to: (1) Operate the program in accordance with the provisions of these regulations and other applicable HUD regulations; (2) Conduct an ongoing assessment of the housing assistance and supportive services required by the participants in the program; (3) Assure the adequate provision of supportive services to the participants in the program; and (4) Comply with such other terms and conditions, including recordkeeping and reports (which must include racial and ethnic data on participants) for program monitoring and evaluation purposes, as HUD may establish for purposes of carrying out the program in an effective and efficient manner. And 24 CFR 574.500 Applicability of Uniform Administrative Requirements as per 2 CFR 200.332(f) Requirements for pass-through entities. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. Condition: The Foundation is not in compliance with recordkeeping for program monitoring and evaluation, as the Foundation did not comprehensively asses all subrecipients using riskbased/ subrecipient monitoring policies and procedures. Questioned Costs: None noted. Cause: Staff were not aware of the extent of the requirements to monitor program and fiscal compliance of project sponsors and document results and evidence of compliance or non-compliance. Therefore, a number of project sponsors/subrecipients were not monitored. Effect: Granting agencies cannot determine whether the Foundation is ensuring that the project sponsor is carrying out activities in compliance with all applicable requirements. Recommendation: The Foundation provide written policies and procedures for project sponsor monitoring and oversight, create a risk analysis form/process for all funded project sponsors and create a timeline to monitor project sponsors based on the risk analysis completed. Views of Responsible Officials: The Foundation has updated its Quality Management Plan to include comprehensive subrecipient monitoring policies. The Quality Management team is working with all programming to implement a robust monitoring process, including risk assessments, adherence to grantor regulations, service delivery, and program outcomes.
Federal program: All federal awards provided to subrecipients. FY/Federal Award ID#: FY2024/All federal awards provided to subrecipients. Federal agency: All federal awards provided to subrecipients. Pass thru entity: All federal awards provided to subrecipients. Criteria: per 24 CFR 574.500 -- Responsibility for grant administration: (a) General. Grantees are responsible for ensuring that grants are administered in accordance with the requirements of this part and other applicable laws. Grantees are responsible for ensuring that their respective subrecipients carry out activities in compliance with all applicable requirements. (b) Grant agreement. The grant agreement will provide that the grantee agrees, and will ensure that each subrecipient agrees, to: (1) Operate the program in accordance with the provisions of these regulations and other applicable HUD regulations; (2) Conduct an ongoing assessment of the housing assistance and supportive services required by the participants in the program; (3) Assure the adequate provision of supportive services to the participants in the program; and (4) Comply with such other terms and conditions, including recordkeeping and reports (which must include racial and ethnic data on participants) for program monitoring and evaluation purposes, as HUD may establish for purposes of carrying out the program in an effective and efficient manner. And 24 CFR 574.500 Applicability of Uniform Administrative Requirements as per 2 CFR 200.332(f) Requirements for pass-through entities. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. Condition: The Foundation is not in compliance with recordkeeping for program monitoring and evaluation, as the Foundation did not comprehensively asses all subrecipients using riskbased/ subrecipient monitoring policies and procedures. Questioned Costs: None noted. Cause: Staff were not aware of the extent of the requirements to monitor program and fiscal compliance of project sponsors and document results and evidence of compliance or non-compliance. Therefore, a number of project sponsors/subrecipients were not monitored. Effect: Granting agencies cannot determine whether the Foundation is ensuring that the project sponsor is carrying out activities in compliance with all applicable requirements. Recommendation: The Foundation provide written policies and procedures for project sponsor monitoring and oversight, create a risk analysis form/process for all funded project sponsors and create a timeline to monitor project sponsors based on the risk analysis completed. Views of Responsible Officials: The Foundation has updated its Quality Management Plan to include comprehensive subrecipient monitoring policies. The Quality Management team is working with all programming to implement a robust monitoring process, including risk assessments, adherence to grantor regulations, service delivery, and program outcomes.
Federal program: All federal awards provided to subrecipients. FY/Federal Award ID#: FY2024/All federal awards provided to subrecipients. Federal agency: All federal awards provided to subrecipients. Pass thru entity: All federal awards provided to subrecipients. Criteria: per 24 CFR 574.500 -- Responsibility for grant administration: (a) General. Grantees are responsible for ensuring that grants are administered in accordance with the requirements of this part and other applicable laws. Grantees are responsible for ensuring that their respective subrecipients carry out activities in compliance with all applicable requirements. (b) Grant agreement. The grant agreement will provide that the grantee agrees, and will ensure that each subrecipient agrees, to: (1) Operate the program in accordance with the provisions of these regulations and other applicable HUD regulations; (2) Conduct an ongoing assessment of the housing assistance and supportive services required by the participants in the program; (3) Assure the adequate provision of supportive services to the participants in the program; and (4) Comply with such other terms and conditions, including recordkeeping and reports (which must include racial and ethnic data on participants) for program monitoring and evaluation purposes, as HUD may establish for purposes of carrying out the program in an effective and efficient manner. And 24 CFR 574.500 Applicability of Uniform Administrative Requirements as per 2 CFR 200.332(f) Requirements for pass-through entities. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. Condition: The Foundation is not in compliance with recordkeeping for program monitoring and evaluation, as the Foundation did not comprehensively asses all subrecipients using riskbased/ subrecipient monitoring policies and procedures. Questioned Costs: None noted. Cause: Staff were not aware of the extent of the requirements to monitor program and fiscal compliance of project sponsors and document results and evidence of compliance or non-compliance. Therefore, a number of project sponsors/subrecipients were not monitored. Effect: Granting agencies cannot determine whether the Foundation is ensuring that the project sponsor is carrying out activities in compliance with all applicable requirements. Recommendation: The Foundation provide written policies and procedures for project sponsor monitoring and oversight, create a risk analysis form/process for all funded project sponsors and create a timeline to monitor project sponsors based on the risk analysis completed. Views of Responsible Officials: The Foundation has updated its Quality Management Plan to include comprehensive subrecipient monitoring policies. The Quality Management team is working with all programming to implement a robust monitoring process, including risk assessments, adherence to grantor regulations, service delivery, and program outcomes.
Federal program: All federal awards provided to subrecipients. FY/Federal Award ID#: FY2024/All federal awards provided to subrecipients. Federal agency: All federal awards provided to subrecipients. Pass thru entity: All federal awards provided to subrecipients. Criteria: per 24 CFR 574.500 -- Responsibility for grant administration: (a) General. Grantees are responsible for ensuring that grants are administered in accordance with the requirements of this part and other applicable laws. Grantees are responsible for ensuring that their respective subrecipients carry out activities in compliance with all applicable requirements. (b) Grant agreement. The grant agreement will provide that the grantee agrees, and will ensure that each subrecipient agrees, to: (1) Operate the program in accordance with the provisions of these regulations and other applicable HUD regulations; (2) Conduct an ongoing assessment of the housing assistance and supportive services required by the participants in the program; (3) Assure the adequate provision of supportive services to the participants in the program; and (4) Comply with such other terms and conditions, including recordkeeping and reports (which must include racial and ethnic data on participants) for program monitoring and evaluation purposes, as HUD may establish for purposes of carrying out the program in an effective and efficient manner. And 24 CFR 574.500 Applicability of Uniform Administrative Requirements as per 2 CFR 200.332(f) Requirements for pass-through entities. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. Condition: The Foundation is not in compliance with recordkeeping for program monitoring and evaluation, as the Foundation did not comprehensively asses all subrecipients using riskbased/ subrecipient monitoring policies and procedures. Questioned Costs: None noted. Cause: Staff were not aware of the extent of the requirements to monitor program and fiscal compliance of project sponsors and document results and evidence of compliance or non-compliance. Therefore, a number of project sponsors/subrecipients were not monitored. Effect: Granting agencies cannot determine whether the Foundation is ensuring that the project sponsor is carrying out activities in compliance with all applicable requirements. Recommendation: The Foundation provide written policies and procedures for project sponsor monitoring and oversight, create a risk analysis form/process for all funded project sponsors and create a timeline to monitor project sponsors based on the risk analysis completed. Views of Responsible Officials: The Foundation has updated its Quality Management Plan to include comprehensive subrecipient monitoring policies. The Quality Management team is working with all programming to implement a robust monitoring process, including risk assessments, adherence to grantor regulations, service delivery, and program outcomes.
Criteria or specific requirement: 2 CFR Part 200, Subpart F requires the pass-through entity to verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Kansas Division of Emergency Management (Management) did not track, determine or monitor the audit verification requirement for its subrecipients in a timely manner. Questioned costs: None Context: For 18 of 22 subrecipients selected for testing (82%), Management did not timely verify subrecipients were audited in accordance with Subpart F. Management did not send the annual audit letter to the subrecipients on a timely basis or provide an adequate documentation for the audit verification to verify this was conducted during the fiscal year ended June 30, 2024. Cause: Procedures and controls were not sufficient to ensure that it verified that subrecipients were audited in accordance with Subpart F timely. Effect: Without being able to verify through supporting documentation that subrecipients have obtained audits as required by Subpart F and management met the requirements in 2 CFR Part 200 Subpart F and 2 CFR 200.303,, there is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Management on a timely basis. Repeat Finding: No. Recommendation: We recommend that the agency review its procedures for monitoring of annual audits for subrecipients to ensure that subrecipients are audited in accordance with Subpart F timely and that supporting documentation is maintained to evidence this was done timely. We recommend that a clear timeline and tracking for this monitoring be added to the policies and procedures. Views of responsible officials: Management does not agree with this finding. Explanation of disagreement with audit finding: • KDEM manages the grant expenditures during the entire lifespan of the project. Scope of work is matched with actual expenses and validated before sending to FEMA for close-out. • KDEM’s audit tracker identifies when audit letters were sent and can be verified through email verification sent to sub-recipients. • There is no regulation stipulating what is “timely”. KDEM verifies audits annually. Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise the finding. Sufficient supporting evidence to demonstrate when the audit letters were sent and returned was not provided during the single audit testing process. We also did not see a detailed timeline and tracking process documented in policies and procedures to support evidence of compliance with these requirements.
