Findings Citing § 200.516

FINDING 2022-020 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 and Children's Health Insurance Program, ALN 93.767 - Expenditure Processing for Medical Payments See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not ensure Bridges and CHAMPS contained the correct Medicaid Cluster and CHIP eligibility information to record expenditures to the appropriate program at the time of payment and to ensure the related federal draw was accurate and timely. On a quarterly basis, MDHHS transferred expenditure amounts from the Medicaid Cluster to CHIP by completing a summary-level adjustment determined by analyzing CHAMPS payment data and Bridges eligibility data. As a result, MDHHS identified it incorrectly recorded $39.1 million of CHIP medical payments to the Medicaid Cluster throughout fiscal year 2022. However, we selected a sample of 2 beneficiaries that were transferred to CHIP and noted both beneficiaries were not eligible for CHIP but were in fact Medicaid eligible and, therefore, should not have been transferred. Criteria Federal regulation 45 CFR 75.303 requires the auditee to establish and maintain effective internal control over federal programs that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Federal regulation 31 CFR 205 requires state recipients to enter into agreements with the U.S. Department of the Treasury that prescribe specific methods of drawing down federal funds for selected large programs. Cause MDHHS implemented a system change to correct eligibility classifications in Bridges in April 2021. All new cases are being correctly routed. MDHHS expects all existing cases will be updated during the 14-month period following the May 11, 2023 end of the public health emergency, as allowed by the Centers for Medicare and Medicaid Services (CMS). The Medicaid Cluster to CHIP transfer was completed correctly; however, because of an incorrect eligibility determination reflected in Bridges, some cases were transferred in error. Effect MDHHS inappropriately transferred $294 Medicaid Cluster expenditures to CHIP. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Also, of the $39.1 million in quarterly transfers, MDHHS may have improperly received either federal Medicaid Cluster funds or federal CHIP funds depending on the accuracy of the transferred amount. After MDHHS recorded the quarterly summary-level adjustments in the accounting system, it returned the Medicaid Cluster funds to the federal government and appropriately received reimbursement from CHIP. The quarterly CHIP draws were not compliant with the State's Cash Management Improvement Act (CMIA) agreement, which required weekly actual costs draws. For the CHIP compliance requirements noted, we consider this to be a material weakness and material noncompliance because the $39.1 million CHIP expenditures identified by MDHHS as inappropriately charged to and reimbursed by the Medicaid Cluster represented 14% of total CHIP expenditures and both sample items were inappropriately transferred to CHIP. Known Questioned Costs Federal regulation 2 CFR 200.516(a)(3) requires the auditor to report known questioned costs that are less than $25,000 if it is likely total questioned costs would exceed $25,000. ? $235 - federal share of CHIP payments made to providers for ineligible CHIP beneficiaries, of which $235 is questioned in Finding 2022-019. ? $58 - State share of costs MDHHS inappropriately used as matching. Recommendation We recommend MDHHS ensure Bridges and CHAMPS contain the correct Medicaid Cluster and CHIP eligibility information to allow MDHHS to record expenditures to the appropriate program at the time of payment and to ensure the related federal draw is accurate and timely. Management Views MDHHS agrees with the finding.

This section identifies audit findings required to be reported by 2 CFR 200.516(a), including significant deficiencies, material weaknesses, and material instances of noncompliance, including questioned costs, and significant instances of abuse. 2022-001: Submission of Single Audit Reports ? Material Weakness (Repeat Comment 2021-001) Federal Agency: U.S. Department of Health and Human Services, U.S. Department of Housing and Urban Development Program Title: Medical Assistance Program, HOME Investment Partnership Programs, Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution, Section 223 Demonstration Programs to Improve Community Mental Health Services, Block Grants for Community Mental Health Services, Block Grants for Prevention and Treatment of Substance Abuse ALN: 93.778, 14.239, 93.498, 93.829, 93.958, 93.959 Federal Award Source: Pass-through funding and direct funding Pass-Through Entities: AHCCCS (ALN 93.778), Health Resources & Services Administration (ALN 93.498), Substance Abuse & Mental Health Services Administration (ALN 93.829), Arizona Complete Health (ALN?s 93.958 and 93.959) Pass-Through Identifying Number: Various, see schedule of expenditures of federal awards Criteria ? Section 200.512 of the Uniform Guidance states that the Single Audit shall be completed and the data collection form and reporting package shall be submitted within the earlier of 30 calendar days after receipt of the auditor?s report, or nine months after the end of the audit period, unless a longer period is agreed to in advance by the cognizant or oversight agency for audit. Condition and Context - The Organization did not complete and submit its single audits prior to fiscal year 2021 by the required deadline. Cause and Effect - Due to a delay in the preparation of the schedule of expenditures of federal awards and the compiling of records and supporting documentation related to the compliance audit, the Company was not in compliance with the OMB Compliance Supplement reporting requirements. Questioned Costs - None identified. Recommendation ? We recommend that the Organization complete its annual Single Audit and submit the related data collection form and reporting package to the federal clearinghouse by the required deadline. View of Responsible Officials - Management acknowledges the lack of completion and filing of the Single Audit reports prior to fiscal year 2021. This is attributable to a change in ownership of the Organization. All future reports will be filed prior to the deadline in a timely manner through adequate planning and appropriate staffing.

This section identifies audit findings required to be reported by 2 CFR 200.516(a), including significant deficiencies, material weaknesses, and material instances of noncompliance, including questioned costs, and significant instances of abuse. 2022-001: Submission of Single Audit Reports ? Material Weakness (Repeat Comment 2021-001) Federal Agency: U.S. Department of Health and Human Services, U.S. Department of Housing and Urban Development Program Title: Medical Assistance Program, HOME Investment Partnership Programs, Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution, Section 223 Demonstration Programs to Improve Community Mental Health Services, Block Grants for Community Mental Health Services, Block Grants for Prevention and Treatment of Substance Abuse ALN: 93.778, 14.239, 93.498, 93.829, 93.958, 93.959 Federal Award Source: Pass-through funding and direct funding Pass-Through Entities: AHCCCS (ALN 93.778), Health Resources & Services Administration (ALN 93.498), Substance Abuse & Mental Health Services Administration (ALN 93.829), Arizona Complete Health (ALN?s 93.958 and 93.959) Pass-Through Identifying Number: Various, see schedule of expenditures of federal awards Criteria ? Section 200.512 of the Uniform Guidance states that the Single Audit shall be completed and the data collection form and reporting package shall be submitted within the earlier of 30 calendar days after receipt of the auditor?s report, or nine months after the end of the audit period, unless a longer period is agreed to in advance by the cognizant or oversight agency for audit. Condition and Context - The Organization did not complete and submit its single audits prior to fiscal year 2021 by the required deadline. Cause and Effect - Due to a delay in the preparation of the schedule of expenditures of federal awards and the compiling of records and supporting documentation related to the compliance audit, the Company was not in compliance with the OMB Compliance Supplement reporting requirements. Questioned Costs - None identified. Recommendation ? We recommend that the Organization complete its annual Single Audit and submit the related data collection form and reporting package to the federal clearinghouse by the required deadline. View of Responsible Officials - Management acknowledges the lack of completion and filing of the Single Audit reports prior to fiscal year 2021. This is attributable to a change in ownership of the Organization. All future reports will be filed prior to the deadline in a timely manner through adequate planning and appropriate staffing.

This section identifies audit findings required to be reported by 2 CFR 200.516(a), including significant deficiencies, material weaknesses, and material instances of noncompliance, including questioned costs, and significant instances of abuse. 2022-001: Submission of Single Audit Reports ? Material Weakness (Repeat Comment 2021-001) Federal Agency: U.S. Department of Health and Human Services, U.S. Department of Housing and Urban Development Program Title: Medical Assistance Program, HOME Investment Partnership Programs, Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution, Section 223 Demonstration Programs to Improve Community Mental Health Services, Block Grants for Community Mental Health Services, Block Grants for Prevention and Treatment of Substance Abuse ALN: 93.778, 14.239, 93.498, 93.829, 93.958, 93.959 Federal Award Source: Pass-through funding and direct funding Pass-Through Entities: AHCCCS (ALN 93.778), Health Resources & Services Administration (ALN 93.498), Substance Abuse & Mental Health Services Administration (ALN 93.829), Arizona Complete Health (ALN?s 93.958 and 93.959) Pass-Through Identifying Number: Various, see schedule of expenditures of federal awards Criteria ? Section 200.512 of the Uniform Guidance states that the Single Audit shall be completed and the data collection form and reporting package shall be submitted within the earlier of 30 calendar days after receipt of the auditor?s report, or nine months after the end of the audit period, unless a longer period is agreed to in advance by the cognizant or oversight agency for audit. Condition and Context - The Organization did not complete and submit its single audits prior to fiscal year 2021 by the required deadline. Cause and Effect - Due to a delay in the preparation of the schedule of expenditures of federal awards and the compiling of records and supporting documentation related to the compliance audit, the Company was not in compliance with the OMB Compliance Supplement reporting requirements. Questioned Costs - None identified. Recommendation ? We recommend that the Organization complete its annual Single Audit and submit the related data collection form and reporting package to the federal clearinghouse by the required deadline. View of Responsible Officials - Management acknowledges the lack of completion and filing of the Single Audit reports prior to fiscal year 2021. This is attributable to a change in ownership of the Organization. All future reports will be filed prior to the deadline in a timely manner through adequate planning and appropriate staffing.

This section identifies audit findings required to be reported by 2 CFR 200.516(a), including significant deficiencies, material weaknesses, and material instances of noncompliance, including questioned costs, and significant instances of abuse. 2022-001: Submission of Single Audit Reports ? Material Weakness (Repeat Comment 2021-001) Federal Agency: U.S. Department of Health and Human Services, U.S. Department of Housing and Urban Development Program Title: Medical Assistance Program, HOME Investment Partnership Programs, Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution, Section 223 Demonstration Programs to Improve Community Mental Health Services, Block Grants for Community Mental Health Services, Block Grants for Prevention and Treatment of Substance Abuse ALN: 93.778, 14.239, 93.498, 93.829, 93.958, 93.959 Federal Award Source: Pass-through funding and direct funding Pass-Through Entities: AHCCCS (ALN 93.778), Health Resources & Services Administration (ALN 93.498), Substance Abuse & Mental Health Services Administration (ALN 93.829), Arizona Complete Health (ALN?s 93.958 and 93.959) Pass-Through Identifying Number: Various, see schedule of expenditures of federal awards Criteria ? Section 200.512 of the Uniform Guidance states that the Single Audit shall be completed and the data collection form and reporting package shall be submitted within the earlier of 30 calendar days after receipt of the auditor?s report, or nine months after the end of the audit period, unless a longer period is agreed to in advance by the cognizant or oversight agency for audit. Condition and Context - The Organization did not complete and submit its single audits prior to fiscal year 2021 by the required deadline. Cause and Effect - Due to a delay in the preparation of the schedule of expenditures of federal awards and the compiling of records and supporting documentation related to the compliance audit, the Company was not in compliance with the OMB Compliance Supplement reporting requirements. Questioned Costs - None identified. Recommendation ? We recommend that the Organization complete its annual Single Audit and submit the related data collection form and reporting package to the federal clearinghouse by the required deadline. View of Responsible Officials - Management acknowledges the lack of completion and filing of the Single Audit reports prior to fiscal year 2021. This is attributable to a change in ownership of the Organization. All future reports will be filed prior to the deadline in a timely manner through adequate planning and appropriate staffing.

This section identifies audit findings required to be reported by 2 CFR 200.516(a), including significant deficiencies, material weaknesses, and material instances of noncompliance, including questioned costs, and significant instances of abuse. 2022-001: Submission of Single Audit Reports ? Material Weakness (Repeat Comment 2021-001) Federal Agency: U.S. Department of Health and Human Services, U.S. Department of Housing and Urban Development Program Title: Medical Assistance Program, HOME Investment Partnership Programs, Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution, Section 223 Demonstration Programs to Improve Community Mental Health Services, Block Grants for Community Mental Health Services, Block Grants for Prevention and Treatment of Substance Abuse ALN: 93.778, 14.239, 93.498, 93.829, 93.958, 93.959 Federal Award Source: Pass-through funding and direct funding Pass-Through Entities: AHCCCS (ALN 93.778), Health Resources & Services Administration (ALN 93.498), Substance Abuse & Mental Health Services Administration (ALN 93.829), Arizona Complete Health (ALN?s 93.958 and 93.959) Pass-Through Identifying Number: Various, see schedule of expenditures of federal awards Criteria ? Section 200.512 of the Uniform Guidance states that the Single Audit shall be completed and the data collection form and reporting package shall be submitted within the earlier of 30 calendar days after receipt of the auditor?s report, or nine months after the end of the audit period, unless a longer period is agreed to in advance by the cognizant or oversight agency for audit. Condition and Context - The Organization did not complete and submit its single audits prior to fiscal year 2021 by the required deadline. Cause and Effect - Due to a delay in the preparation of the schedule of expenditures of federal awards and the compiling of records and supporting documentation related to the compliance audit, the Company was not in compliance with the OMB Compliance Supplement reporting requirements. Questioned Costs - None identified. Recommendation ? We recommend that the Organization complete its annual Single Audit and submit the related data collection form and reporting package to the federal clearinghouse by the required deadline. View of Responsible Officials - Management acknowledges the lack of completion and filing of the Single Audit reports prior to fiscal year 2021. This is attributable to a change in ownership of the Organization. All future reports will be filed prior to the deadline in a timely manner through adequate planning and appropriate staffing.

This section identifies audit findings required to be reported by 2 CFR 200.516(a), including significant deficiencies, material weaknesses, and material instances of noncompliance, including questioned costs, and significant instances of abuse. 2022-001: Submission of Single Audit Reports ? Material Weakness (Repeat Comment 2021-001) Federal Agency: U.S. Department of Health and Human Services, U.S. Department of Housing and Urban Development Program Title: Medical Assistance Program, HOME Investment Partnership Programs, Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution, Section 223 Demonstration Programs to Improve Community Mental Health Services, Block Grants for Community Mental Health Services, Block Grants for Prevention and Treatment of Substance Abuse ALN: 93.778, 14.239, 93.498, 93.829, 93.958, 93.959 Federal Award Source: Pass-through funding and direct funding Pass-Through Entities: AHCCCS (ALN 93.778), Health Resources & Services Administration (ALN 93.498), Substance Abuse & Mental Health Services Administration (ALN 93.829), Arizona Complete Health (ALN?s 93.958 and 93.959) Pass-Through Identifying Number: Various, see schedule of expenditures of federal awards Criteria ? Section 200.512 of the Uniform Guidance states that the Single Audit shall be completed and the data collection form and reporting package shall be submitted within the earlier of 30 calendar days after receipt of the auditor?s report, or nine months after the end of the audit period, unless a longer period is agreed to in advance by the cognizant or oversight agency for audit. Condition and Context - The Organization did not complete and submit its single audits prior to fiscal year 2021 by the required deadline. Cause and Effect - Due to a delay in the preparation of the schedule of expenditures of federal awards and the compiling of records and supporting documentation related to the compliance audit, the Company was not in compliance with the OMB Compliance Supplement reporting requirements. Questioned Costs - None identified. Recommendation ? We recommend that the Organization complete its annual Single Audit and submit the related data collection form and reporting package to the federal clearinghouse by the required deadline. View of Responsible Officials - Management acknowledges the lack of completion and filing of the Single Audit reports prior to fiscal year 2021. This is attributable to a change in ownership of the Organization. All future reports will be filed prior to the deadline in a timely manner through adequate planning and appropriate staffing.

This section identifies audit findings required to be reported by 2 CFR 200.516(a), including significant deficiencies, material weaknesses, and material instances of noncompliance, including questioned costs, and significant instances of abuse. 2022-001: Submission of Single Audit Reports ? Material Weakness (Repeat Comment 2021-001) Federal Agency: U.S. Department of Health and Human Services, U.S. Department of Housing and Urban Development Program Title: Medical Assistance Program, HOME Investment Partnership Programs, Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution, Section 223 Demonstration Programs to Improve Community Mental Health Services, Block Grants for Community Mental Health Services, Block Grants for Prevention and Treatment of Substance Abuse ALN: 93.778, 14.239, 93.498, 93.829, 93.958, 93.959 Federal Award Source: Pass-through funding and direct funding Pass-Through Entities: AHCCCS (ALN 93.778), Health Resources & Services Administration (ALN 93.498), Substance Abuse & Mental Health Services Administration (ALN 93.829), Arizona Complete Health (ALN?s 93.958 and 93.959) Pass-Through Identifying Number: Various, see schedule of expenditures of federal awards Criteria ? Section 200.512 of the Uniform Guidance states that the Single Audit shall be completed and the data collection form and reporting package shall be submitted within the earlier of 30 calendar days after receipt of the auditor?s report, or nine months after the end of the audit period, unless a longer period is agreed to in advance by the cognizant or oversight agency for audit. Condition and Context - The Organization did not complete and submit its single audits prior to fiscal year 2021 by the required deadline. Cause and Effect - Due to a delay in the preparation of the schedule of expenditures of federal awards and the compiling of records and supporting documentation related to the compliance audit, the Company was not in compliance with the OMB Compliance Supplement reporting requirements. Questioned Costs - None identified. Recommendation ? We recommend that the Organization complete its annual Single Audit and submit the related data collection form and reporting package to the federal clearinghouse by the required deadline. View of Responsible Officials - Management acknowledges the lack of completion and filing of the Single Audit reports prior to fiscal year 2021. This is attributable to a change in ownership of the Organization. All future reports will be filed prior to the deadline in a timely manner through adequate planning and appropriate staffing.

Item 2022-01 ? Late Submissions for Reporting Requirements and Fiscal Year Reporting Audit findings under 2 CFR section 200.516(a). Criteria: In accordance with terms of the federal award granted for the major program, Faith Community United Credit Union, Inc. (?the Credit Union?) must submit the annual report components in accordance with the Credit Union?s fiscal year. Condition: During our procedures performed over compliance with reporting requirements (as stipulated under Schedule 1, Section A of the CDFI Fund Assistance Agreement for the major program), we noted that the Credit Union?s annual report components were based on a fiscal year ending December 31, 2021. Inquiry with management and inspection of the prior period audit reports identified that the Credit Union?s fiscal year is September 30. As a result, the report due dates for the annual report components were improperly identified. This resulted in the annual report components that were submitted late to document the incorrect fiscal year end date. This also resulted in the submissions for the Financial Statements, TLR, Performance Progress Report, and Uses of Award Report for fiscal year 2021 to incorrectly include information for October through December 2021. This financial information should have been included in the fiscal year 2022 reporting. Cause: The Credit Union did not maintain adequate internal controls to ensure the Credit Union?s fiscal year end was appropriately reported, and by extension, that the annual report submissions were completed within the correct due dates for the proper reporting timeframe. Recommendation: We recommend that management properly reflect the annual reporting components using its September 30 fiscal year end. We also recommend that management contact their CDFI representative to identify what correcting steps be completed, if any, for the year ended September 30, 2021 reporting components.

COVID-19 Coronavirus Relief Fund (21.019) Agency: Department of Treasury Federal Award Number/Year: 2020 Program & ALN: COVID-19 Coronavirus Relief Fund - 21.019 Pass-through Entities: Virginia Department of Accounts Compliance Requirement: Reporting Finding Type: Finding reported in accordance with 2 CFR section 200.516(a) and material weakness of internal controls surrounding reporting requirements. Criteria: Per single audit requirements, prime recipients (i.e. the Commonwealth of Virginia) are required to submit quarterly Financial Progress reports. To assist with the reporting requirement, the Commonwealth required quarterly reports from its subrecipients (the County). Condition: The County did not file a required quarterly report for the quarter ended September 30, 2021. Cause: The County did not have a proper reporting and review process of federal grants and failed to submit the required report. Effect: The amounts reported by the County to the Commonwealth are understated resulting in an error in reporting by the Commonwealth to the federal government. Recommendation: Management should establish a reconciliation process and reports should be reviewed by someone other than the preparer prior to submission to ensure accuracy of reporting. Views of Responsible Officials and Planned Corrective Action: The County concurs with the finding. The County corrected activity with the final reporting filed for the period ended December 31, 2021.

A. Summary of Auditor's Results 1. The auditor's report expresses a unmodified opinion on whether the financial statements of Geneva Avenue Elderly Housing, Inc. were prepared in accordance with generally accepted accounting principles. 2. No significant deficiencies related to the audit of the financial statements were reported in the Independent Auditor's Report on Internal Control over Financial Reporting and on Compliance and Other Matters Based on an Audit of Financial Statements Performed in Accordance with Government Auditing Standards. No material weaknesses were reported. 3. One instance of noncompliance material to the financial statements of Geneva Avenue Elderly Housing, Inc., which would be required to be reported in accordance with Government Auditing Standards, was disclosed during the audit. 4. One significant deficiency in internal control over major federal award programs was disclosed during the audit and reported in the Independent Auditor's Report on Compliance for the Major Federal Program and on Internal Control over Compliance Required by the Uniform Guidance. No material weaknesses were reported. 5. The auditor's report on compliance for the major federal award programs for Geneva Avenue Elderly Housing, Inc. expresses a qualified opinion on all major federal programs. 6. There is one audit finding required to be reported in accordance with 2 CFR Section 200.516(a) in this Schedule. 7. The programs tested as major programs included: CFDA Number Name of Federal Program 14.157 HUD Section 202 (Capital Advance) 8. The threshold for distinguishing between Type A and B programs was $750,000. 9. Geneva Avenue Elderly Housing, Inc. was determined to be a low risk auditee. B. Financial Statement Findings None reported C. Federal Award Findings and Questioned Costs Department of Housing and Urban Development Finding No. 2022-001; Assistance Listing No. 14.157 Support Housing for the Elderly (Section 202) Criteria Tenant lease files are required to be maintained and tenant eligibility determined in accordance with HUD Handbook 4571.3, Section 202 Supportive Housing for the Elderly. Condition In connection with our lease file testing, we noted that six tenant files out of the six tenant files tested did not have the EIV completed timely for the most recent annual recertification. Cause There was an administrative error involving personnel involved in the annual recertification process resulting in the EIV reports not being run in accordance with the HUD program guidelines. Effect or Potential Effect The Corporation is not in compliance with HUD Program guidelines. Recommendation The Corporation should ensure that EIV reports are run timely in connection with the annual recertification in accordance with the HUD Program guidelines, and it should monitor its compliance with those policies and procedures. Auditor Noncompliance Code: R - Section 8 program administration Reporting Views of Responsible Officials: Management concurs with the finding. Management has communicated with the staff the importance of completing EIV reports in accordance with HUD Program guidelines, and on a go forward basis will enhance its monitoring of compliance with this requirement to ensure that EIV's are run within an appropriate time frame.

THIS FINDING IS: New FINDING TYPE: Internal Control DEFICIENCY TYPE: Significant Deficiency Federal Program Name and Year: Education Stabilization Fund - 2022 Project No.: 20-4998-ER AL No.: 84.425D Passed Through: Illinois State Board of Education Federal Agency: U.S. Department of Education Criteria or specific requirement (including statutory, regulatory, or other citation): The District is required to report grant expenditures in accordance with the Illinois State Board of Education State and Federal Grant Administration Policy and Fiscal Requirements and Procedures and the ISBE Illinois Program Account Manual, which is consistent with the provisions of the Uniform Guidance. According to Uniform Guidance, Title 2 CFR 200.516, the District is required to maintain internal control over Federal programs that provide reasonable assurance that the Auditee is managing Federal awards in compliance with laws, regulations, and provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Under Uniform Guidance, Title 2 CFR 200.501, a non-Federal entity that expends $750,000 or more during the entity's fiscal year in Federal awards must have a single audit conducted for that year. Condition: The District overstated expenditures on the ESSER I June 30, 2021 expenditure report. Questioned Costs: The ESSER I 2020 project year's June 30, 2021 expenditure report included $10,678 of questioned costs. Purchased Services were overstated by $2,300, Supplies and Materials were overstated by $6,035, and Capital Outlay was overstated by $2,343 when compared to the accounting records. Context: The ESSER I 2020 project year's June 30, 2021 expenditure report included $10,678 of questioned costs. Purchased Services were overstated by $2,300, Supplies and Materials were overstated by $6,035, and Capital Outlay was overstated by $2,343 when compared to the accounting records. Effect: Expenditures reported on the final project expenditure report were overstated by $10,678. Excluding the $10,678 of overstated expenditures from the calculation of over all expenditures of federal awards resulted in the district expending less than $750,000 of federal awards during the year ended June 30, 2021 and thereby not being subject to the Uniform Guidance/Single Audit provisions. Cause: ESSER I 2020 project year's final expenditures were reported in error. Recommendation: Grant expenditures should be reviewed and reconciled back to the accounting records prior to submitting final reports; ISBE grants division should be contacted regarding this discrepancy. Management's response: The District agrees that the expenditures claimed on the June 30, 2021 expenditure report was overstated by $10,678 and in the future will review and reconcile the expenditure reports to the accounting records before submitting to ISBE.