Criteria or specific requirement: 2 CFR Part 200, Subpart F requires the pass-through entity to verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Kansas Division of Emergency Management (Management) did not track, determine or monitor the audit verification requirement for its subrecipients in a timely manner. Questioned costs: None Context: For 18 of 22 subrecipients selected for testing (82%), Management did not timely verify subrecipients were audited in accordance with Subpart F. Management did not send the annual audit letter to the subrecipients on a timely basis or provide an adequate documentation for the audit verification to verify this was conducted during the fiscal year ended June 30, 2024. Cause: Procedures and controls were not sufficient to ensure that it verified that subrecipients were audited in accordance with Subpart F timely. Effect: Without being able to verify through supporting documentation that subrecipients have obtained audits as required by Subpart F and management met the requirements in 2 CFR Part 200 Subpart F and 2 CFR 200.303,, there is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Management on a timely basis. Repeat Finding: No. Recommendation: We recommend that the agency review its procedures for monitoring of annual audits for subrecipients to ensure that subrecipients are audited in accordance with Subpart F timely and that supporting documentation is maintained to evidence this was done timely. We recommend that a clear timeline and tracking for this monitoring be added to the policies and procedures. Views of responsible officials: Management does not agree with this finding. Explanation of disagreement with audit finding: • KDEM manages the grant expenditures during the entire lifespan of the project. Scope of work is matched with actual expenses and validated before sending to FEMA for close-out. • KDEM’s audit tracker identifies when audit letters were sent and can be verified through email verification sent to sub-recipients. • There is no regulation stipulating what is “timely”. KDEM verifies audits annually. Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise the finding. Sufficient supporting evidence to demonstrate when the audit letters were sent and returned was not provided during the single audit testing process. We also did not see a detailed timeline and tracking process documented in policies and procedures to support evidence of compliance with these requirements.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2024 ¬– 015: ALN 10.565, 10.568, 10.569 – Food Distribution Cluster ALN 15.252 – Abandoned Mine Land Reclamation (AMLR) ALN 21.027 – COVID 19 – Coronavirus State and Local Fiscal Recovery Funds ALN 84.425C – COVID 19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID 19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID 19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID 19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID 19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID 19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, 93.053 – Aging Cluster (including COVID-19) ALN 93.558 – Temporary Assistance for Needy Families ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2023-024) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 231PA445Q2204 (10/01/2022 – 9/30/2023), 231PA825Y8005 (10/01/2022 – 9/30/2023), 231PA825Y8105 (10/01/2022 – 9/30/2023), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), S18AF20004 (11/01/2017 – 10/31/2025), S19AF20004 (12/01/2018 – 11/30/2025), S21AF10015 (1/01/2021 – 12/31/2023), S22AF00017 (1/01/2022 – 12/31/2024), S23AF00002 (11/01/2022 – 10/31/2027), TN75GJE1S7G3 (3/03/2021 – 12/31/2024), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021– 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PAPHC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PAOASS (10/01/2021 – 9/30/2023), 2201PASTPH (1/01/2022 – 9/30/2024), 2301PAOACM (10/01/2022 – 9/30/2024), 2301PAOAHD (10/01/2022 – 9/30/2024), 2301PAOANS (10/01/2022 – 9/30/2024), 2301PAOASS (10/01/2022 – 9/30/2024), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2101PATANF (10/01/2020 – 9/30/2021), 2201PATANF (10/01/2021 – 9/30/2022), 2301PATANF (10/01/2022 – 9/30/2023), 2401PATANF (10/01/2023 – 9/30/2024), 2301PASOSR (10/01/2022 – 9/30/2024), 2401PASOSR (10/01/2023 – 9/30/2025), 2301PATANF (10/01/2022 – 9/30/2024), 2401PATANF (10/01/2023 – 9/30/2025) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters for Abandoned Mine Land Reclamation (AMLR), Temporary Assistance for Needy Families, Coronavirus State and Local Fiscal Recovery Funds, and Social Services Block Grant Material Weakness in Internal Control over Compliance, Material Noncompliance for Food Distribution Cluster, Education Stabilization Fund, and Aging Cluster Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) Acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance Finding 2024 ¬– 015: (continued) audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2024 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2023 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2024. We also evaluated the Commonwealth’s review of 45 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2024 and required management decisions by Commonwealth agencies. Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 17.6 months to over 18 months after the FAC Acceptance date for two out of two audit reports with findings. There was also a delay in PDOA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): Our testing disclosed that PDA did not have procedures in place to track audit reports including having an audit tracking list. The time period for making a management decision on findings was approximately 8.7 months to over 16 months after the FAC Acceptance date for four out of four audit reports with findings. • Department of Education (PDE): The time period for making a management decision on findings was approximately 7.8 months to over 12 months after the FAC Acceptance date for seven out of 22 audit reports with findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Department of Environmental Protection (DEP): The time period for making a management decision on findings was approximately 11.6 months to over 12 months after the FAC Acceptance date for two out of two audit reports with findings. Our testing disclosed for the two late audit reports, DEP made management decisions timely. However, DEP did not notify the subrecipients of the management decisions within the required six month time period after the audit reports FAC Acceptance date. • Department of Human Services (DHS): The time period for making a management decision on findings was approximately 7.2 months after the FAC Acceptance date for one out of two audit reports with findings. Our testing disclosed for the one late audit report DHS made a management decision timely. However, DHS did not notify the subrecipient of the management decision within the required six month time period after the audit reports FAC Acceptance date. Criteria: 2 CFR §200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: Finding 2024 ¬– 015: (continued) (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (f) Verify that every subrecipient is audited as required by Subpart F [Audit Requirements] of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501 [Audit requirements]. (g) Consider whether the results of the subrecipient’s audit, on-site review, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] of this part and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR §200.512, Report submission, states in part: (a) General. (1) The audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR §200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR §200.505, Sanctions, states: In cases of continued inability or unwillingness to have an audit conducted in accordance with this part, Federal agencies and pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR §200.339, Remedies for noncompliance, states in part: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in §200.208 [Specific conditions]. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances. Finding 2024 ¬– 015: (continued) (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR Part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Finding 2024 ¬– 015: (continued) Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: c. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (6) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. PDOA Response: PDOA agrees with the finding. PDA Response: PDA agrees with the finding. PDE Response: PDE agrees with the finding. DEP Response: DEP agrees with the finding. Finding 2024 ¬– 015: (continued) DHS Response: DHS agrees that there was an exception where human error caused a management decision on one single audit report to be issued untimely; in this instance, the decision itself was made timely but was not communicated in a timely manner. DHS disagrees that an isolated incident due to human error signifies a weakness in internal controls. This was not a systemic issue and therefore should not have been considered a significant deficiency in internal controls, and DHS should not have been included in this finding. Auditors’ Conclusion: The agency responses from PDOA, PDA, PDE, and DEP indicate agreement with the finding. DHS agrees that an error occurred resulting in untimely submission of one management decision, DHS disagrees that the error represents a significant deficiency. We acknowledge the error occurred due to an oversight and is not a systemic error, however, the error resulted in noncompliance with one of two audit reports that required timely management decisions. We will evaluate corrective action in the subsequent audit. The finding remains as stated. Questioned Costs: The amount of questioned costs cannot be determined.