2022-028 The University of Washington did not establish adequate internal controls to ensure payments to contractors and subrecipients for the Global AIDS program were allowable, properly supported and within the period of performance. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. To achieve the performance goals of the program, the Seattle headquarters of I-TECH (Seattle HQ) provides funding to subrecipients and contractors. Invoices submitted by contractors directly to Seattle HQ are reviewed and approved for payment by budget managers who have delegated authority from the Principal Investigator. Invoices submitted by subrecipients are reviewed and approved for payment by a Principal Investigator. Principal Investigators are also responsible for monitoring the subrecipient?s technical progress and performance. Seattle HQ also provides funding to country offices operating within the University?s global network. The country offices incur costs associated with furnishing supplies and equipment to address the HIV/AIDS epidemic, as well as staffing resources and acquiring goods and services from contractors to carry out the objectives of the program. Payments made by country offices are approved by Country Directors and Country Representatives as delegated by the University. Under the University?s policies, country offices are reimbursed for locally incurred expenses at least monthly. An invoice, accompanied by a schedule of expenses incurred, is submitted and approved by the Country Director and then by the Director of Finance at Seattle HQ, prior to payment. Country offices also responsible for obtaining and retaining supporting documentation for costs incurred and paid on each project. Monthly, Budget Managers review and approve a Budget Activity Report (BAR) that details the expenses charged to the project for the previous month to ensure accurate posting of already approved expenses. This review is also to determine whether the work performed during the billing period reconciles to costs claimed within the contractor?s invoice so that payment may be authorized. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls to ensure payments to contractors and subrecipients of the Global AIDS program were allowable properly supported and within the period of performance. Payments to country offices We used a statistical sampling method to randomly select and examine 58 out of 1,644 transactions for country offices. Of the 58 payments examined, we identified one payment (1.7 percent) that was not approved by the Country Director and the corresponding Budget Activity Report was not approved by the Director of Finance. Payments to contractors We used a statistical sampling method to randomly select and review 58 out of 3,040 payments to contractors. We found: ? Invoices for three payments (5 percent) were not approved by a Budget Manager ? Monthly Budget Activity Reports were not approved for 12 payments (20 percent) Subrecipient reimbursements We used a statistical sampling method to randomly select and review 55 out of 438 payments to subrecipients. We found the assigned Budget Manager did not review and approve the monthly Budget Activity Reports for 52 payments (94 percent). We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Program management did not require supporting documentation for each payment to be forwarded to and reviewed by headquarters personnel prior to payment authorization. Management also did not monitor the submission of invoices and Budget Activity Reports to ensure they were approved by the responsible Budget Manager, as required. Effect of Condition Without establishing adequate internal controls, the University cannot reasonably ensure it is using federal funds for allowable purposes and that expenditures of federal funds are supported by adequate documentation. Recommendations We recommend the University: ? Improve its internal controls to ensure invoices are properly approved by Principal Investigators, as required ? Improve its internal controls to ensure Budget Mangers review and approve monthly Budget Activity Reports before authorizing payments for projects incurring reimbursement requests ? Ensure it retains supporting documentation sufficient to show costs incurred and paid by the program are allowable, and to demonstrate the required managerial reviews have occurred prior to issuing payment University?s Response In response to the findings for the Global Aids Program, we would like to clarify the following: General Clarification: The draft finding inaccurately represents the role of BARS approvals as part of the internal controls to ensure payments to country offices, contractors and subrecipients are allowable, properly supported and within the period of performance. This is not the role of the BARS review process. Compliance, Budget Manager and PI reviews are the controls that ensure allowability of payments and BARS approvals are after-the-fact validations of accurate posting of already approved expenditures. We provided edits to the Background section to reflect our process. We request in light of this that the description of condition, cause of condition and recommendation sections of this finding be updated accordingly. Payments to country offices I-TECH country offices are not contractors; the offices are an extension of the University of Washington. Your review identified one of fifty-eight samples (1.7%) did not meet the approval requirements set forth in I-TECH?s standard operating procedure. Based on the error percentage, we disagree with this finding. Payments to contractors Payments to contractors have multiple approvals. Upon receipt, individual invoices are approved by the program/budget manager either by signature or email. Invoices are then sent to the I-TECH Accounts Payable Administrator for input to the University?s procurement system, ARIBA, which requires compliance approval from the Accounts Payable Supervisor or other manager, as well as funding approval from the budget manager prior to payment. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to contractors, they are reviews of the monthly expenses posted to the budget and the program manager?s concurrence that the expenses are as expected. The exceptions noted were payments made to country offices instead of contractors. The support for approvals were provided to the State Auditors on April 26, 2023, prior to the completion of fieldwork. We therefore disagree with this finding. We also request that the finding be adjusted to omit the 20% of missing BARS approvals as this is not related to the contractor payments. Subrecipient reimbursements Each subrecipient invoice is reviewed for reasonableness, allowability and allocability by the contracts manager and approved by both budget managers and principal investigators prior to being processed for payment in ARIBA. PI approvals were provided and verified for each subrecipient selection with no omissions noted by the auditors. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to subrecipients, they are after-the-fact reviews of the monthly expenses posted to the budget, intended as documentation of the program manager?s concurrence that the expenses are posted as expected. We acknowledge the instances detailed in the finding where we were unable to produce related BARS approvals for 52 of the transactions; however, we request that the finding be adjusted as these BARS approvals are not related to subrecipient invoice review and approvals. Our record keeping process for BARS approvals was to save the emails in a folder within our Finance Team mailbox. We learned during this review that emails beyond a certain date are deleted but maintained in the MS360 file. We?ve searched for the missing BARS approvals but have not yet been able to locate them. We have since begun saving the approvals to our server to ensure we have access to the data going forward. Auditor?s Remarks The University?s I-TECH Global Operations Manual stipulates that BARs will be generated, reviewed and approved monthly by the Budget Manager and management team. This information was provided to our Office as part of the University?s overall design of internal controls over payments to contractors, subrecipients and country offices. The University responded to our Office on April 20, 2023 adding that ?BAR review is the University?s key post payment control designed to ensure charges are accurately processed, coded and allowable on the budget charged.? We interpret this response to indicate the BAR review process is a monitoring control, and the University asserted on multiple occasions this is a key internal control, which is why we tested it. On January 5, our Office notified University management in writing that the BAR review process would be tested as a key control over the cost principles and period of performance requirements for Global AIDS expenditures. We received no additional inquiry or concerns from University management regarding this internal control until the draft finding was issued on April 14. We provided the University with a final written summary of our fieldwork in this area on April 6, 2023, after fieldwork had concluded. On April 7, the Finance Director responded to our Office in writing confirming they had no further questions or concerns regarding our testing results. It was not until after the University received this finding that additional documentation supporting expenditures tested during the audit were ultimately given to our Office. The basis for this audit finding is the key internal control failure rate of BAR approvals that exceeds our established materiality threshold of five percent, and constitutes a material weakness in internal control, which under the Uniform Guidance is required to be reported as an audit finding in accordance with 2 CFR 200.516 ? Audit findings. We reaffirm our finding and will follow up on the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 02 ? Acceptance of Sponsored Program Awards and Fiscal Compliance on Sponsored Program Accounts (Budget Numbers), states in part: Responsibilities Principal Investigator ? Supervises expenditure of sponsored program funds and approves sub-recipient invoices (see GIM 8) to assure: o That funds are used only for purposes that directly relate to and benefit the activity supported in the award. o That expenditures are consistent with all special terms, conditions, or limitations that apply to expenditures under the particular grant or contract. o That expenditures do not exceed the total funds authorized for a given period under the grant or contract. GIM 07 ? Sponsored Program Subaward Administration, states in part: Principal Investigator ? Review and approve subaward invoices. GIM 08 ? Subrecipient Monitoring, states in part: Roles & Responsibilities PI / Department Responsibilities Project level monitoring of subrecipient including: o Reviews that expenses are necessary, reasonable, and allocable to the work completed and are aligned with technical progress. o Approve invoices for payment. Subrecipient Monitoring ? Project Level Subrecipient invoices are reviewed and approved in accordance with the requirements of GIM 2 in the manner and frequency stated in the subaward. The University of Washington I-TECH Global Operations Manual (GRef 2.3), Section 2, Finance, Accounting Policy and Procedure Requirements, states in part: In addition to the Fiscal Guidelines set forth in the I-TECH Field Operations Manual, these country specific policies are implemented at I-TECH. 10. Budget Management and Reporting f. Reports that show the variance between the budget plan and the activity for each region and activity code will be generated, reviewed and approved by the budget managers and the Management Team each month.

2022-030 The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. Federal regulations require the University to monitor its subrecipients? activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single or program-specific audit. For the Global AIDS program, the Centers for Disease Control and Prevention requires foreign subrecipients to submit their audits directly to the federal government and pass-through entity within 30 days after receiving the auditor?s report or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes onto its subrecipients, the University must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a University-funded program, federal law requires the University to issue a management decision to the subrecipient within six months of the audit report?s acceptance by the federal government. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it appropriately followed up on findings and issued management decisions. We found the University did not have adequate internal controls in place to verify whether: ? Subrecipients received required audits, if necessary, and appropriate remedies were taken if audits were not filed ? Management decisions were required to be issued for subrecipients who required a single or program-specific audit We used a nonstatistical sampling method to randomly select and examine seven out of a total population of 21 subrecipients. We found the University did not adequately monitor one subrecipient (14 percent) to ensure it received a required single or program-specific audit. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Staff in the University?s Office of Sponsored Programs (OSP) used a spreadsheet to track subrecipient certifications and responses, and reviewed annual certifications from the subrecipient to monitor its audit status. However, OSP did not correctly interpret the subrecipient?s response and, therefore, did not require it to provide documentation of a single or program-specific audit. Additionally, management did not review the subrecipient?s federal assistance expenditures to detect that it required an audit and, therefore, also failed to adequately follow up to ensure any reported findings were resolved with appropriate corrective action, if required. Effect of Condition Without establishing adequate internal controls, the University cannot ensure all subrecipients that required a single or program-specific audit received one. Furthermore, the University cannot ensure it is following up on subrecipient audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitors them for effectiveness where required, the University cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the University: ? Follow policies and procedures to ensure subrecipients receive required single or program-specific audits ? Establish and follow effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations ? Follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations ? Issue a written management decision for all applicable audit findings, if necessary University?s Response The University of Washington has established internal controls to carry out a risk assessment per Uniform Guidance, 2 CFR ? 200.332, Requirements for pass-through entities, and our UW Grants Information Memorandum (GIM) 8. This involves using various factors to assess risk. Part of our process to obtain the information needed from each subrecipient is through a certification process. The certification was obtained from the subrecipient, along with additional documentation from the subrecipient, such as an audited financial statement. We made a risk assessment using our standard risk criteria. We did misinterpret the response provided from the subrecipient regarding whether it expended $750,000 or more in federal awards during a fiscal year in order to obtain a single or program-specific audit from this subrecipient. While this was not obtained and reviewed, a risk assessment using our standard criteria was performed with the subrecipient rated as a medium risk, and subject to monitoring throughout the project, per GIM 8. The monitoring at the program level occurred during the period in question. We will be improving our required communications with subrecipients to have clear questions and responses regarding whether the subrecipient expended $750,000 or more in federal awards during the fiscal year in order to obtain a single or program-specific audit, follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations, and issue a written management decision for all applicable audit findings, if necessary. Auditor?s Remarks We thank the University for its cooperation and assistance during the audit. Whether the University performed a risk assessment for the subrecipient is not being questioned. The University did not adequately monitor the subrecipient to ensure it detected whether the subrecipient was required to receive a single audit, or program-specific audit in accordance with 2 CFR ?200.332(f). There is no other mechanism for the Federal government to monitor subrecipients of the University and, because a single audit of the subrecipient was not performed, neither the federal grantor nor the University had reasonable assurance of the subrecipient?s compliance with federal award requirements. We reaffirm our finding and will follow up on the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, establishes the following applicable requirements: Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient?s cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set for the in ?200.501 Audit requirements. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c). The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 8 ? Subrecipient Monitoring, states in part: Background Additionally, per the Federal Uniform Guidance, UW must evaluate each subrecipients? risk of noncompliance with federal regulations, include specific terms and conditions in the subaward as necessary, and monitor the activities of the subrecipient through various mechanisms. These mechanisms include: Training and technical assistance to subrecipients, on-site reviews, review of audit results, increased reporting requirements and enforcement action, if necessary. University Policy UW reviews each subrecipient entity according to an entity level comprehensive risk assessment prior to the issuance of a subaward. This risk assessment includes an entity level review of their fiscal systems, past audit activity, and if required, financial statements of the entity as well as the project specific activity proposed and that the required compliance approvals are obtained. When necessary, UW imposes limitations and requirements on the subrecipient through subaward terms and conditions per Federal Uniform Guidance, Section 200.521, prior to the issuance or renewal of a subaward. UW?s subrecipient monitoring requirements are comprised, at a minimum, of the following: ? Completion of the UW?s entity level comprehensive risk assessment (Certs & Reps, Annual Audit Certification) Subrecipient Monitoring ? Entity Level Entity level monitoring consists of a combination of the following: ? Initial Subrecipient Certification Form completion and assurance by subrecipient?s authorized official ? Annual audit assurance through an annual audit certification form ? Maintenance of a subrecipient profile list, which includes information on the entity?s past audit information and certifications ? Risk assessment carried out at each annual renewal of a subaward

2022-028 The University of Washington did not establish adequate internal controls to ensure payments to contractors and subrecipients for the Global AIDS program were allowable, properly supported and within the period of performance. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. To achieve the performance goals of the program, the Seattle headquarters of I-TECH (Seattle HQ) provides funding to subrecipients and contractors. Invoices submitted by contractors directly to Seattle HQ are reviewed and approved for payment by budget managers who have delegated authority from the Principal Investigator. Invoices submitted by subrecipients are reviewed and approved for payment by a Principal Investigator. Principal Investigators are also responsible for monitoring the subrecipient?s technical progress and performance. Seattle HQ also provides funding to country offices operating within the University?s global network. The country offices incur costs associated with furnishing supplies and equipment to address the HIV/AIDS epidemic, as well as staffing resources and acquiring goods and services from contractors to carry out the objectives of the program. Payments made by country offices are approved by Country Directors and Country Representatives as delegated by the University. Under the University?s policies, country offices are reimbursed for locally incurred expenses at least monthly. An invoice, accompanied by a schedule of expenses incurred, is submitted and approved by the Country Director and then by the Director of Finance at Seattle HQ, prior to payment. Country offices also responsible for obtaining and retaining supporting documentation for costs incurred and paid on each project. Monthly, Budget Managers review and approve a Budget Activity Report (BAR) that details the expenses charged to the project for the previous month to ensure accurate posting of already approved expenses. This review is also to determine whether the work performed during the billing period reconciles to costs claimed within the contractor?s invoice so that payment may be authorized. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls to ensure payments to contractors and subrecipients of the Global AIDS program were allowable properly supported and within the period of performance. Payments to country offices We used a statistical sampling method to randomly select and examine 58 out of 1,644 transactions for country offices. Of the 58 payments examined, we identified one payment (1.7 percent) that was not approved by the Country Director and the corresponding Budget Activity Report was not approved by the Director of Finance. Payments to contractors We used a statistical sampling method to randomly select and review 58 out of 3,040 payments to contractors. We found: ? Invoices for three payments (5 percent) were not approved by a Budget Manager ? Monthly Budget Activity Reports were not approved for 12 payments (20 percent) Subrecipient reimbursements We used a statistical sampling method to randomly select and review 55 out of 438 payments to subrecipients. We found the assigned Budget Manager did not review and approve the monthly Budget Activity Reports for 52 payments (94 percent). We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Program management did not require supporting documentation for each payment to be forwarded to and reviewed by headquarters personnel prior to payment authorization. Management also did not monitor the submission of invoices and Budget Activity Reports to ensure they were approved by the responsible Budget Manager, as required. Effect of Condition Without establishing adequate internal controls, the University cannot reasonably ensure it is using federal funds for allowable purposes and that expenditures of federal funds are supported by adequate documentation. Recommendations We recommend the University: ? Improve its internal controls to ensure invoices are properly approved by Principal Investigators, as required ? Improve its internal controls to ensure Budget Mangers review and approve monthly Budget Activity Reports before authorizing payments for projects incurring reimbursement requests ? Ensure it retains supporting documentation sufficient to show costs incurred and paid by the program are allowable, and to demonstrate the required managerial reviews have occurred prior to issuing payment University?s Response In response to the findings for the Global Aids Program, we would like to clarify the following: General Clarification: The draft finding inaccurately represents the role of BARS approvals as part of the internal controls to ensure payments to country offices, contractors and subrecipients are allowable, properly supported and within the period of performance. This is not the role of the BARS review process. Compliance, Budget Manager and PI reviews are the controls that ensure allowability of payments and BARS approvals are after-the-fact validations of accurate posting of already approved expenditures. We provided edits to the Background section to reflect our process. We request in light of this that the description of condition, cause of condition and recommendation sections of this finding be updated accordingly. Payments to country offices I-TECH country offices are not contractors; the offices are an extension of the University of Washington. Your review identified one of fifty-eight samples (1.7%) did not meet the approval requirements set forth in I-TECH?s standard operating procedure. Based on the error percentage, we disagree with this finding. Payments to contractors Payments to contractors have multiple approvals. Upon receipt, individual invoices are approved by the program/budget manager either by signature or email. Invoices are then sent to the I-TECH Accounts Payable Administrator for input to the University?s procurement system, ARIBA, which requires compliance approval from the Accounts Payable Supervisor or other manager, as well as funding approval from the budget manager prior to payment. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to contractors, they are reviews of the monthly expenses posted to the budget and the program manager?s concurrence that the expenses are as expected. The exceptions noted were payments made to country offices instead of contractors. The support for approvals were provided to the State Auditors on April 26, 2023, prior to the completion of fieldwork. We therefore disagree with this finding. We also request that the finding be adjusted to omit the 20% of missing BARS approvals as this is not related to the contractor payments. Subrecipient reimbursements Each subrecipient invoice is reviewed for reasonableness, allowability and allocability by the contracts manager and approved by both budget managers and principal investigators prior to being processed for payment in ARIBA. PI approvals were provided and verified for each subrecipient selection with no omissions noted by the auditors. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to subrecipients, they are after-the-fact reviews of the monthly expenses posted to the budget, intended as documentation of the program manager?s concurrence that the expenses are posted as expected. We acknowledge the instances detailed in the finding where we were unable to produce related BARS approvals for 52 of the transactions; however, we request that the finding be adjusted as these BARS approvals are not related to subrecipient invoice review and approvals. Our record keeping process for BARS approvals was to save the emails in a folder within our Finance Team mailbox. We learned during this review that emails beyond a certain date are deleted but maintained in the MS360 file. We?ve searched for the missing BARS approvals but have not yet been able to locate them. We have since begun saving the approvals to our server to ensure we have access to the data going forward. Auditor?s Remarks The University?s I-TECH Global Operations Manual stipulates that BARs will be generated, reviewed and approved monthly by the Budget Manager and management team. This information was provided to our Office as part of the University?s overall design of internal controls over payments to contractors, subrecipients and country offices. The University responded to our Office on April 20, 2023 adding that ?BAR review is the University?s key post payment control designed to ensure charges are accurately processed, coded and allowable on the budget charged.? We interpret this response to indicate the BAR review process is a monitoring control, and the University asserted on multiple occasions this is a key internal control, which is why we tested it. On January 5, our Office notified University management in writing that the BAR review process would be tested as a key control over the cost principles and period of performance requirements for Global AIDS expenditures. We received no additional inquiry or concerns from University management regarding this internal control until the draft finding was issued on April 14. We provided the University with a final written summary of our fieldwork in this area on April 6, 2023, after fieldwork had concluded. On April 7, the Finance Director responded to our Office in writing confirming they had no further questions or concerns regarding our testing results. It was not until after the University received this finding that additional documentation supporting expenditures tested during the audit were ultimately given to our Office. The basis for this audit finding is the key internal control failure rate of BAR approvals that exceeds our established materiality threshold of five percent, and constitutes a material weakness in internal control, which under the Uniform Guidance is required to be reported as an audit finding in accordance with 2 CFR 200.516 ? Audit findings. We reaffirm our finding and will follow up on the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 02 ? Acceptance of Sponsored Program Awards and Fiscal Compliance on Sponsored Program Accounts (Budget Numbers), states in part: Responsibilities Principal Investigator ? Supervises expenditure of sponsored program funds and approves sub-recipient invoices (see GIM 8) to assure: o That funds are used only for purposes that directly relate to and benefit the activity supported in the award. o That expenditures are consistent with all special terms, conditions, or limitations that apply to expenditures under the particular grant or contract. o That expenditures do not exceed the total funds authorized for a given period under the grant or contract. GIM 07 ? Sponsored Program Subaward Administration, states in part: Principal Investigator ? Review and approve subaward invoices. GIM 08 ? Subrecipient Monitoring, states in part: Roles & Responsibilities PI / Department Responsibilities Project level monitoring of subrecipient including: o Reviews that expenses are necessary, reasonable, and allocable to the work completed and are aligned with technical progress. o Approve invoices for payment. Subrecipient Monitoring ? Project Level Subrecipient invoices are reviewed and approved in accordance with the requirements of GIM 2 in the manner and frequency stated in the subaward. The University of Washington I-TECH Global Operations Manual (GRef 2.3), Section 2, Finance, Accounting Policy and Procedure Requirements, states in part: In addition to the Fiscal Guidelines set forth in the I-TECH Field Operations Manual, these country specific policies are implemented at I-TECH. 10. Budget Management and Reporting f. Reports that show the variance between the budget plan and the activity for each region and activity code will be generated, reviewed and approved by the budget managers and the Management Team each month.

2022-030 The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. Federal regulations require the University to monitor its subrecipients? activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single or program-specific audit. For the Global AIDS program, the Centers for Disease Control and Prevention requires foreign subrecipients to submit their audits directly to the federal government and pass-through entity within 30 days after receiving the auditor?s report or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes onto its subrecipients, the University must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a University-funded program, federal law requires the University to issue a management decision to the subrecipient within six months of the audit report?s acceptance by the federal government. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it appropriately followed up on findings and issued management decisions. We found the University did not have adequate internal controls in place to verify whether: ? Subrecipients received required audits, if necessary, and appropriate remedies were taken if audits were not filed ? Management decisions were required to be issued for subrecipients who required a single or program-specific audit We used a nonstatistical sampling method to randomly select and examine seven out of a total population of 21 subrecipients. We found the University did not adequately monitor one subrecipient (14 percent) to ensure it received a required single or program-specific audit. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Staff in the University?s Office of Sponsored Programs (OSP) used a spreadsheet to track subrecipient certifications and responses, and reviewed annual certifications from the subrecipient to monitor its audit status. However, OSP did not correctly interpret the subrecipient?s response and, therefore, did not require it to provide documentation of a single or program-specific audit. Additionally, management did not review the subrecipient?s federal assistance expenditures to detect that it required an audit and, therefore, also failed to adequately follow up to ensure any reported findings were resolved with appropriate corrective action, if required. Effect of Condition Without establishing adequate internal controls, the University cannot ensure all subrecipients that required a single or program-specific audit received one. Furthermore, the University cannot ensure it is following up on subrecipient audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitors them for effectiveness where required, the University cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the University: ? Follow policies and procedures to ensure subrecipients receive required single or program-specific audits ? Establish and follow effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations ? Follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations ? Issue a written management decision for all applicable audit findings, if necessary University?s Response The University of Washington has established internal controls to carry out a risk assessment per Uniform Guidance, 2 CFR ? 200.332, Requirements for pass-through entities, and our UW Grants Information Memorandum (GIM) 8. This involves using various factors to assess risk. Part of our process to obtain the information needed from each subrecipient is through a certification process. The certification was obtained from the subrecipient, along with additional documentation from the subrecipient, such as an audited financial statement. We made a risk assessment using our standard risk criteria. We did misinterpret the response provided from the subrecipient regarding whether it expended $750,000 or more in federal awards during a fiscal year in order to obtain a single or program-specific audit from this subrecipient. While this was not obtained and reviewed, a risk assessment using our standard criteria was performed with the subrecipient rated as a medium risk, and subject to monitoring throughout the project, per GIM 8. The monitoring at the program level occurred during the period in question. We will be improving our required communications with subrecipients to have clear questions and responses regarding whether the subrecipient expended $750,000 or more in federal awards during the fiscal year in order to obtain a single or program-specific audit, follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations, and issue a written management decision for all applicable audit findings, if necessary. Auditor?s Remarks We thank the University for its cooperation and assistance during the audit. Whether the University performed a risk assessment for the subrecipient is not being questioned. The University did not adequately monitor the subrecipient to ensure it detected whether the subrecipient was required to receive a single audit, or program-specific audit in accordance with 2 CFR ?200.332(f). There is no other mechanism for the Federal government to monitor subrecipients of the University and, because a single audit of the subrecipient was not performed, neither the federal grantor nor the University had reasonable assurance of the subrecipient?s compliance with federal award requirements. We reaffirm our finding and will follow up on the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, establishes the following applicable requirements: Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient?s cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set for the in ?200.501 Audit requirements. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c). The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 8 ? Subrecipient Monitoring, states in part: Background Additionally, per the Federal Uniform Guidance, UW must evaluate each subrecipients? risk of noncompliance with federal regulations, include specific terms and conditions in the subaward as necessary, and monitor the activities of the subrecipient through various mechanisms. These mechanisms include: Training and technical assistance to subrecipients, on-site reviews, review of audit results, increased reporting requirements and enforcement action, if necessary. University Policy UW reviews each subrecipient entity according to an entity level comprehensive risk assessment prior to the issuance of a subaward. This risk assessment includes an entity level review of their fiscal systems, past audit activity, and if required, financial statements of the entity as well as the project specific activity proposed and that the required compliance approvals are obtained. When necessary, UW imposes limitations and requirements on the subrecipient through subaward terms and conditions per Federal Uniform Guidance, Section 200.521, prior to the issuance or renewal of a subaward. UW?s subrecipient monitoring requirements are comprised, at a minimum, of the following: ? Completion of the UW?s entity level comprehensive risk assessment (Certs & Reps, Annual Audit Certification) Subrecipient Monitoring ? Entity Level Entity level monitoring consists of a combination of the following: ? Initial Subrecipient Certification Form completion and assurance by subrecipient?s authorized official ? Annual audit assurance through an annual audit certification form ? Maintenance of a subrecipient profile list, which includes information on the entity?s past audit information and certifications ? Risk assessment carried out at each annual renewal of a subaward