CONDITION Career and Technical Education is not verifying every subrecipient is audited and reviewing audit findings as required by 2 CFR 200, Subpart F. Subsequently, by not verifying every subrecipient is audited, Career and Technical Education is not ensuring their responsibilities for issuing management decisions are performed, if any findings are identified in the audits. CRITERIA All pass-through entities must: • Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and terms and conditions of the subaward, and that the subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include, in part, following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward; issuing a management decision for applicable audit findings pertaining only to the federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521; and ensuring audit findings specifically related to the subaward are resolved (2 CFR 200.332(d)). • Verify that every subrecipient is audited as required by 2 CFR 200, Subpart F, when it is expected that the subrecipient's Federal award expended during the respective fiscal year equaled or exceeded the $750,000 threshold set forth in 2 CFR 200.501 (2 CFR 200.332(f). Federal regulation, 2 CFR 200.303, requires non-Federal entities, in part, to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. CAUSE Career and Technical Education has not established processes to identify which subrecipients are subject to required audits or to obtain and review Uniform Guidance Single Audit reports. In addition, Career and Technical Education has not developed a tracking system to ensure timely submission of required audit reports and to ensure timely and appropriate corrective action is taken on all deficiencies. EFFECT Subrecipient noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward, including audit findings pertaining to the Federal award, may go undetected and unresolved. CONTEXT Career and Technical Education awarded subawards, individually up to $10 million, to 13 subrecipients totaling $74.6 million for 19 different multi-purpose community facility projects. Career and Technical Education has had prior experience with these subrecipients. Projects were included in the state’s program plan that was reviewed and approved by U.S. Treasury. Career and Technical Education imposed specific subaward conditions upon each subrecipient requiring payments as reimbursements rather than advance payments. Career and Technical Education performs ongoing monitoring procedures through review and approval of subrecipient requests for reimbursements, which includes reviewing invoices and contractor progress billings for unallowable expenses, prior to disbursing Capital Project Funds. Lastly, Career and Technical Education conducts annual on-site visits of started projects until completed to visually inspect projects are being completed as planned. Where sampling was performed, the audit used a non-statistical sampling method. This finding, in combination with the finding regarding required communication of award information to the subrecipients (Finding 2024-04), results in a modified opinion for the subrecipient monitoring compliance requirement. IDENTIFICATION AS A REPEAT FINDING Not a repeat finding. RECOMMENDATION We recommend Career and Technical Education establish processes to identify which subrecipients are subject to required audits and to obtain and review Uniform Guidance Single Audit reports, including developing a tracking system to ensure timely submission of required audit reports and timely and appropriate corrective action is taken on all deficiencies. We also recommend Career and Technical Education verify every subrecipient is audited as required by 2 CFR 200, Subpart F; follow-up and ensure that subrecipients take timely and appropriate action on all deficiencies of the Federal award; and issue management decisions and ensure audit findings have been resolved. CAREER AND TECHNICAL EDUCATION RESPONSE The Department agrees with this recommendation See “Management’s Response and Corrective Action” section of this report.
Program: AL 97.036 – Disaster Grants – Public Assistance (Presidentially Declared Disasters) – Subrecipient Monitoring Grant Number & Year: 4616-DR-NE, declared September 6, 2021; 4420-DR-NE, declared March 21, 2019; 4641-DR-NE, declared February 23, 2022; 4662-DR-NE, declared July 27, 2022; 4521-DR-NE, declared April 4, 2020 Federal Grantor Agency: U.S. Department of Homeland Security Criteria: 2 CFR § 200.332 (January 1, 2024) states, in relevant part, the following: All pass-through entities must: * * * * (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. 2 CFR § 200.501(b) (January 1, 2024) states, in relevant part, the following, “A non-Federal entity that expends $750,000 or more during the non-Federal entity’s fiscal year in Federal awards must have a single audit conducted in accordance with § 200.514 . . . .” A good internal control plan includes procedures to ensure subrecipient audits are reviewed timely. Condition: The Agency did not ensure subrecipients obtained Single audits. A similar finding was noted in the prior audit. Repeat Finding: 2023-063 Questioned Costs: None Statistical Sample: No Context: We selected three subrecipients for testing that would have required a Single audit based on the amount of funds received from the Agency during the subrecipient’s previous fiscal year. One of the three subrecipients received $12,604,747 in disaster grant funds passed through the Agency during the subrecipient’s fiscal year 2023, but did not submit a Single audit and the Agency had not followed up with the subrecipient. Cause: Employee oversight. The subrecipient returned a certification stating that they did not require a Single audit, and the Agency failed to verify the certification was proper. Effect: Without adequate monitoring procedures, there is an increased risk that Federal awards could be used for unallowable costs. Recommendation: We recommend the Agency implement procedures to ensure subrecipient audits are obtained and reviewed timely. Management Response: Military (NEMA) agrees with the finding and has implemented the corrective action plan.
Finding 2024 - 001 Lack of Subrecipient Monitoring Procedures – Verification of Audits Information on the Federal Programs: 19.511 Criteria: Per 2 CFR § 200.332(f), pass-through entities must ensure that subrecipients expending $750,000 or more in Federal awards during the subrecipient’s fiscal year undergo a single or program-specific audit as required by 2 CFR § 200.501. Additionally, per 2 CFR § 200.332(d), passthrough entities must monitor subrecipients to ensure compliance with Federal statutes, regulations, and the terms and conditions of the subaward. Condition: During the audit, it was noted that the entity does not have a formalized process in place to verify whether subrecipients required to undergo a single audit have completed and submitted the audit as required. Specifically, there was no documented evidence that the entity reviewed audit reports or followed up on subrecipient audit compliance. Cause: The entity has not established or implemented adequate policies and procedures to monitor subrecipient compliance with audit requirements under the Uniform Guidance. Effect or Potential Effect: Failure to verify and review subrecipient audit reports increases the risk that noncompliance, questioned costs, or internal control deficiencies at the subrecipient level go undetected, potentially resulting in unallowable costs or noncompliance with Federal regulations. Questioned Costs: None noted at this time; however, the lack of monitoring increases the risk of unallowable costs in Federal programs. Context: BRAC USA has one primary subrecipient for which a single audit was not performed prior to our audit fieldwork. Identification as a Repeat Finding, if Applicable: Not a repeat finding. Recommendation: We recommend that the entity develop and implement formal written procedures to ensure subrecipient audit requirements are met. These procedures should include: Identifying subrecipients required to undergo a single audit. Requiring subrecipients to submit audit reports and management letters annually. Reviewing subrecipient audit reports to identify findings that may impact the entity. Establishing follow-up procedures to address and resolve subrecipient audit findings. Maintaining documentation of audit verification and any corrective actions taken.
Reference Number: 2024-006 – Subrecipient Monitoring Federal Program Title: WIOA Cluster Federal Assistance Listing Number: 17.258 BWC Federal Agency: Department of Labor (DOL) Pass-Through Entity: State of California Employment Development Department Federal Award Number and Year: AA211079 Fiscal Year 2023-2024 Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Instance of Noncompliance Criteria In accordance with Title 2 U.S. Code of Federal Regulations (CFR) § 200.332, all pass-through entities (PTE) must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section. (c) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. (d) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Condition During our audit of compliance with subrecipient monitoring, we noted that for one (1) subrecipient agreement, the agreement did not include one or more of the required elements defined in 2 CFR § 200.332 (a)(1) in the subrecipient’s agreement. For the same one (1) subrecipient, the Organization did not perform the risk assessment procedures defined in 2 CFR § 200.332 (b) or verify that the subrecipient should be audited as defined in 2 CFR § 200.332 (d). Cause Due to significant turnover in key personnel in the Organization’s finance department and management in past years, the Organization has no documented policies and procedures for subrecipient monitoring. Effect Not providing sufficient documentation to auditors to demonstrate compliance with federal compliance results in an audit scope limitation. Failure to provide all the required subaward information may result in subrecipients incorrectly reporting on federal pass-through awards in their Single Audit reports. Failure to document subrecipient risk assessment and verifying the subrecipient audit requirement result in noncompliance with the subrecipient monitoring requirements 2 CFR § 200.332. Questioned Costs Questioned costs were not determinable. Context For one (1) subrecipient selected for testing, with total expenditures of $325,977, from a population of one (1) subrecipient, the Company did not communicate all of the required subaward data elements, did not perform subrecipient risk assessment, and did not verify if subrecipient received audit. The sample was not a statistically valid sample. Recommendation We recommend that the Organization perform the following: (1) Develop procedures for future subrecipient agreements to ensure agreements will include all the required elements of 2 CFR § 200.332 (a)(1). (2) For existing subrecipients that were not provided the required elements, provide a letter or amended agreement to include all the required elements of 2 CFR § 200.332 (a)(1). (3) Maintain sufficient records of subrecipient risk assessment and monitoring subrecipients in accordance with subrecipient monitoring requirements noted in 2 CFR § 200.332 (b) – (d). Views of Responsible Officials and Planned Corrective Action Person responsible: Leona Smith Di Faustino, Interim Executive Director Corrective Action Plan: The Organization will update its subrecipient monitoring policies to ensure all required elements as defined in 2 CFR § 200.332 (a)(1) are included in subrecipient agreements, Additionally, a checklist will be established to perform a risk assessment process to evaluate subrecipient risk prior to contract execution and annually thereafter and to verify each subrecipient’s that meets the audit threshold and if required has a current Single Audit on file or is otherwise in compliance. Anticipated Implementation Date: July 1, 2025
Congressional Directives, ALN 93.493, U.S. Department of Health and Human Services Applicable Institution: University of Mississippi Medical Center (UMMC) Congressional Directives, ALN 95.010, Executive Office of the President Applicable Institution; University of Mississippi (UM) Program Year 2023-2024 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement – Subrecipient Monitoring (31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.332, and 200.501(h); federal awarding agency regulations; and the terms and conditions of the award. Condition – The pass-through entity must identify the award and applicable requirements, including whether the grant is considered research and development (R&D). Subawards were made that identified the grants as R&D when they were not. Cause – The institution’s internal controls did not ensure the applicable requirements were communicated to the subrecipient. Effect or Potential Effect – The subaward was or could have been improperly classified as R&D on the subrecipients’ schedule of expenditures of federal awards. Questioned costs – None Context – ALN 93.493 - Out of 3 subrecipients, a sample of 1 was selected for testing, ALN 95.010 – Out of 7 subrecipients, a sample of 2 were selected for testing. Our sample was not, and was not intended to be, statistically valid. All awards tested communicated that the subaward was R&D. Identification as a Repeat Finding, if Applicable – N/A Recommendation – The institutions should update policies and procedures to ensure the award and applicable requirements are communicated to subrecipients. Views of Responsible Officials and Planned Corrective Actions – There is no disagreement with the audit finding. See corrective action plan.