2022-028 The University of Washington did not establish adequate internal controls to ensure payments to contractors and subrecipients for the Global AIDS program were allowable, properly supported and within the period of performance. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. To achieve the performance goals of the program, the Seattle headquarters of I-TECH (Seattle HQ) provides funding to subrecipients and contractors. Invoices submitted by contractors directly to Seattle HQ are reviewed and approved for payment by budget managers who have delegated authority from the Principal Investigator. Invoices submitted by subrecipients are reviewed and approved for payment by a Principal Investigator. Principal Investigators are also responsible for monitoring the subrecipient?s technical progress and performance. Seattle HQ also provides funding to country offices operating within the University?s global network. The country offices incur costs associated with furnishing supplies and equipment to address the HIV/AIDS epidemic, as well as staffing resources and acquiring goods and services from contractors to carry out the objectives of the program. Payments made by country offices are approved by Country Directors and Country Representatives as delegated by the University. Under the University?s policies, country offices are reimbursed for locally incurred expenses at least monthly. An invoice, accompanied by a schedule of expenses incurred, is submitted and approved by the Country Director and then by the Director of Finance at Seattle HQ, prior to payment. Country offices also responsible for obtaining and retaining supporting documentation for costs incurred and paid on each project. Monthly, Budget Managers review and approve a Budget Activity Report (BAR) that details the expenses charged to the project for the previous month to ensure accurate posting of already approved expenses. This review is also to determine whether the work performed during the billing period reconciles to costs claimed within the contractor?s invoice so that payment may be authorized. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls to ensure payments to contractors and subrecipients of the Global AIDS program were allowable properly supported and within the period of performance. Payments to country offices We used a statistical sampling method to randomly select and examine 58 out of 1,644 transactions for country offices. Of the 58 payments examined, we identified one payment (1.7 percent) that was not approved by the Country Director and the corresponding Budget Activity Report was not approved by the Director of Finance. Payments to contractors We used a statistical sampling method to randomly select and review 58 out of 3,040 payments to contractors. We found: ? Invoices for three payments (5 percent) were not approved by a Budget Manager ? Monthly Budget Activity Reports were not approved for 12 payments (20 percent) Subrecipient reimbursements We used a statistical sampling method to randomly select and review 55 out of 438 payments to subrecipients. We found the assigned Budget Manager did not review and approve the monthly Budget Activity Reports for 52 payments (94 percent). We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Program management did not require supporting documentation for each payment to be forwarded to and reviewed by headquarters personnel prior to payment authorization. Management also did not monitor the submission of invoices and Budget Activity Reports to ensure they were approved by the responsible Budget Manager, as required. Effect of Condition Without establishing adequate internal controls, the University cannot reasonably ensure it is using federal funds for allowable purposes and that expenditures of federal funds are supported by adequate documentation. Recommendations We recommend the University: ? Improve its internal controls to ensure invoices are properly approved by Principal Investigators, as required ? Improve its internal controls to ensure Budget Mangers review and approve monthly Budget Activity Reports before authorizing payments for projects incurring reimbursement requests ? Ensure it retains supporting documentation sufficient to show costs incurred and paid by the program are allowable, and to demonstrate the required managerial reviews have occurred prior to issuing payment University?s Response In response to the findings for the Global Aids Program, we would like to clarify the following: General Clarification: The draft finding inaccurately represents the role of BARS approvals as part of the internal controls to ensure payments to country offices, contractors and subrecipients are allowable, properly supported and within the period of performance. This is not the role of the BARS review process. Compliance, Budget Manager and PI reviews are the controls that ensure allowability of payments and BARS approvals are after-the-fact validations of accurate posting of already approved expenditures. We provided edits to the Background section to reflect our process. We request in light of this that the description of condition, cause of condition and recommendation sections of this finding be updated accordingly. Payments to country offices I-TECH country offices are not contractors; the offices are an extension of the University of Washington. Your review identified one of fifty-eight samples (1.7%) did not meet the approval requirements set forth in I-TECH?s standard operating procedure. Based on the error percentage, we disagree with this finding. Payments to contractors Payments to contractors have multiple approvals. Upon receipt, individual invoices are approved by the program/budget manager either by signature or email. Invoices are then sent to the I-TECH Accounts Payable Administrator for input to the University?s procurement system, ARIBA, which requires compliance approval from the Accounts Payable Supervisor or other manager, as well as funding approval from the budget manager prior to payment. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to contractors, they are reviews of the monthly expenses posted to the budget and the program manager?s concurrence that the expenses are as expected. The exceptions noted were payments made to country offices instead of contractors. The support for approvals were provided to the State Auditors on April 26, 2023, prior to the completion of fieldwork. We therefore disagree with this finding. We also request that the finding be adjusted to omit the 20% of missing BARS approvals as this is not related to the contractor payments. Subrecipient reimbursements Each subrecipient invoice is reviewed for reasonableness, allowability and allocability by the contracts manager and approved by both budget managers and principal investigators prior to being processed for payment in ARIBA. PI approvals were provided and verified for each subrecipient selection with no omissions noted by the auditors. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to subrecipients, they are after-the-fact reviews of the monthly expenses posted to the budget, intended as documentation of the program manager?s concurrence that the expenses are posted as expected. We acknowledge the instances detailed in the finding where we were unable to produce related BARS approvals for 52 of the transactions; however, we request that the finding be adjusted as these BARS approvals are not related to subrecipient invoice review and approvals. Our record keeping process for BARS approvals was to save the emails in a folder within our Finance Team mailbox. We learned during this review that emails beyond a certain date are deleted but maintained in the MS360 file. We?ve searched for the missing BARS approvals but have not yet been able to locate them. We have since begun saving the approvals to our server to ensure we have access to the data going forward. Auditor?s Remarks The University?s I-TECH Global Operations Manual stipulates that BARs will be generated, reviewed and approved monthly by the Budget Manager and management team. This information was provided to our Office as part of the University?s overall design of internal controls over payments to contractors, subrecipients and country offices. The University responded to our Office on April 20, 2023 adding that ?BAR review is the University?s key post payment control designed to ensure charges are accurately processed, coded and allowable on the budget charged.? We interpret this response to indicate the BAR review process is a monitoring control, and the University asserted on multiple occasions this is a key internal control, which is why we tested it. On January 5, our Office notified University management in writing that the BAR review process would be tested as a key control over the cost principles and period of performance requirements for Global AIDS expenditures. We received no additional inquiry or concerns from University management regarding this internal control until the draft finding was issued on April 14. We provided the University with a final written summary of our fieldwork in this area on April 6, 2023, after fieldwork had concluded. On April 7, the Finance Director responded to our Office in writing confirming they had no further questions or concerns regarding our testing results. It was not until after the University received this finding that additional documentation supporting expenditures tested during the audit were ultimately given to our Office. The basis for this audit finding is the key internal control failure rate of BAR approvals that exceeds our established materiality threshold of five percent, and constitutes a material weakness in internal control, which under the Uniform Guidance is required to be reported as an audit finding in accordance with 2 CFR 200.516 ? Audit findings. We reaffirm our finding and will follow up on the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 02 ? Acceptance of Sponsored Program Awards and Fiscal Compliance on Sponsored Program Accounts (Budget Numbers), states in part: Responsibilities Principal Investigator ? Supervises expenditure of sponsored program funds and approves sub-recipient invoices (see GIM 8) to assure: o That funds are used only for purposes that directly relate to and benefit the activity supported in the award. o That expenditures are consistent with all special terms, conditions, or limitations that apply to expenditures under the particular grant or contract. o That expenditures do not exceed the total funds authorized for a given period under the grant or contract. GIM 07 ? Sponsored Program Subaward Administration, states in part: Principal Investigator ? Review and approve subaward invoices. GIM 08 ? Subrecipient Monitoring, states in part: Roles & Responsibilities PI / Department Responsibilities Project level monitoring of subrecipient including: o Reviews that expenses are necessary, reasonable, and allocable to the work completed and are aligned with technical progress. o Approve invoices for payment. Subrecipient Monitoring ? Project Level Subrecipient invoices are reviewed and approved in accordance with the requirements of GIM 2 in the manner and frequency stated in the subaward. The University of Washington I-TECH Global Operations Manual (GRef 2.3), Section 2, Finance, Accounting Policy and Procedure Requirements, states in part: In addition to the Fiscal Guidelines set forth in the I-TECH Field Operations Manual, these country specific policies are implemented at I-TECH. 10. Budget Management and Reporting f. Reports that show the variance between the budget plan and the activity for each region and activity code will be generated, reviewed and approved by the budget managers and the Management Team each month.

2022-030 The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. Federal regulations require the University to monitor its subrecipients? activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single or program-specific audit. For the Global AIDS program, the Centers for Disease Control and Prevention requires foreign subrecipients to submit their audits directly to the federal government and pass-through entity within 30 days after receiving the auditor?s report or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes onto its subrecipients, the University must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a University-funded program, federal law requires the University to issue a management decision to the subrecipient within six months of the audit report?s acceptance by the federal government. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it appropriately followed up on findings and issued management decisions. We found the University did not have adequate internal controls in place to verify whether: ? Subrecipients received required audits, if necessary, and appropriate remedies were taken if audits were not filed ? Management decisions were required to be issued for subrecipients who required a single or program-specific audit We used a nonstatistical sampling method to randomly select and examine seven out of a total population of 21 subrecipients. We found the University did not adequately monitor one subrecipient (14 percent) to ensure it received a required single or program-specific audit. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Staff in the University?s Office of Sponsored Programs (OSP) used a spreadsheet to track subrecipient certifications and responses, and reviewed annual certifications from the subrecipient to monitor its audit status. However, OSP did not correctly interpret the subrecipient?s response and, therefore, did not require it to provide documentation of a single or program-specific audit. Additionally, management did not review the subrecipient?s federal assistance expenditures to detect that it required an audit and, therefore, also failed to adequately follow up to ensure any reported findings were resolved with appropriate corrective action, if required. Effect of Condition Without establishing adequate internal controls, the University cannot ensure all subrecipients that required a single or program-specific audit received one. Furthermore, the University cannot ensure it is following up on subrecipient audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitors them for effectiveness where required, the University cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the University: ? Follow policies and procedures to ensure subrecipients receive required single or program-specific audits ? Establish and follow effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations ? Follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations ? Issue a written management decision for all applicable audit findings, if necessary University?s Response The University of Washington has established internal controls to carry out a risk assessment per Uniform Guidance, 2 CFR ? 200.332, Requirements for pass-through entities, and our UW Grants Information Memorandum (GIM) 8. This involves using various factors to assess risk. Part of our process to obtain the information needed from each subrecipient is through a certification process. The certification was obtained from the subrecipient, along with additional documentation from the subrecipient, such as an audited financial statement. We made a risk assessment using our standard risk criteria. We did misinterpret the response provided from the subrecipient regarding whether it expended $750,000 or more in federal awards during a fiscal year in order to obtain a single or program-specific audit from this subrecipient. While this was not obtained and reviewed, a risk assessment using our standard criteria was performed with the subrecipient rated as a medium risk, and subject to monitoring throughout the project, per GIM 8. The monitoring at the program level occurred during the period in question. We will be improving our required communications with subrecipients to have clear questions and responses regarding whether the subrecipient expended $750,000 or more in federal awards during the fiscal year in order to obtain a single or program-specific audit, follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations, and issue a written management decision for all applicable audit findings, if necessary. Auditor?s Remarks We thank the University for its cooperation and assistance during the audit. Whether the University performed a risk assessment for the subrecipient is not being questioned. The University did not adequately monitor the subrecipient to ensure it detected whether the subrecipient was required to receive a single audit, or program-specific audit in accordance with 2 CFR ?200.332(f). There is no other mechanism for the Federal government to monitor subrecipients of the University and, because a single audit of the subrecipient was not performed, neither the federal grantor nor the University had reasonable assurance of the subrecipient?s compliance with federal award requirements. We reaffirm our finding and will follow up on the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, establishes the following applicable requirements: Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient?s cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set for the in ?200.501 Audit requirements. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c). The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 8 ? Subrecipient Monitoring, states in part: Background Additionally, per the Federal Uniform Guidance, UW must evaluate each subrecipients? risk of noncompliance with federal regulations, include specific terms and conditions in the subaward as necessary, and monitor the activities of the subrecipient through various mechanisms. These mechanisms include: Training and technical assistance to subrecipients, on-site reviews, review of audit results, increased reporting requirements and enforcement action, if necessary. University Policy UW reviews each subrecipient entity according to an entity level comprehensive risk assessment prior to the issuance of a subaward. This risk assessment includes an entity level review of their fiscal systems, past audit activity, and if required, financial statements of the entity as well as the project specific activity proposed and that the required compliance approvals are obtained. When necessary, UW imposes limitations and requirements on the subrecipient through subaward terms and conditions per Federal Uniform Guidance, Section 200.521, prior to the issuance or renewal of a subaward. UW?s subrecipient monitoring requirements are comprised, at a minimum, of the following: ? Completion of the UW?s entity level comprehensive risk assessment (Certs & Reps, Annual Audit Certification) Subrecipient Monitoring ? Entity Level Entity level monitoring consists of a combination of the following: ? Initial Subrecipient Certification Form completion and assurance by subrecipient?s authorized official ? Annual audit assurance through an annual audit certification form ? Maintenance of a subrecipient profile list, which includes information on the entity?s past audit information and certifications ? Risk assessment carried out at each annual renewal of a subaward