Congressional Directives, ALN 93.493, U.S. Department of Health and Human Services Applicable Institution: University of Mississippi Medical Center (UMMC) Congressional Directives, ALN 95.010, Executive Office of the President Applicable Institution; University of Mississippi (UM) Program Year 2023-2024 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement – Subrecipient Monitoring (31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.332, and 200.501(h); federal awarding agency regulations; and the terms and conditions of the award. Condition – The pass-through entity must identify the award and applicable requirements, including whether the grant is considered research and development (R&D). Subawards were made that identified the grants as R&D when they were not. Cause – The institution’s internal controls did not ensure the applicable requirements were communicated to the subrecipient. Effect or Potential Effect – The subaward was or could have been improperly classified as R&D on the subrecipients’ schedule of expenditures of federal awards. Questioned costs – None Context – ALN 93.493 - Out of 3 subrecipients, a sample of 1 was selected for testing, ALN 95.010 – Out of 7 subrecipients, a sample of 2 were selected for testing. Our sample was not, and was not intended to be, statistically valid. All awards tested communicated that the subaward was R&D. Identification as a Repeat Finding, if Applicable – N/A Recommendation – The institutions should update policies and procedures to ensure the award and applicable requirements are communicated to subrecipients. Views of Responsible Officials and Planned Corrective Actions – There is no disagreement with the audit finding. See corrective action plan.
Finding Reference Number: 2024-005 NH Fish and Game Department Fish and Wildlife Cluster (Assistance Listing #15.605, #15.611, #15.626) Federal Award Numbers: F22AF00995-00, F22AF00929-00, F23AF03086-00, F22AF00514-01, F22AF02616-02 Federal Award Year: 2022, 2023 U.S. Department of Interior Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness and Material Noncompliance Prior Year Finding: N/A Statistically Valid Sample: The sample was not intended to be, and was not, a statistically valid sample. Criteria A pass-through entity (PTE) must: 1. Identify the Award and Applicable Requirements - Clearly identify to the subrecipient required award information and applicable requirements described in 2 CFR section 200.332(a). 2. Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). 3. Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: a. Reviewing financial and programmatic (performance and special reports) required by the PTE. b. Following up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. c. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. 2 CFR 200.303, non-federal entities must establish and maintain effective internal control over federal awards that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. This would include internal controls related to the cash management process. Condition During the year ended June 30, 2024, the New Hampshire Fish and Game Department (the Department) passed through $484,952 of federal funding to 1 subrecipient to fund 4 different projects. As part of our testwork related subrecipient monitoring, we identified the following: A. The Department communicates award information through the approved grant agreement. For 3 of 4 projects selected for testwork, the Department did not communicate all the required award information as outlined in 2 CFR 200.332(b). Specifically, the following elements were not communicated: • Subrecipient's unique entity identifier • Identification of whether the Federal award is for research and development B. As part of the during the award monitoring testwork, we noted that the Department completes a risk assessment questionnaire for all new projects they approve for the subrecipient. As part of our testwork over the risk assessments performed, we identified the following: • For 1 of 4 projects selected for testwork, there was no risk assessment questionnaire completed. • For 3 of 4 projects selected for testwork, a risk assessment questionnaire was completed, however there were no required monitoring procedures outlined within the questionnaire. As a result, we were not able to determine what monitoring procedures should have been performed over the projects as a result of the risk assessment. C. The Department’s during the award monitoring includes the review and approval of the subrecipient’s request for reimbursement. During our testwork over the review and approval of the request for reimbursement, we noted that for all 9 invoices selected for testwork, that while the invoice appeared to be properly reviewed and approved, the level of detail included within the invoice would not allow the Department to determine the reasonableness of the costs incurred to ensure that they were incurred in accordance with the grant agreement. D. The Department’s during the award monitoring includes obtaining a progress report related to each project that the subrecipient has been granted funding for. As part of our testwork, we identified that for all 4 projects selected for testwork, while a progress report was obtained, there was no evidence provided to support that the Department had reviewed the report. As a result, we were unable to determine based on the Department’s risk assessment procedures what the type and frequency of monitoring procedures that should have been performed over each project. E. The Department does not have formal policies and procedures to review and maintain documentation to evidence the review and approval of the subrecipient’s unform guidance report. There was no documentation to support that the Department had obtained and reviewed its subrecipient’s most recent uniform guidance report issued. Cause The cause of the condition found was primarily due to a lack of formal written policies and procedures and internal controls to ensure that all required subrecipient monitoring compliance procedures are being performed by the Department. Effect The effect of the condition found is that the Department did not comply with 2 CFR section 200.332(a), 2 CFR section 200.332(b), 2 CFR sections 200.332(d) through (f), and 2 CFR section 200.501(h). Questioned Costs: None. Recommendation We recommend the Department develop written policies and procedures and implement internal controls to ensure that the Department complies with 2 CFR section 200.332(a), 2 CFR section 200.332(b), 2 CFR sections 200.332(d) through (f), and 2 CFR section 200.501(h). This would ensure that all subrecipient grant agreements contains all required communications, that a risk assessment is performed that will outline the types and frequency of monitoring procedures to be performed, that all during the award monitoring activities are properly documented and that the receipt and review of the subrecipient’s uniform guidance report is properly documented. View of Responsible Officials: Management partially concurs with this finding. Rejoinder: As documented within the condition found, sufficient documentation was not provided to demonstrate that the Department complied with 2 CFR section 200.332(a), 2 CFR section 200.332(b), 2 CFR sections 200.332(d) through (f), and 2 CFR section 200.501(h).
Finding Reference Number: 2024-005 NH Fish and Game Department Fish and Wildlife Cluster (Assistance Listing #15.605, #15.611, #15.626) Federal Award Numbers: F22AF00995-00, F22AF00929-00, F23AF03086-00, F22AF00514-01, F22AF02616-02 Federal Award Year: 2022, 2023 U.S. Department of Interior Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness and Material Noncompliance Prior Year Finding: N/A Statistically Valid Sample: The sample was not intended to be, and was not, a statistically valid sample. Criteria A pass-through entity (PTE) must: 1. Identify the Award and Applicable Requirements - Clearly identify to the subrecipient required award information and applicable requirements described in 2 CFR section 200.332(a). 2. Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). 3. Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: a. Reviewing financial and programmatic (performance and special reports) required by the PTE. b. Following up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. c. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. 2 CFR 200.303, non-federal entities must establish and maintain effective internal control over federal awards that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. This would include internal controls related to the cash management process. Condition During the year ended June 30, 2024, the New Hampshire Fish and Game Department (the Department) passed through $484,952 of federal funding to 1 subrecipient to fund 4 different projects. As part of our testwork related subrecipient monitoring, we identified the following: A. The Department communicates award information through the approved grant agreement. For 3 of 4 projects selected for testwork, the Department did not communicate all the required award information as outlined in 2 CFR 200.332(b). Specifically, the following elements were not communicated: • Subrecipient's unique entity identifier • Identification of whether the Federal award is for research and development B. As part of the during the award monitoring testwork, we noted that the Department completes a risk assessment questionnaire for all new projects they approve for the subrecipient. As part of our testwork over the risk assessments performed, we identified the following: • For 1 of 4 projects selected for testwork, there was no risk assessment questionnaire completed. • For 3 of 4 projects selected for testwork, a risk assessment questionnaire was completed, however there were no required monitoring procedures outlined within the questionnaire. As a result, we were not able to determine what monitoring procedures should have been performed over the projects as a result of the risk assessment. C. The Department’s during the award monitoring includes the review and approval of the subrecipient’s request for reimbursement. During our testwork over the review and approval of the request for reimbursement, we noted that for all 9 invoices selected for testwork, that while the invoice appeared to be properly reviewed and approved, the level of detail included within the invoice would not allow the Department to determine the reasonableness of the costs incurred to ensure that they were incurred in accordance with the grant agreement. D. The Department’s during the award monitoring includes obtaining a progress report related to each project that the subrecipient has been granted funding for. As part of our testwork, we identified that for all 4 projects selected for testwork, while a progress report was obtained, there was no evidence provided to support that the Department had reviewed the report. As a result, we were unable to determine based on the Department’s risk assessment procedures what the type and frequency of monitoring procedures that should have been performed over each project. E. The Department does not have formal policies and procedures to review and maintain documentation to evidence the review and approval of the subrecipient’s unform guidance report. There was no documentation to support that the Department had obtained and reviewed its subrecipient’s most recent uniform guidance report issued. Cause The cause of the condition found was primarily due to a lack of formal written policies and procedures and internal controls to ensure that all required subrecipient monitoring compliance procedures are being performed by the Department. Effect The effect of the condition found is that the Department did not comply with 2 CFR section 200.332(a), 2 CFR section 200.332(b), 2 CFR sections 200.332(d) through (f), and 2 CFR section 200.501(h). Questioned Costs: None. Recommendation We recommend the Department develop written policies and procedures and implement internal controls to ensure that the Department complies with 2 CFR section 200.332(a), 2 CFR section 200.332(b), 2 CFR sections 200.332(d) through (f), and 2 CFR section 200.501(h). This would ensure that all subrecipient grant agreements contains all required communications, that a risk assessment is performed that will outline the types and frequency of monitoring procedures to be performed, that all during the award monitoring activities are properly documented and that the receipt and review of the subrecipient’s uniform guidance report is properly documented. View of Responsible Officials: Management partially concurs with this finding. Rejoinder: As documented within the condition found, sufficient documentation was not provided to demonstrate that the Department complied with 2 CFR section 200.332(a), 2 CFR section 200.332(b), 2 CFR sections 200.332(d) through (f), and 2 CFR section 200.501(h).
Finding Reference Number: 2024-005 NH Fish and Game Department Fish and Wildlife Cluster (Assistance Listing #15.605, #15.611, #15.626) Federal Award Numbers: F22AF00995-00, F22AF00929-00, F23AF03086-00, F22AF00514-01, F22AF02616-02 Federal Award Year: 2022, 2023 U.S. Department of Interior Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness and Material Noncompliance Prior Year Finding: N/A Statistically Valid Sample: The sample was not intended to be, and was not, a statistically valid sample. Criteria A pass-through entity (PTE) must: 1. Identify the Award and Applicable Requirements - Clearly identify to the subrecipient required award information and applicable requirements described in 2 CFR section 200.332(a). 2. Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). 3. Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: a. Reviewing financial and programmatic (performance and special reports) required by the PTE. b. Following up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. c. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. 2 CFR 200.303, non-federal entities must establish and maintain effective internal control over federal awards that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. This would include internal controls related to the cash management process. Condition During the year ended June 30, 2024, the New Hampshire Fish and Game Department (the Department) passed through $484,952 of federal funding to 1 subrecipient to fund 4 different projects. As part of our testwork related subrecipient monitoring, we identified the following: A. The Department communicates award information through the approved grant agreement. For 3 of 4 projects selected for testwork, the Department did not communicate all the required award information as outlined in 2 CFR 200.332(b). Specifically, the following elements were not communicated: • Subrecipient's unique entity identifier • Identification of whether the Federal award is for research and development B. As part of the during the award monitoring testwork, we noted that the Department completes a risk assessment questionnaire for all new projects they approve for the subrecipient. As part of our testwork over the risk assessments performed, we identified the following: • For 1 of 4 projects selected for testwork, there was no risk assessment questionnaire completed. • For 3 of 4 projects selected for testwork, a risk assessment questionnaire was completed, however there were no required monitoring procedures outlined within the questionnaire. As a result, we were not able to determine what monitoring procedures should have been performed over the projects as a result of the risk assessment. C. The Department’s during the award monitoring includes the review and approval of the subrecipient’s request for reimbursement. During our testwork over the review and approval of the request for reimbursement, we noted that for all 9 invoices selected for testwork, that while the invoice appeared to be properly reviewed and approved, the level of detail included within the invoice would not allow the Department to determine the reasonableness of the costs incurred to ensure that they were incurred in accordance with the grant agreement. D. The Department’s during the award monitoring includes obtaining a progress report related to each project that the subrecipient has been granted funding for. As part of our testwork, we identified that for all 4 projects selected for testwork, while a progress report was obtained, there was no evidence provided to support that the Department had reviewed the report. As a result, we were unable to determine based on the Department’s risk assessment procedures what the type and frequency of monitoring procedures that should have been performed over each project. E. The Department does not have formal policies and procedures to review and maintain documentation to evidence the review and approval of the subrecipient’s unform guidance report. There was no documentation to support that the Department had obtained and reviewed its subrecipient’s most recent uniform guidance report issued. Cause The cause of the condition found was primarily due to a lack of formal written policies and procedures and internal controls to ensure that all required subrecipient monitoring compliance procedures are being performed by the Department. Effect The effect of the condition found is that the Department did not comply with 2 CFR section 200.332(a), 2 CFR section 200.332(b), 2 CFR sections 200.332(d) through (f), and 2 CFR section 200.501(h). Questioned Costs: None. Recommendation We recommend the Department develop written policies and procedures and implement internal controls to ensure that the Department complies with 2 CFR section 200.332(a), 2 CFR section 200.332(b), 2 CFR sections 200.332(d) through (f), and 2 CFR section 200.501(h). This would ensure that all subrecipient grant agreements contains all required communications, that a risk assessment is performed that will outline the types and frequency of monitoring procedures to be performed, that all during the award monitoring activities are properly documented and that the receipt and review of the subrecipient’s uniform guidance report is properly documented. View of Responsible Officials: Management partially concurs with this finding. Rejoinder: As documented within the condition found, sufficient documentation was not provided to demonstrate that the Department complied with 2 CFR section 200.332(a), 2 CFR section 200.332(b), 2 CFR sections 200.332(d) through (f), and 2 CFR section 200.501(h).
Finding Reference Number: 2024-034 NH Department of Safety Disaster Grants – Public Assistance (Presidentially Declared Disasters) and COVID-19 Public Assistance (Presidentially Declared Disasters) (Assistance Listing #97.036) Federal Award Numbers: FEMA-4622-DR-NH, FEMA-4624-DR-NH, FEMA-4457-DR-NH, FEMA-4370-DR, FEMA-4693-DR, FEMA-4355-DR, FEMA-4329-DR, FEMA-4516-DR-NH Federal Award Year: July 17-19, 2021, July 29-30, 2021, July 11-12, 2019, March 2-8, 2018, December 22-December 25, 2022, October 29-November 1, 2017, July 1-2, 2017, January 20, 2020 U.S. Department of Homeland Security Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness and Material Noncompliance Prior Year Finding: 2023-023 Statistically Valid Sample: The sample was not intended to be, and was not, a statistically valid sample. Criteria A pass-through entity (PTE) must: 1. Identify the Award and Applicable Requirements – Clearly identify to the subrecipient: (1) the award as a subaward at the time of subaward (or subsequent subaward modification) by providing the information described in 2 CFR section 200.332(a)(1); (2) all requirements imposed by the PTE on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.332(a)(2)); and (3) any additional requirements that the PTE imposes on the subrecipient in order for the PTE to meet its own responsibility for the federal award (e.g., financial, performance, and special reports) (2 CFR section 200.332(a)(3)). 2. Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). 3. Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: a. Reviewing financial and programmatic (performance and special reports) required by the PTE. b. Following up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. c. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Additionally, 2 CFR 200.303 (a) states that non-federal entities must establish and maintain effective internal control over federal awards that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition As part of the Disaster Grants - Public Assistance program (DGPA), the New Hampshire Department of Safety - Homeland Security and Emergency Management (the Department) enters into grant agreements with local municipalities to provide reimbursement for expenditures incurred as a result of New Hampshire declared disasters. During the year ended June 30, 2024, $41,851,050 was passed through to 85 subrecipients. As part of our testwork over the subrecipient monitoring process, we noted the following: A. The Department communicates award information to subrecipients through the approved agreement. Per review of the agreement, for each of the 17 subrecipients selected for testwork, the Department did not communicate all the required award information as outlined in 2 CFR section 200.332(a). Specifically, the following elements were not communicated: • Identification of whether the award is R&D was not communicated for 13 of 17 subrecipients selected for testwork; and • Indirect cost rate for the federal award was not communicated for 13 of 17 subrecipients selected for testwork B. For 4 of 17 subrecipients selected for testwork, while a risk assessment was performed, the Department did not perform it within calendar year of when the award was obligated as outlined within their policies and procedures. C. For 1 of 17 subrecipients selected for testwork, the risk assessment form was not dated or initialed to indicted when the risk assessment procedures were performed. As such, it was unclear if the risk assessment was completed timely. D. During our testwork over the Department’s review of subrecipient uniform guidance reports, we noted there were no uniform guidance report review policies and procedures in place. For the 17 subrecipients selected for testwork, 5 subrecipients were identified in which the Department did not review the most recent uniform guidance report issued. Specifically, we noted: • For 4 of 5 subrecipients, the subrecipient’s uniform guidance report was not reviewed due to updated risk assessments not being performed in the current year. • For 1 of 5 subrecipients, the current year risk assessment was performed prior to the receipt of the subrecipient’s uniform guidance report and management did not go back to review the report. Cause The cause of the condition found was primarily due to the Department not following their sub monitoring internal controls in accordance with written formal policies and procedures. Questioned Costs: None. Recommendation We recommend that the Department develop policies and procedures and implement internal controls to ensure that the Department complies with 2 CFR section 200.332(a-h) and 2 CFR section 200.501(h). View of Responsible Officials: Management concurs with the finding above.