2022-028 The University of Washington did not establish adequate internal controls to ensure payments to contractors and subrecipients for the Global AIDS program were allowable, properly supported and within the period of performance. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. To achieve the performance goals of the program, the Seattle headquarters of I-TECH (Seattle HQ) provides funding to subrecipients and contractors. Invoices submitted by contractors directly to Seattle HQ are reviewed and approved for payment by budget managers who have delegated authority from the Principal Investigator. Invoices submitted by subrecipients are reviewed and approved for payment by a Principal Investigator. Principal Investigators are also responsible for monitoring the subrecipient?s technical progress and performance. Seattle HQ also provides funding to country offices operating within the University?s global network. The country offices incur costs associated with furnishing supplies and equipment to address the HIV/AIDS epidemic, as well as staffing resources and acquiring goods and services from contractors to carry out the objectives of the program. Payments made by country offices are approved by Country Directors and Country Representatives as delegated by the University. Under the University?s policies, country offices are reimbursed for locally incurred expenses at least monthly. An invoice, accompanied by a schedule of expenses incurred, is submitted and approved by the Country Director and then by the Director of Finance at Seattle HQ, prior to payment. Country offices also responsible for obtaining and retaining supporting documentation for costs incurred and paid on each project. Monthly, Budget Managers review and approve a Budget Activity Report (BAR) that details the expenses charged to the project for the previous month to ensure accurate posting of already approved expenses. This review is also to determine whether the work performed during the billing period reconciles to costs claimed within the contractor?s invoice so that payment may be authorized. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls to ensure payments to contractors and subrecipients of the Global AIDS program were allowable properly supported and within the period of performance. Payments to country offices We used a statistical sampling method to randomly select and examine 58 out of 1,644 transactions for country offices. Of the 58 payments examined, we identified one payment (1.7 percent) that was not approved by the Country Director and the corresponding Budget Activity Report was not approved by the Director of Finance. Payments to contractors We used a statistical sampling method to randomly select and review 58 out of 3,040 payments to contractors. We found: ? Invoices for three payments (5 percent) were not approved by a Budget Manager ? Monthly Budget Activity Reports were not approved for 12 payments (20 percent) Subrecipient reimbursements We used a statistical sampling method to randomly select and review 55 out of 438 payments to subrecipients. We found the assigned Budget Manager did not review and approve the monthly Budget Activity Reports for 52 payments (94 percent). We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Program management did not require supporting documentation for each payment to be forwarded to and reviewed by headquarters personnel prior to payment authorization. Management also did not monitor the submission of invoices and Budget Activity Reports to ensure they were approved by the responsible Budget Manager, as required. Effect of Condition Without establishing adequate internal controls, the University cannot reasonably ensure it is using federal funds for allowable purposes and that expenditures of federal funds are supported by adequate documentation. Recommendations We recommend the University: ? Improve its internal controls to ensure invoices are properly approved by Principal Investigators, as required ? Improve its internal controls to ensure Budget Mangers review and approve monthly Budget Activity Reports before authorizing payments for projects incurring reimbursement requests ? Ensure it retains supporting documentation sufficient to show costs incurred and paid by the program are allowable, and to demonstrate the required managerial reviews have occurred prior to issuing payment University?s Response In response to the findings for the Global Aids Program, we would like to clarify the following: General Clarification: The draft finding inaccurately represents the role of BARS approvals as part of the internal controls to ensure payments to country offices, contractors and subrecipients are allowable, properly supported and within the period of performance. This is not the role of the BARS review process. Compliance, Budget Manager and PI reviews are the controls that ensure allowability of payments and BARS approvals are after-the-fact validations of accurate posting of already approved expenditures. We provided edits to the Background section to reflect our process. We request in light of this that the description of condition, cause of condition and recommendation sections of this finding be updated accordingly. Payments to country offices I-TECH country offices are not contractors; the offices are an extension of the University of Washington. Your review identified one of fifty-eight samples (1.7%) did not meet the approval requirements set forth in I-TECH?s standard operating procedure. Based on the error percentage, we disagree with this finding. Payments to contractors Payments to contractors have multiple approvals. Upon receipt, individual invoices are approved by the program/budget manager either by signature or email. Invoices are then sent to the I-TECH Accounts Payable Administrator for input to the University?s procurement system, ARIBA, which requires compliance approval from the Accounts Payable Supervisor or other manager, as well as funding approval from the budget manager prior to payment. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to contractors, they are reviews of the monthly expenses posted to the budget and the program manager?s concurrence that the expenses are as expected. The exceptions noted were payments made to country offices instead of contractors. The support for approvals were provided to the State Auditors on April 26, 2023, prior to the completion of fieldwork. We therefore disagree with this finding. We also request that the finding be adjusted to omit the 20% of missing BARS approvals as this is not related to the contractor payments. Subrecipient reimbursements Each subrecipient invoice is reviewed for reasonableness, allowability and allocability by the contracts manager and approved by both budget managers and principal investigators prior to being processed for payment in ARIBA. PI approvals were provided and verified for each subrecipient selection with no omissions noted by the auditors. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to subrecipients, they are after-the-fact reviews of the monthly expenses posted to the budget, intended as documentation of the program manager?s concurrence that the expenses are posted as expected. We acknowledge the instances detailed in the finding where we were unable to produce related BARS approvals for 52 of the transactions; however, we request that the finding be adjusted as these BARS approvals are not related to subrecipient invoice review and approvals. Our record keeping process for BARS approvals was to save the emails in a folder within our Finance Team mailbox. We learned during this review that emails beyond a certain date are deleted but maintained in the MS360 file. We?ve searched for the missing BARS approvals but have not yet been able to locate them. We have since begun saving the approvals to our server to ensure we have access to the data going forward. Auditor?s Remarks The University?s I-TECH Global Operations Manual stipulates that BARs will be generated, reviewed and approved monthly by the Budget Manager and management team. This information was provided to our Office as part of the University?s overall design of internal controls over payments to contractors, subrecipients and country offices. The University responded to our Office on April 20, 2023 adding that ?BAR review is the University?s key post payment control designed to ensure charges are accurately processed, coded and allowable on the budget charged.? We interpret this response to indicate the BAR review process is a monitoring control, and the University asserted on multiple occasions this is a key internal control, which is why we tested it. On January 5, our Office notified University management in writing that the BAR review process would be tested as a key control over the cost principles and period of performance requirements for Global AIDS expenditures. We received no additional inquiry or concerns from University management regarding this internal control until the draft finding was issued on April 14. We provided the University with a final written summary of our fieldwork in this area on April 6, 2023, after fieldwork had concluded. On April 7, the Finance Director responded to our Office in writing confirming they had no further questions or concerns regarding our testing results. It was not until after the University received this finding that additional documentation supporting expenditures tested during the audit were ultimately given to our Office. The basis for this audit finding is the key internal control failure rate of BAR approvals that exceeds our established materiality threshold of five percent, and constitutes a material weakness in internal control, which under the Uniform Guidance is required to be reported as an audit finding in accordance with 2 CFR 200.516 ? Audit findings. We reaffirm our finding and will follow up on the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 02 ? Acceptance of Sponsored Program Awards and Fiscal Compliance on Sponsored Program Accounts (Budget Numbers), states in part: Responsibilities Principal Investigator ? Supervises expenditure of sponsored program funds and approves sub-recipient invoices (see GIM 8) to assure: o That funds are used only for purposes that directly relate to and benefit the activity supported in the award. o That expenditures are consistent with all special terms, conditions, or limitations that apply to expenditures under the particular grant or contract. o That expenditures do not exceed the total funds authorized for a given period under the grant or contract. GIM 07 ? Sponsored Program Subaward Administration, states in part: Principal Investigator ? Review and approve subaward invoices. GIM 08 ? Subrecipient Monitoring, states in part: Roles & Responsibilities PI / Department Responsibilities Project level monitoring of subrecipient including: o Reviews that expenses are necessary, reasonable, and allocable to the work completed and are aligned with technical progress. o Approve invoices for payment. Subrecipient Monitoring ? Project Level Subrecipient invoices are reviewed and approved in accordance with the requirements of GIM 2 in the manner and frequency stated in the subaward. The University of Washington I-TECH Global Operations Manual (GRef 2.3), Section 2, Finance, Accounting Policy and Procedure Requirements, states in part: In addition to the Fiscal Guidelines set forth in the I-TECH Field Operations Manual, these country specific policies are implemented at I-TECH. 10. Budget Management and Reporting f. Reports that show the variance between the budget plan and the activity for each region and activity code will be generated, reviewed and approved by the budget managers and the Management Team each month.

2022-030 The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. Federal regulations require the University to monitor its subrecipients? activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single or program-specific audit. For the Global AIDS program, the Centers for Disease Control and Prevention requires foreign subrecipients to submit their audits directly to the federal government and pass-through entity within 30 days after receiving the auditor?s report or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes onto its subrecipients, the University must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a University-funded program, federal law requires the University to issue a management decision to the subrecipient within six months of the audit report?s acceptance by the federal government. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it appropriately followed up on findings and issued management decisions. We found the University did not have adequate internal controls in place to verify whether: ? Subrecipients received required audits, if necessary, and appropriate remedies were taken if audits were not filed ? Management decisions were required to be issued for subrecipients who required a single or program-specific audit We used a nonstatistical sampling method to randomly select and examine seven out of a total population of 21 subrecipients. We found the University did not adequately monitor one subrecipient (14 percent) to ensure it received a required single or program-specific audit. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Staff in the University?s Office of Sponsored Programs (OSP) used a spreadsheet to track subrecipient certifications and responses, and reviewed annual certifications from the subrecipient to monitor its audit status. However, OSP did not correctly interpret the subrecipient?s response and, therefore, did not require it to provide documentation of a single or program-specific audit. Additionally, management did not review the subrecipient?s federal assistance expenditures to detect that it required an audit and, therefore, also failed to adequately follow up to ensure any reported findings were resolved with appropriate corrective action, if required. Effect of Condition Without establishing adequate internal controls, the University cannot ensure all subrecipients that required a single or program-specific audit received one. Furthermore, the University cannot ensure it is following up on subrecipient audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitors them for effectiveness where required, the University cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the University: ? Follow policies and procedures to ensure subrecipients receive required single or program-specific audits ? Establish and follow effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations ? Follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations ? Issue a written management decision for all applicable audit findings, if necessary University?s Response The University of Washington has established internal controls to carry out a risk assessment per Uniform Guidance, 2 CFR ? 200.332, Requirements for pass-through entities, and our UW Grants Information Memorandum (GIM) 8. This involves using various factors to assess risk. Part of our process to obtain the information needed from each subrecipient is through a certification process. The certification was obtained from the subrecipient, along with additional documentation from the subrecipient, such as an audited financial statement. We made a risk assessment using our standard risk criteria. We did misinterpret the response provided from the subrecipient regarding whether it expended $750,000 or more in federal awards during a fiscal year in order to obtain a single or program-specific audit from this subrecipient. While this was not obtained and reviewed, a risk assessment using our standard criteria was performed with the subrecipient rated as a medium risk, and subject to monitoring throughout the project, per GIM 8. The monitoring at the program level occurred during the period in question. We will be improving our required communications with subrecipients to have clear questions and responses regarding whether the subrecipient expended $750,000 or more in federal awards during the fiscal year in order to obtain a single or program-specific audit, follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations, and issue a written management decision for all applicable audit findings, if necessary. Auditor?s Remarks We thank the University for its cooperation and assistance during the audit. Whether the University performed a risk assessment for the subrecipient is not being questioned. The University did not adequately monitor the subrecipient to ensure it detected whether the subrecipient was required to receive a single audit, or program-specific audit in accordance with 2 CFR ?200.332(f). There is no other mechanism for the Federal government to monitor subrecipients of the University and, because a single audit of the subrecipient was not performed, neither the federal grantor nor the University had reasonable assurance of the subrecipient?s compliance with federal award requirements. We reaffirm our finding and will follow up on the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, establishes the following applicable requirements: Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient?s cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set for the in ?200.501 Audit requirements. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c). The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 8 ? Subrecipient Monitoring, states in part: Background Additionally, per the Federal Uniform Guidance, UW must evaluate each subrecipients? risk of noncompliance with federal regulations, include specific terms and conditions in the subaward as necessary, and monitor the activities of the subrecipient through various mechanisms. These mechanisms include: Training and technical assistance to subrecipients, on-site reviews, review of audit results, increased reporting requirements and enforcement action, if necessary. University Policy UW reviews each subrecipient entity according to an entity level comprehensive risk assessment prior to the issuance of a subaward. This risk assessment includes an entity level review of their fiscal systems, past audit activity, and if required, financial statements of the entity as well as the project specific activity proposed and that the required compliance approvals are obtained. When necessary, UW imposes limitations and requirements on the subrecipient through subaward terms and conditions per Federal Uniform Guidance, Section 200.521, prior to the issuance or renewal of a subaward. UW?s subrecipient monitoring requirements are comprised, at a minimum, of the following: ? Completion of the UW?s entity level comprehensive risk assessment (Certs & Reps, Annual Audit Certification) Subrecipient Monitoring ? Entity Level Entity level monitoring consists of a combination of the following: ? Initial Subrecipient Certification Form completion and assurance by subrecipient?s authorized official ? Annual audit assurance through an annual audit certification form ? Maintenance of a subrecipient profile list, which includes information on the entity?s past audit information and certifications ? Risk assessment carried out at each annual renewal of a subaward

2022-028 The University of Washington did not establish adequate internal controls to ensure payments to contractors and subrecipients for the Global AIDS program were allowable, properly supported and within the period of performance. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. To achieve the performance goals of the program, the Seattle headquarters of I-TECH (Seattle HQ) provides funding to subrecipients and contractors. Invoices submitted by contractors directly to Seattle HQ are reviewed and approved for payment by budget managers who have delegated authority from the Principal Investigator. Invoices submitted by subrecipients are reviewed and approved for payment by a Principal Investigator. Principal Investigators are also responsible for monitoring the subrecipient?s technical progress and performance. Seattle HQ also provides funding to country offices operating within the University?s global network. The country offices incur costs associated with furnishing supplies and equipment to address the HIV/AIDS epidemic, as well as staffing resources and acquiring goods and services from contractors to carry out the objectives of the program. Payments made by country offices are approved by Country Directors and Country Representatives as delegated by the University. Under the University?s policies, country offices are reimbursed for locally incurred expenses at least monthly. An invoice, accompanied by a schedule of expenses incurred, is submitted and approved by the Country Director and then by the Director of Finance at Seattle HQ, prior to payment. Country offices also responsible for obtaining and retaining supporting documentation for costs incurred and paid on each project. Monthly, Budget Managers review and approve a Budget Activity Report (BAR) that details the expenses charged to the project for the previous month to ensure accurate posting of already approved expenses. This review is also to determine whether the work performed during the billing period reconciles to costs claimed within the contractor?s invoice so that payment may be authorized. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls to ensure payments to contractors and subrecipients of the Global AIDS program were allowable properly supported and within the period of performance. Payments to country offices We used a statistical sampling method to randomly select and examine 58 out of 1,644 transactions for country offices. Of the 58 payments examined, we identified one payment (1.7 percent) that was not approved by the Country Director and the corresponding Budget Activity Report was not approved by the Director of Finance. Payments to contractors We used a statistical sampling method to randomly select and review 58 out of 3,040 payments to contractors. We found: ? Invoices for three payments (5 percent) were not approved by a Budget Manager ? Monthly Budget Activity Reports were not approved for 12 payments (20 percent) Subrecipient reimbursements We used a statistical sampling method to randomly select and review 55 out of 438 payments to subrecipients. We found the assigned Budget Manager did not review and approve the monthly Budget Activity Reports for 52 payments (94 percent). We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Program management did not require supporting documentation for each payment to be forwarded to and reviewed by headquarters personnel prior to payment authorization. Management also did not monitor the submission of invoices and Budget Activity Reports to ensure they were approved by the responsible Budget Manager, as required. Effect of Condition Without establishing adequate internal controls, the University cannot reasonably ensure it is using federal funds for allowable purposes and that expenditures of federal funds are supported by adequate documentation. Recommendations We recommend the University: ? Improve its internal controls to ensure invoices are properly approved by Principal Investigators, as required ? Improve its internal controls to ensure Budget Mangers review and approve monthly Budget Activity Reports before authorizing payments for projects incurring reimbursement requests ? Ensure it retains supporting documentation sufficient to show costs incurred and paid by the program are allowable, and to demonstrate the required managerial reviews have occurred prior to issuing payment University?s Response In response to the findings for the Global Aids Program, we would like to clarify the following: General Clarification: The draft finding inaccurately represents the role of BARS approvals as part of the internal controls to ensure payments to country offices, contractors and subrecipients are allowable, properly supported and within the period of performance. This is not the role of the BARS review process. Compliance, Budget Manager and PI reviews are the controls that ensure allowability of payments and BARS approvals are after-the-fact validations of accurate posting of already approved expenditures. We provided edits to the Background section to reflect our process. We request in light of this that the description of condition, cause of condition and recommendation sections of this finding be updated accordingly. Payments to country offices I-TECH country offices are not contractors; the offices are an extension of the University of Washington. Your review identified one of fifty-eight samples (1.7%) did not meet the approval requirements set forth in I-TECH?s standard operating procedure. Based on the error percentage, we disagree with this finding. Payments to contractors Payments to contractors have multiple approvals. Upon receipt, individual invoices are approved by the program/budget manager either by signature or email. Invoices are then sent to the I-TECH Accounts Payable Administrator for input to the University?s procurement system, ARIBA, which requires compliance approval from the Accounts Payable Supervisor or other manager, as well as funding approval from the budget manager prior to payment. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to contractors, they are reviews of the monthly expenses posted to the budget and the program manager?s concurrence that the expenses are as expected. The exceptions noted were payments made to country offices instead of contractors. The support for approvals were provided to the State Auditors on April 26, 2023, prior to the completion of fieldwork. We therefore disagree with this finding. We also request that the finding be adjusted to omit the 20% of missing BARS approvals as this is not related to the contractor payments. Subrecipient reimbursements Each subrecipient invoice is reviewed for reasonableness, allowability and allocability by the contracts manager and approved by both budget managers and principal investigators prior to being processed for payment in ARIBA. PI approvals were provided and verified for each subrecipient selection with no omissions noted by the auditors. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to subrecipients, they are after-the-fact reviews of the monthly expenses posted to the budget, intended as documentation of the program manager?s concurrence that the expenses are posted as expected. We acknowledge the instances detailed in the finding where we were unable to produce related BARS approvals for 52 of the transactions; however, we request that the finding be adjusted as these BARS approvals are not related to subrecipient invoice review and approvals. Our record keeping process for BARS approvals was to save the emails in a folder within our Finance Team mailbox. We learned during this review that emails beyond a certain date are deleted but maintained in the MS360 file. We?ve searched for the missing BARS approvals but have not yet been able to locate them. We have since begun saving the approvals to our server to ensure we have access to the data going forward. Auditor?s Remarks The University?s I-TECH Global Operations Manual stipulates that BARs will be generated, reviewed and approved monthly by the Budget Manager and management team. This information was provided to our Office as part of the University?s overall design of internal controls over payments to contractors, subrecipients and country offices. The University responded to our Office on April 20, 2023 adding that ?BAR review is the University?s key post payment control designed to ensure charges are accurately processed, coded and allowable on the budget charged.? We interpret this response to indicate the BAR review process is a monitoring control, and the University asserted on multiple occasions this is a key internal control, which is why we tested it. On January 5, our Office notified University management in writing that the BAR review process would be tested as a key control over the cost principles and period of performance requirements for Global AIDS expenditures. We received no additional inquiry or concerns from University management regarding this internal control until the draft finding was issued on April 14. We provided the University with a final written summary of our fieldwork in this area on April 6, 2023, after fieldwork had concluded. On April 7, the Finance Director responded to our Office in writing confirming they had no further questions or concerns regarding our testing results. It was not until after the University received this finding that additional documentation supporting expenditures tested during the audit were ultimately given to our Office. The basis for this audit finding is the key internal control failure rate of BAR approvals that exceeds our established materiality threshold of five percent, and constitutes a material weakness in internal control, which under the Uniform Guidance is required to be reported as an audit finding in accordance with 2 CFR 200.516 ? Audit findings. We reaffirm our finding and will follow up on the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 02 ? Acceptance of Sponsored Program Awards and Fiscal Compliance on Sponsored Program Accounts (Budget Numbers), states in part: Responsibilities Principal Investigator ? Supervises expenditure of sponsored program funds and approves sub-recipient invoices (see GIM 8) to assure: o That funds are used only for purposes that directly relate to and benefit the activity supported in the award. o That expenditures are consistent with all special terms, conditions, or limitations that apply to expenditures under the particular grant or contract. o That expenditures do not exceed the total funds authorized for a given period under the grant or contract. GIM 07 ? Sponsored Program Subaward Administration, states in part: Principal Investigator ? Review and approve subaward invoices. GIM 08 ? Subrecipient Monitoring, states in part: Roles & Responsibilities PI / Department Responsibilities Project level monitoring of subrecipient including: o Reviews that expenses are necessary, reasonable, and allocable to the work completed and are aligned with technical progress. o Approve invoices for payment. Subrecipient Monitoring ? Project Level Subrecipient invoices are reviewed and approved in accordance with the requirements of GIM 2 in the manner and frequency stated in the subaward. The University of Washington I-TECH Global Operations Manual (GRef 2.3), Section 2, Finance, Accounting Policy and Procedure Requirements, states in part: In addition to the Fiscal Guidelines set forth in the I-TECH Field Operations Manual, these country specific policies are implemented at I-TECH. 10. Budget Management and Reporting f. Reports that show the variance between the budget plan and the activity for each region and activity code will be generated, reviewed and approved by the budget managers and the Management Team each month.