Finding Reference Number: 2024-034 NH Department of Safety Disaster Grants – Public Assistance (Presidentially Declared Disasters) and COVID-19 Public Assistance (Presidentially Declared Disasters) (Assistance Listing #97.036) Federal Award Numbers: FEMA-4622-DR-NH, FEMA-4624-DR-NH, FEMA-4457-DR-NH, FEMA-4370-DR, FEMA-4693-DR, FEMA-4355-DR, FEMA-4329-DR, FEMA-4516-DR-NH Federal Award Year: July 17-19, 2021, July 29-30, 2021, July 11-12, 2019, March 2-8, 2018, December 22-December 25, 2022, October 29-November 1, 2017, July 1-2, 2017, January 20, 2020 U.S. Department of Homeland Security Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness and Material Noncompliance Prior Year Finding: 2023-023 Statistically Valid Sample: The sample was not intended to be, and was not, a statistically valid sample. Criteria A pass-through entity (PTE) must: 1. Identify the Award and Applicable Requirements – Clearly identify to the subrecipient: (1) the award as a subaward at the time of subaward (or subsequent subaward modification) by providing the information described in 2 CFR section 200.332(a)(1); (2) all requirements imposed by the PTE on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.332(a)(2)); and (3) any additional requirements that the PTE imposes on the subrecipient in order for the PTE to meet its own responsibility for the federal award (e.g., financial, performance, and special reports) (2 CFR section 200.332(a)(3)). 2. Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). 3. Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: a. Reviewing financial and programmatic (performance and special reports) required by the PTE. b. Following up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. c. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Additionally, 2 CFR 200.303 (a) states that non-federal entities must establish and maintain effective internal control over federal awards that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition As part of the Disaster Grants - Public Assistance program (DGPA), the New Hampshire Department of Safety - Homeland Security and Emergency Management (the Department) enters into grant agreements with local municipalities to provide reimbursement for expenditures incurred as a result of New Hampshire declared disasters. During the year ended June 30, 2024, $41,851,050 was passed through to 85 subrecipients. As part of our testwork over the subrecipient monitoring process, we noted the following: A. The Department communicates award information to subrecipients through the approved agreement. Per review of the agreement, for each of the 17 subrecipients selected for testwork, the Department did not communicate all the required award information as outlined in 2 CFR section 200.332(a). Specifically, the following elements were not communicated: • Identification of whether the award is R&D was not communicated for 13 of 17 subrecipients selected for testwork; and • Indirect cost rate for the federal award was not communicated for 13 of 17 subrecipients selected for testwork B. For 4 of 17 subrecipients selected for testwork, while a risk assessment was performed, the Department did not perform it within calendar year of when the award was obligated as outlined within their policies and procedures. C. For 1 of 17 subrecipients selected for testwork, the risk assessment form was not dated or initialed to indicted when the risk assessment procedures were performed. As such, it was unclear if the risk assessment was completed timely. D. During our testwork over the Department’s review of subrecipient uniform guidance reports, we noted there were no uniform guidance report review policies and procedures in place. For the 17 subrecipients selected for testwork, 5 subrecipients were identified in which the Department did not review the most recent uniform guidance report issued. Specifically, we noted: • For 4 of 5 subrecipients, the subrecipient’s uniform guidance report was not reviewed due to updated risk assessments not being performed in the current year. • For 1 of 5 subrecipients, the current year risk assessment was performed prior to the receipt of the subrecipient’s uniform guidance report and management did not go back to review the report. Cause The cause of the condition found was primarily due to the Department not following their sub monitoring internal controls in accordance with written formal policies and procedures. Questioned Costs: None. Recommendation We recommend that the Department develop policies and procedures and implement internal controls to ensure that the Department complies with 2 CFR section 200.332(a-h) and 2 CFR section 200.501(h). View of Responsible Officials: Management concurs with the finding above.
2024-008 - Noncompliance with Subrecipient Monitoring Requirements State Entity: University of Louisiana at Lafayette (UL Lafayette) Award Years: 2019 - 2023 Award Numbers: DE-EE0009421, FA9550-21-1-0215, M19AC00015, OIA-1920858, OIA-2019511, OIA-2119688, U19AI142636 Compliance Requirement: Subrecipient Monitoring Repeat Finding: Yes (Prior Year Finding No. 2023-008) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the fourth consecutive year, UL Lafayette did not adequately monitor subrecipients of the Research and Development (R&D) Cluster Programs. In a non-statistical sample of seven subawards out of a population of 50 subawards, it was noted that for six (85.7%) of the subrecipients evaluated, UL Lafayette could not provide evidence that the financial and performance reports required by the subaward agreement were obtained and reviewed by UL Lafayette. For three (42.9%) of the subrecipients evaluated, UL Lafayette could not provide evidence that the required risk analyses were performed to evaluate each subrecipients’ fraud risk and risk of noncompliance with federal regulations and the terms of the subaward. For two of the subrecipients reviewed (28.6%), UL Lafayette was unable to provide documentation that ensured each subrecipient obtained the required audit and that the audit was reviewed so that timely and appropriate action could be taken for any findings pertaining to the federal awards, as required by federal regulations. Additionally, for one (14.3%) of the subrecipients evaluated, the subaward documents did not contain the federal award date as required by federal regulations. Criteria: Per 2 CFR 200.332(b)(1)(iv), all pass-through entities must ensure that every subaward includes the federal award date. 2 CFR 200.332(c) requires pass through entities to evaluate each subrecipient's fraud risk and risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. 2 CFR 200.332(e)(1) requires that pass-through monitoring include reviewing financial and performance reports required by the pass-through entity. 2 CFR 200.332(e)(2) and (3) require pass-through entities to issue a management decision on applicable audit findings, in accordance with 2 CFR 200.521, within six months after acceptance of the subrecipient’s audit report by the Federal Audit Clearinghouse, and ensure that the subrecipient takes timely and appropriate corrective action on all findings. Per 2 CFR 200.332(g), pass-through entities are responsible for verifying that every subrecipient is audited as required by 2 CFR Part 200, subpart F when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in CFR 200.501 of $750,000 or more in federal awards during the subrecipient’s fiscal year. Cause: UL Lafayette did not have sufficient controls in place to adequately monitor subrecipients as required by federal regulations. Effect: Failure to properly monitor subrecipients results in noncompliance with federal regulations and increases the likelihood of improper payments which may have to be returned to the federal awarding agency. Recommendation: UL Lafayette should strengthen controls to ensure that all required financial and performance reports are obtained and reviewed and that all required subrecipient audit reports are obtained and reviewed in order to evaluate the impact of any findings noted by the audit and issue management decision letters, if applicable. In addition, UL Lafayette should strengthen controls to ensure that required information is included in the subaward documents and that risk assessments are performed and documented on all subrecipients in accordance with federal regulations. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-64).
2024-008 - Noncompliance with Subrecipient Monitoring Requirements State Entity: University of Louisiana at Lafayette (UL Lafayette) Award Years: 2019 - 2023 Award Numbers: DE-EE0009421, FA9550-21-1-0215, M19AC00015, OIA-1920858, OIA-2019511, OIA-2119688, U19AI142636 Compliance Requirement: Subrecipient Monitoring Repeat Finding: Yes (Prior Year Finding No. 2023-008) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the fourth consecutive year, UL Lafayette did not adequately monitor subrecipients of the Research and Development (R&D) Cluster Programs. In a non-statistical sample of seven subawards out of a population of 50 subawards, it was noted that for six (85.7%) of the subrecipients evaluated, UL Lafayette could not provide evidence that the financial and performance reports required by the subaward agreement were obtained and reviewed by UL Lafayette. For three (42.9%) of the subrecipients evaluated, UL Lafayette could not provide evidence that the required risk analyses were performed to evaluate each subrecipients’ fraud risk and risk of noncompliance with federal regulations and the terms of the subaward. For two of the subrecipients reviewed (28.6%), UL Lafayette was unable to provide documentation that ensured each subrecipient obtained the required audit and that the audit was reviewed so that timely and appropriate action could be taken for any findings pertaining to the federal awards, as required by federal regulations. Additionally, for one (14.3%) of the subrecipients evaluated, the subaward documents did not contain the federal award date as required by federal regulations. Criteria: Per 2 CFR 200.332(b)(1)(iv), all pass-through entities must ensure that every subaward includes the federal award date. 2 CFR 200.332(c) requires pass through entities to evaluate each subrecipient's fraud risk and risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. 2 CFR 200.332(e)(1) requires that pass-through monitoring include reviewing financial and performance reports required by the pass-through entity. 2 CFR 200.332(e)(2) and (3) require pass-through entities to issue a management decision on applicable audit findings, in accordance with 2 CFR 200.521, within six months after acceptance of the subrecipient’s audit report by the Federal Audit Clearinghouse, and ensure that the subrecipient takes timely and appropriate corrective action on all findings. Per 2 CFR 200.332(g), pass-through entities are responsible for verifying that every subrecipient is audited as required by 2 CFR Part 200, subpart F when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in CFR 200.501 of $750,000 or more in federal awards during the subrecipient’s fiscal year. Cause: UL Lafayette did not have sufficient controls in place to adequately monitor subrecipients as required by federal regulations. Effect: Failure to properly monitor subrecipients results in noncompliance with federal regulations and increases the likelihood of improper payments which may have to be returned to the federal awarding agency. Recommendation: UL Lafayette should strengthen controls to ensure that all required financial and performance reports are obtained and reviewed and that all required subrecipient audit reports are obtained and reviewed in order to evaluate the impact of any findings noted by the audit and issue management decision letters, if applicable. In addition, UL Lafayette should strengthen controls to ensure that required information is included in the subaward documents and that risk assessments are performed and documented on all subrecipients in accordance with federal regulations. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-64).
2024-008 - Noncompliance with Subrecipient Monitoring Requirements State Entity: University of Louisiana at Lafayette (UL Lafayette) Award Years: 2019 - 2023 Award Numbers: DE-EE0009421, FA9550-21-1-0215, M19AC00015, OIA-1920858, OIA-2019511, OIA-2119688, U19AI142636 Compliance Requirement: Subrecipient Monitoring Repeat Finding: Yes (Prior Year Finding No. 2023-008) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the fourth consecutive year, UL Lafayette did not adequately monitor subrecipients of the Research and Development (R&D) Cluster Programs. In a non-statistical sample of seven subawards out of a population of 50 subawards, it was noted that for six (85.7%) of the subrecipients evaluated, UL Lafayette could not provide evidence that the financial and performance reports required by the subaward agreement were obtained and reviewed by UL Lafayette. For three (42.9%) of the subrecipients evaluated, UL Lafayette could not provide evidence that the required risk analyses were performed to evaluate each subrecipients’ fraud risk and risk of noncompliance with federal regulations and the terms of the subaward. For two of the subrecipients reviewed (28.6%), UL Lafayette was unable to provide documentation that ensured each subrecipient obtained the required audit and that the audit was reviewed so that timely and appropriate action could be taken for any findings pertaining to the federal awards, as required by federal regulations. Additionally, for one (14.3%) of the subrecipients evaluated, the subaward documents did not contain the federal award date as required by federal regulations. Criteria: Per 2 CFR 200.332(b)(1)(iv), all pass-through entities must ensure that every subaward includes the federal award date. 2 CFR 200.332(c) requires pass through entities to evaluate each subrecipient's fraud risk and risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. 2 CFR 200.332(e)(1) requires that pass-through monitoring include reviewing financial and performance reports required by the pass-through entity. 2 CFR 200.332(e)(2) and (3) require pass-through entities to issue a management decision on applicable audit findings, in accordance with 2 CFR 200.521, within six months after acceptance of the subrecipient’s audit report by the Federal Audit Clearinghouse, and ensure that the subrecipient takes timely and appropriate corrective action on all findings. Per 2 CFR 200.332(g), pass-through entities are responsible for verifying that every subrecipient is audited as required by 2 CFR Part 200, subpart F when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in CFR 200.501 of $750,000 or more in federal awards during the subrecipient’s fiscal year. Cause: UL Lafayette did not have sufficient controls in place to adequately monitor subrecipients as required by federal regulations. Effect: Failure to properly monitor subrecipients results in noncompliance with federal regulations and increases the likelihood of improper payments which may have to be returned to the federal awarding agency. Recommendation: UL Lafayette should strengthen controls to ensure that all required financial and performance reports are obtained and reviewed and that all required subrecipient audit reports are obtained and reviewed in order to evaluate the impact of any findings noted by the audit and issue management decision letters, if applicable. In addition, UL Lafayette should strengthen controls to ensure that required information is included in the subaward documents and that risk assessments are performed and documented on all subrecipients in accordance with federal regulations. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-64).
2024-008 - Noncompliance with Subrecipient Monitoring Requirements State Entity: University of Louisiana at Lafayette (UL Lafayette) Award Years: 2019 - 2023 Award Numbers: DE-EE0009421, FA9550-21-1-0215, M19AC00015, OIA-1920858, OIA-2019511, OIA-2119688, U19AI142636 Compliance Requirement: Subrecipient Monitoring Repeat Finding: Yes (Prior Year Finding No. 2023-008) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the fourth consecutive year, UL Lafayette did not adequately monitor subrecipients of the Research and Development (R&D) Cluster Programs. In a non-statistical sample of seven subawards out of a population of 50 subawards, it was noted that for six (85.7%) of the subrecipients evaluated, UL Lafayette could not provide evidence that the financial and performance reports required by the subaward agreement were obtained and reviewed by UL Lafayette. For three (42.9%) of the subrecipients evaluated, UL Lafayette could not provide evidence that the required risk analyses were performed to evaluate each subrecipients’ fraud risk and risk of noncompliance with federal regulations and the terms of the subaward. For two of the subrecipients reviewed (28.6%), UL Lafayette was unable to provide documentation that ensured each subrecipient obtained the required audit and that the audit was reviewed so that timely and appropriate action could be taken for any findings pertaining to the federal awards, as required by federal regulations. Additionally, for one (14.3%) of the subrecipients evaluated, the subaward documents did not contain the federal award date as required by federal regulations. Criteria: Per 2 CFR 200.332(b)(1)(iv), all pass-through entities must ensure that every subaward includes the federal award date. 2 CFR 200.332(c) requires pass through entities to evaluate each subrecipient's fraud risk and risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. 2 CFR 200.332(e)(1) requires that pass-through monitoring include reviewing financial and performance reports required by the pass-through entity. 2 CFR 200.332(e)(2) and (3) require pass-through entities to issue a management decision on applicable audit findings, in accordance with 2 CFR 200.521, within six months after acceptance of the subrecipient’s audit report by the Federal Audit Clearinghouse, and ensure that the subrecipient takes timely and appropriate corrective action on all findings. Per 2 CFR 200.332(g), pass-through entities are responsible for verifying that every subrecipient is audited as required by 2 CFR Part 200, subpart F when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in CFR 200.501 of $750,000 or more in federal awards during the subrecipient’s fiscal year. Cause: UL Lafayette did not have sufficient controls in place to adequately monitor subrecipients as required by federal regulations. Effect: Failure to properly monitor subrecipients results in noncompliance with federal regulations and increases the likelihood of improper payments which may have to be returned to the federal awarding agency. Recommendation: UL Lafayette should strengthen controls to ensure that all required financial and performance reports are obtained and reviewed and that all required subrecipient audit reports are obtained and reviewed in order to evaluate the impact of any findings noted by the audit and issue management decision letters, if applicable. In addition, UL Lafayette should strengthen controls to ensure that required information is included in the subaward documents and that risk assessments are performed and documented on all subrecipients in accordance with federal regulations. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-64).
2024-008 - Noncompliance with Subrecipient Monitoring Requirements State Entity: University of Louisiana at Lafayette (UL Lafayette) Award Years: 2019 - 2023 Award Numbers: DE-EE0009421, FA9550-21-1-0215, M19AC00015, OIA-1920858, OIA-2019511, OIA-2119688, U19AI142636 Compliance Requirement: Subrecipient Monitoring Repeat Finding: Yes (Prior Year Finding No. 2023-008) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the fourth consecutive year, UL Lafayette did not adequately monitor subrecipients of the Research and Development (R&D) Cluster Programs. In a non-statistical sample of seven subawards out of a population of 50 subawards, it was noted that for six (85.7%) of the subrecipients evaluated, UL Lafayette could not provide evidence that the financial and performance reports required by the subaward agreement were obtained and reviewed by UL Lafayette. For three (42.9%) of the subrecipients evaluated, UL Lafayette could not provide evidence that the required risk analyses were performed to evaluate each subrecipients’ fraud risk and risk of noncompliance with federal regulations and the terms of the subaward. For two of the subrecipients reviewed (28.6%), UL Lafayette was unable to provide documentation that ensured each subrecipient obtained the required audit and that the audit was reviewed so that timely and appropriate action could be taken for any findings pertaining to the federal awards, as required by federal regulations. Additionally, for one (14.3%) of the subrecipients evaluated, the subaward documents did not contain the federal award date as required by federal regulations. Criteria: Per 2 CFR 200.332(b)(1)(iv), all pass-through entities must ensure that every subaward includes the federal award date. 2 CFR 200.332(c) requires pass through entities to evaluate each subrecipient's fraud risk and risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. 2 CFR 200.332(e)(1) requires that pass-through monitoring include reviewing financial and performance reports required by the pass-through entity. 2 CFR 200.332(e)(2) and (3) require pass-through entities to issue a management decision on applicable audit findings, in accordance with 2 CFR 200.521, within six months after acceptance of the subrecipient’s audit report by the Federal Audit Clearinghouse, and ensure that the subrecipient takes timely and appropriate corrective action on all findings. Per 2 CFR 200.332(g), pass-through entities are responsible for verifying that every subrecipient is audited as required by 2 CFR Part 200, subpart F when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in CFR 200.501 of $750,000 or more in federal awards during the subrecipient’s fiscal year. Cause: UL Lafayette did not have sufficient controls in place to adequately monitor subrecipients as required by federal regulations. Effect: Failure to properly monitor subrecipients results in noncompliance with federal regulations and increases the likelihood of improper payments which may have to be returned to the federal awarding agency. Recommendation: UL Lafayette should strengthen controls to ensure that all required financial and performance reports are obtained and reviewed and that all required subrecipient audit reports are obtained and reviewed in order to evaluate the impact of any findings noted by the audit and issue management decision letters, if applicable. In addition, UL Lafayette should strengthen controls to ensure that required information is included in the subaward documents and that risk assessments are performed and documented on all subrecipients in accordance with federal regulations. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-64).
Finding No. 2024-007: Inadequate Internal Controls over Monitoring of Subrecipient Audits Type of Finding: Significant Deficiency and Non-Compliance Assistance Listing Title: Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Federal Award Number: 4155DRSDP00000001,4440DRSDP00000001, 4463DRSDP00000001, 4467DRSDP00000001, 4469DRSDP00000001, 4527DRSDP00000001, 4656DRSDP00000001, 4664DRSDP00000001, 4689DRSDP00000001, and 4718DRSDP00000001 Federal Award Year: 2019, 2020, 2021, 2022, 2023, and 2024 Federal Agency: Department of Homeland Security Category of Finding: Subrecipient Monitoring Criteria: 2 CFR section 200.332 requires, among other things, that a pass-through entity verify that subrecipients receive Single Audits as required by 2 CFR 200.501(a), follow-up to ensure that the subrecipient takes timely and appropriate action on audit findings, and issue a management decision on applicable audit findings pertaining to the subaward. 2 CFR 200.521(d) requires this management decision to be issued within six months of acceptance of the audit report by the Federal Audit Clearinghouse (FAC). Condition: The Department of Public Safety (DPS) receives funding under ALN 97.036, Disaster Grants - Public Assistance (Presidentially Declared Disasters) (Public Assistance) and makes subawards to local governments and private nonprofit entities to respond to and recover from presidentially declared disasters. During FY24, DPS did not have adequate controls in place to ensure that Single Audits were obtained for all applicable subrecipients within the required time frame, that those audits were reviewed to ensure timely and appropriate action was taken on any findings, and that a management decision was issued by DPS within the six-month time frame required by federal regulations. Based on our review of funding amounts passed through by DPS, there were seven subrecipients receiving Federal grant payments that would require a Single Audit for the auditee’s fiscal year 2023. These subrecipients had received the required audits and their audit reports were accepted by the FAC, however, two of the audits were not reviewed timely by DPS. Of those two subrecipient audits, one had an audit finding pertaining to the Public Assistance program and DPS had not issued a management decision within the time frame required by 2 CFR 200.521. Cause: Controls were not adequate to identify when subrecipient audits were due and obtain all required audits off the FAC in a timely manner. While DPS personnel did track expenditures to determine which subrecipients were required to have audits under 2 CFR 200.501(a), failure to monitor subrecipient year-ends and the related audit deadlines resulted in some audits not being obtained and reviewed in a timely manner. Effect: This resulted in noncompliance with subrecipient monitoring requirements and increased the risk of subrecipient audit findings not being corrected in a timely manner. Questioned Costs: None. Repeat Finding from Prior Year: No. Recommendation: We recommend the Department implement controls to ensure that audits of subrecipients are obtained and followed up on in a timely manner and that management decisions are issued within the required time frame for all audit findings pertaining to DPS subawards. Views of Responsible Officials: The Department of Public Safety concurs with the audit finding.
Reference Number: 2024-002 Prior Year Finding: 2023-007 Federal Agency: U.S. Department of Treasury Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: 2021 Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Controls over Compliance, Other Matters Criteria or Specific Requirement: Compliance - 2 CFR Section 200.332 – Requirements for Pass-Through Entities states in part, that all pass-through entities must: (a) Verify that every subrecipient is audited as required by Subpart F – Audit Requirements of this part when it is expected that the subrecipient’s Federal award expended during the respective fiscal year equaled or exceeded the threshold set forth in section 200.501 Audit requirements. Control - Per 2 CDF 200.303(a), a non-Federal entity must: Establish a maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statues, regulations, and the terms and conditions of the federal awards. These internal controls should comply with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The County was not able to provide documentation to show it ensured its subrecipients were audited as required by 2 CFR Part 200 Subpart F – Audit Requirements (Subpart F). Context: Exceptions were noted for 7 of 7 subrecipients selected for testing: • The County was unable to provide support that it ensured the subrecipient was audited as required by Subpart F. The County could not produce evidence of verification that the subrecipient’s Federal awards expended during the fiscal year were below the threshold set forth in section 200.501 Audit Requirements. Cause: The County did not establish effective internal controls and procedures over subrecipient monitoring. Effect: Without ensuring subrecipients have obtained audits as required by Subpart F, there is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple years, and these discrepancies may not be properly monitored, detected, and corrected by the County personnel on a timely basis. Questioned Costs: Undetermined. Recommendation: The County should review and enhance internal controls and procedures to ensure that evaluation of independent audits is performed. Views of Responsible Officials: The County agrees with this finding. See separate Correction Action Plan related to this finding.
Reference Number: 2024-002 Prior Year Finding: 2023-007 Federal Agency: U.S. Department of Treasury Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: 2021 Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Controls over Compliance, Other Matters Criteria or Specific Requirement: Compliance - 2 CFR Section 200.332 – Requirements for Pass-Through Entities states in part, that all pass-through entities must: (a) Verify that every subrecipient is audited as required by Subpart F – Audit Requirements of this part when it is expected that the subrecipient’s Federal award expended during the respective fiscal year equaled or exceeded the threshold set forth in section 200.501 Audit requirements. Control - Per 2 CDF 200.303(a), a non-Federal entity must: Establish a maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statues, regulations, and the terms and conditions of the federal awards. These internal controls should comply with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The County was not able to provide documentation to show it ensured its subrecipients were audited as required by 2 CFR Part 200 Subpart F – Audit Requirements (Subpart F). Context: Exceptions were noted for 7 of 7 subrecipients selected for testing: • The County was unable to provide support that it ensured the subrecipient was audited as required by Subpart F. The County could not produce evidence of verification that the subrecipient’s Federal awards expended during the fiscal year were below the threshold set forth in section 200.501 Audit Requirements. Cause: The County did not establish effective internal controls and procedures over subrecipient monitoring. Effect: Without ensuring subrecipients have obtained audits as required by Subpart F, there is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple years, and these discrepancies may not be properly monitored, detected, and corrected by the County personnel on a timely basis. Questioned Costs: Undetermined. Recommendation: The County should review and enhance internal controls and procedures to ensure that evaluation of independent audits is performed. Views of Responsible Officials: The County agrees with this finding. See separate Correction Action Plan related to this finding.
NONCOMPLIANCE WITH SUBRECIPIENT MONITORING REQUIREMENTS, CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS, AL No. 21.027, GRANT No. AM-23-0211 Criteria: Per the 2024 OMB compliance supplement, subrecipient monitoring is required by pass-through entities for all SLFRF funded projects. Among other activities, Treasury considers the following activities to be part of subrecipient monitoring: • Ensuring that the subrecipient has access to information about public programs relevant to the subrecipient’s duties necessary to ensure that subaward performance goals are achieved. • Ensuring that the subrecipient has access to information about projects operated by other subrecipients, necessary to ensure that subaward performance goals are achieved. • Ensuring deliverables and payment are within the approved scope of the subaward. • Responding to inquiries about the interpretation of subrecipient responsibilities under the subaward • Processing and correcting invoices. • Taking remedial action necessary to prevent the subrecipient from failing to perform its responsibilities under the subaward. Condition: The county did perform subrecipient monitoring activities over the program as required by Treasury guidelines. Cause: The county does not have policies and procedures in place that allow it to comply with subrecipient monitoring requirements outlined in the Uniform Guidance and Treasury guidelines. Effect: Non-compliance with program terms and conditions. Questioned Costs: None Recommendation: The requirements for subrecipient monitoring for the subaward are contained in 31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.332, and 200.501(h); federal awarding agency regulations; and the terms and conditions of the award. Management should develop procedures that will ensure compliance with the requirements. Views of responsible officials and planned corrective action: The government agrees with this finding and will adhere to the attached corrective action plan.
Finding 2024-014 U.S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2023-011 Condition: For 2 out of 2 selections, there is no evidence that the subrecipients were monitored during the fiscal year. For 2 out 2 selections, various information related to the funding source and the pass through entity were missing on the notice of award (E.g. FAIN number, UEI, indirect cost). Criteria: In accordance with 2 CFR §200.303: The non-federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Pursuant to 31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.330, .331, and .501(h), a pass-through entity must identify the award and applicable requirements, evaluate risk, monitor, and ensure accountability of subrecipients. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier. (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the Federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the Federal award. d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved.(f) Verify that every subrecipient is audited as required by 2 CFR § 200.331 when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Cause: MOHS did not maintain adequate documentation of the requirements included in Uniform Guidance related to procedures required for subrecipient monitoring. Effect: The City may not be in compliance with the Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend that MOHS establish and implement controls for the program and prepare and maintain a written plan to perform risk assessments on potential subrecipients. Additionally, we recommend that MOHS provides training on the Uniform Guidance requirements related to subrecipient monitoring. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.
Finding 2024-014 U.S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2023-011 Condition: For 2 out of 2 selections, there is no evidence that the subrecipients were monitored during the fiscal year. For 2 out 2 selections, various information related to the funding source and the pass through entity were missing on the notice of award (E.g. FAIN number, UEI, indirect cost). Criteria: In accordance with 2 CFR §200.303: The non-federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Pursuant to 31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.330, .331, and .501(h), a pass-through entity must identify the award and applicable requirements, evaluate risk, monitor, and ensure accountability of subrecipients. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier. (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the Federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the Federal award. d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved.(f) Verify that every subrecipient is audited as required by 2 CFR § 200.331 when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Cause: MOHS did not maintain adequate documentation of the requirements included in Uniform Guidance related to procedures required for subrecipient monitoring. Effect: The City may not be in compliance with the Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend that MOHS establish and implement controls for the program and prepare and maintain a written plan to perform risk assessments on potential subrecipients. Additionally, we recommend that MOHS provides training on the Uniform Guidance requirements related to subrecipient monitoring. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.