2022-030 The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. Federal regulations require the University to monitor its subrecipients? activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single or program-specific audit. For the Global AIDS program, the Centers for Disease Control and Prevention requires foreign subrecipients to submit their audits directly to the federal government and pass-through entity within 30 days after receiving the auditor?s report or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes onto its subrecipients, the University must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a University-funded program, federal law requires the University to issue a management decision to the subrecipient within six months of the audit report?s acceptance by the federal government. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it appropriately followed up on findings and issued management decisions. We found the University did not have adequate internal controls in place to verify whether: ? Subrecipients received required audits, if necessary, and appropriate remedies were taken if audits were not filed ? Management decisions were required to be issued for subrecipients who required a single or program-specific audit We used a nonstatistical sampling method to randomly select and examine seven out of a total population of 21 subrecipients. We found the University did not adequately monitor one subrecipient (14 percent) to ensure it received a required single or program-specific audit. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Staff in the University?s Office of Sponsored Programs (OSP) used a spreadsheet to track subrecipient certifications and responses, and reviewed annual certifications from the subrecipient to monitor its audit status. However, OSP did not correctly interpret the subrecipient?s response and, therefore, did not require it to provide documentation of a single or program-specific audit. Additionally, management did not review the subrecipient?s federal assistance expenditures to detect that it required an audit and, therefore, also failed to adequately follow up to ensure any reported findings were resolved with appropriate corrective action, if required. Effect of Condition Without establishing adequate internal controls, the University cannot ensure all subrecipients that required a single or program-specific audit received one. Furthermore, the University cannot ensure it is following up on subrecipient audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitors them for effectiveness where required, the University cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the University: ? Follow policies and procedures to ensure subrecipients receive required single or program-specific audits ? Establish and follow effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations ? Follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations ? Issue a written management decision for all applicable audit findings, if necessary University?s Response The University of Washington has established internal controls to carry out a risk assessment per Uniform Guidance, 2 CFR ? 200.332, Requirements for pass-through entities, and our UW Grants Information Memorandum (GIM) 8. This involves using various factors to assess risk. Part of our process to obtain the information needed from each subrecipient is through a certification process. The certification was obtained from the subrecipient, along with additional documentation from the subrecipient, such as an audited financial statement. We made a risk assessment using our standard risk criteria. We did misinterpret the response provided from the subrecipient regarding whether it expended $750,000 or more in federal awards during a fiscal year in order to obtain a single or program-specific audit from this subrecipient. While this was not obtained and reviewed, a risk assessment using our standard criteria was performed with the subrecipient rated as a medium risk, and subject to monitoring throughout the project, per GIM 8. The monitoring at the program level occurred during the period in question. We will be improving our required communications with subrecipients to have clear questions and responses regarding whether the subrecipient expended $750,000 or more in federal awards during the fiscal year in order to obtain a single or program-specific audit, follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations, and issue a written management decision for all applicable audit findings, if necessary. Auditor?s Remarks We thank the University for its cooperation and assistance during the audit. Whether the University performed a risk assessment for the subrecipient is not being questioned. The University did not adequately monitor the subrecipient to ensure it detected whether the subrecipient was required to receive a single audit, or program-specific audit in accordance with 2 CFR ?200.332(f). There is no other mechanism for the Federal government to monitor subrecipients of the University and, because a single audit of the subrecipient was not performed, neither the federal grantor nor the University had reasonable assurance of the subrecipient?s compliance with federal award requirements. We reaffirm our finding and will follow up on the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, establishes the following applicable requirements: Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient?s cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set for the in ?200.501 Audit requirements. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c). The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 8 ? Subrecipient Monitoring, states in part: Background Additionally, per the Federal Uniform Guidance, UW must evaluate each subrecipients? risk of noncompliance with federal regulations, include specific terms and conditions in the subaward as necessary, and monitor the activities of the subrecipient through various mechanisms. These mechanisms include: Training and technical assistance to subrecipients, on-site reviews, review of audit results, increased reporting requirements and enforcement action, if necessary. University Policy UW reviews each subrecipient entity according to an entity level comprehensive risk assessment prior to the issuance of a subaward. This risk assessment includes an entity level review of their fiscal systems, past audit activity, and if required, financial statements of the entity as well as the project specific activity proposed and that the required compliance approvals are obtained. When necessary, UW imposes limitations and requirements on the subrecipient through subaward terms and conditions per Federal Uniform Guidance, Section 200.521, prior to the issuance or renewal of a subaward. UW?s subrecipient monitoring requirements are comprised, at a minimum, of the following: ? Completion of the UW?s entity level comprehensive risk assessment (Certs & Reps, Annual Audit Certification) Subrecipient Monitoring ? Entity Level Entity level monitoring consists of a combination of the following: ? Initial Subrecipient Certification Form completion and assurance by subrecipient?s authorized official ? Annual audit assurance through an annual audit certification form ? Maintenance of a subrecipient profile list, which includes information on the entity?s past audit information and certifications ? Risk assessment carried out at each annual renewal of a subaward

2022-028 The University of Washington did not establish adequate internal controls to ensure payments to contractors and subrecipients for the Global AIDS program were allowable, properly supported and within the period of performance. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. To achieve the performance goals of the program, the Seattle headquarters of I-TECH (Seattle HQ) provides funding to subrecipients and contractors. Invoices submitted by contractors directly to Seattle HQ are reviewed and approved for payment by budget managers who have delegated authority from the Principal Investigator. Invoices submitted by subrecipients are reviewed and approved for payment by a Principal Investigator. Principal Investigators are also responsible for monitoring the subrecipient?s technical progress and performance. Seattle HQ also provides funding to country offices operating within the University?s global network. The country offices incur costs associated with furnishing supplies and equipment to address the HIV/AIDS epidemic, as well as staffing resources and acquiring goods and services from contractors to carry out the objectives of the program. Payments made by country offices are approved by Country Directors and Country Representatives as delegated by the University. Under the University?s policies, country offices are reimbursed for locally incurred expenses at least monthly. An invoice, accompanied by a schedule of expenses incurred, is submitted and approved by the Country Director and then by the Director of Finance at Seattle HQ, prior to payment. Country offices also responsible for obtaining and retaining supporting documentation for costs incurred and paid on each project. Monthly, Budget Managers review and approve a Budget Activity Report (BAR) that details the expenses charged to the project for the previous month to ensure accurate posting of already approved expenses. This review is also to determine whether the work performed during the billing period reconciles to costs claimed within the contractor?s invoice so that payment may be authorized. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls to ensure payments to contractors and subrecipients of the Global AIDS program were allowable properly supported and within the period of performance. Payments to country offices We used a statistical sampling method to randomly select and examine 58 out of 1,644 transactions for country offices. Of the 58 payments examined, we identified one payment (1.7 percent) that was not approved by the Country Director and the corresponding Budget Activity Report was not approved by the Director of Finance. Payments to contractors We used a statistical sampling method to randomly select and review 58 out of 3,040 payments to contractors. We found: ? Invoices for three payments (5 percent) were not approved by a Budget Manager ? Monthly Budget Activity Reports were not approved for 12 payments (20 percent) Subrecipient reimbursements We used a statistical sampling method to randomly select and review 55 out of 438 payments to subrecipients. We found the assigned Budget Manager did not review and approve the monthly Budget Activity Reports for 52 payments (94 percent). We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Program management did not require supporting documentation for each payment to be forwarded to and reviewed by headquarters personnel prior to payment authorization. Management also did not monitor the submission of invoices and Budget Activity Reports to ensure they were approved by the responsible Budget Manager, as required. Effect of Condition Without establishing adequate internal controls, the University cannot reasonably ensure it is using federal funds for allowable purposes and that expenditures of federal funds are supported by adequate documentation. Recommendations We recommend the University: ? Improve its internal controls to ensure invoices are properly approved by Principal Investigators, as required ? Improve its internal controls to ensure Budget Mangers review and approve monthly Budget Activity Reports before authorizing payments for projects incurring reimbursement requests ? Ensure it retains supporting documentation sufficient to show costs incurred and paid by the program are allowable, and to demonstrate the required managerial reviews have occurred prior to issuing payment University?s Response In response to the findings for the Global Aids Program, we would like to clarify the following: General Clarification: The draft finding inaccurately represents the role of BARS approvals as part of the internal controls to ensure payments to country offices, contractors and subrecipients are allowable, properly supported and within the period of performance. This is not the role of the BARS review process. Compliance, Budget Manager and PI reviews are the controls that ensure allowability of payments and BARS approvals are after-the-fact validations of accurate posting of already approved expenditures. We provided edits to the Background section to reflect our process. We request in light of this that the description of condition, cause of condition and recommendation sections of this finding be updated accordingly. Payments to country offices I-TECH country offices are not contractors; the offices are an extension of the University of Washington. Your review identified one of fifty-eight samples (1.7%) did not meet the approval requirements set forth in I-TECH?s standard operating procedure. Based on the error percentage, we disagree with this finding. Payments to contractors Payments to contractors have multiple approvals. Upon receipt, individual invoices are approved by the program/budget manager either by signature or email. Invoices are then sent to the I-TECH Accounts Payable Administrator for input to the University?s procurement system, ARIBA, which requires compliance approval from the Accounts Payable Supervisor or other manager, as well as funding approval from the budget manager prior to payment. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to contractors, they are reviews of the monthly expenses posted to the budget and the program manager?s concurrence that the expenses are as expected. The exceptions noted were payments made to country offices instead of contractors. The support for approvals were provided to the State Auditors on April 26, 2023, prior to the completion of fieldwork. We therefore disagree with this finding. We also request that the finding be adjusted to omit the 20% of missing BARS approvals as this is not related to the contractor payments. Subrecipient reimbursements Each subrecipient invoice is reviewed for reasonableness, allowability and allocability by the contracts manager and approved by both budget managers and principal investigators prior to being processed for payment in ARIBA. PI approvals were provided and verified for each subrecipient selection with no omissions noted by the auditors. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to subrecipients, they are after-the-fact reviews of the monthly expenses posted to the budget, intended as documentation of the program manager?s concurrence that the expenses are posted as expected. We acknowledge the instances detailed in the finding where we were unable to produce related BARS approvals for 52 of the transactions; however, we request that the finding be adjusted as these BARS approvals are not related to subrecipient invoice review and approvals. Our record keeping process for BARS approvals was to save the emails in a folder within our Finance Team mailbox. We learned during this review that emails beyond a certain date are deleted but maintained in the MS360 file. We?ve searched for the missing BARS approvals but have not yet been able to locate them. We have since begun saving the approvals to our server to ensure we have access to the data going forward. Auditor?s Remarks The University?s I-TECH Global Operations Manual stipulates that BARs will be generated, reviewed and approved monthly by the Budget Manager and management team. This information was provided to our Office as part of the University?s overall design of internal controls over payments to contractors, subrecipients and country offices. The University responded to our Office on April 20, 2023 adding that ?BAR review is the University?s key post payment control designed to ensure charges are accurately processed, coded and allowable on the budget charged.? We interpret this response to indicate the BAR review process is a monitoring control, and the University asserted on multiple occasions this is a key internal control, which is why we tested it. On January 5, our Office notified University management in writing that the BAR review process would be tested as a key control over the cost principles and period of performance requirements for Global AIDS expenditures. We received no additional inquiry or concerns from University management regarding this internal control until the draft finding was issued on April 14. We provided the University with a final written summary of our fieldwork in this area on April 6, 2023, after fieldwork had concluded. On April 7, the Finance Director responded to our Office in writing confirming they had no further questions or concerns regarding our testing results. It was not until after the University received this finding that additional documentation supporting expenditures tested during the audit were ultimately given to our Office. The basis for this audit finding is the key internal control failure rate of BAR approvals that exceeds our established materiality threshold of five percent, and constitutes a material weakness in internal control, which under the Uniform Guidance is required to be reported as an audit finding in accordance with 2 CFR 200.516 ? Audit findings. We reaffirm our finding and will follow up on the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 02 ? Acceptance of Sponsored Program Awards and Fiscal Compliance on Sponsored Program Accounts (Budget Numbers), states in part: Responsibilities Principal Investigator ? Supervises expenditure of sponsored program funds and approves sub-recipient invoices (see GIM 8) to assure: o That funds are used only for purposes that directly relate to and benefit the activity supported in the award. o That expenditures are consistent with all special terms, conditions, or limitations that apply to expenditures under the particular grant or contract. o That expenditures do not exceed the total funds authorized for a given period under the grant or contract. GIM 07 ? Sponsored Program Subaward Administration, states in part: Principal Investigator ? Review and approve subaward invoices. GIM 08 ? Subrecipient Monitoring, states in part: Roles & Responsibilities PI / Department Responsibilities Project level monitoring of subrecipient including: o Reviews that expenses are necessary, reasonable, and allocable to the work completed and are aligned with technical progress. o Approve invoices for payment. Subrecipient Monitoring ? Project Level Subrecipient invoices are reviewed and approved in accordance with the requirements of GIM 2 in the manner and frequency stated in the subaward. The University of Washington I-TECH Global Operations Manual (GRef 2.3), Section 2, Finance, Accounting Policy and Procedure Requirements, states in part: In addition to the Fiscal Guidelines set forth in the I-TECH Field Operations Manual, these country specific policies are implemented at I-TECH. 10. Budget Management and Reporting f. Reports that show the variance between the budget plan and the activity for each region and activity code will be generated, reviewed and approved by the budget managers and the Management Team each month.

2022-030 The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. Federal regulations require the University to monitor its subrecipients? activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single or program-specific audit. For the Global AIDS program, the Centers for Disease Control and Prevention requires foreign subrecipients to submit their audits directly to the federal government and pass-through entity within 30 days after receiving the auditor?s report or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes onto its subrecipients, the University must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a University-funded program, federal law requires the University to issue a management decision to the subrecipient within six months of the audit report?s acceptance by the federal government. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it appropriately followed up on findings and issued management decisions. We found the University did not have adequate internal controls in place to verify whether: ? Subrecipients received required audits, if necessary, and appropriate remedies were taken if audits were not filed ? Management decisions were required to be issued for subrecipients who required a single or program-specific audit We used a nonstatistical sampling method to randomly select and examine seven out of a total population of 21 subrecipients. We found the University did not adequately monitor one subrecipient (14 percent) to ensure it received a required single or program-specific audit. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Staff in the University?s Office of Sponsored Programs (OSP) used a spreadsheet to track subrecipient certifications and responses, and reviewed annual certifications from the subrecipient to monitor its audit status. However, OSP did not correctly interpret the subrecipient?s response and, therefore, did not require it to provide documentation of a single or program-specific audit. Additionally, management did not review the subrecipient?s federal assistance expenditures to detect that it required an audit and, therefore, also failed to adequately follow up to ensure any reported findings were resolved with appropriate corrective action, if required. Effect of Condition Without establishing adequate internal controls, the University cannot ensure all subrecipients that required a single or program-specific audit received one. Furthermore, the University cannot ensure it is following up on subrecipient audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitors them for effectiveness where required, the University cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the University: ? Follow policies and procedures to ensure subrecipients receive required single or program-specific audits ? Establish and follow effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations ? Follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations ? Issue a written management decision for all applicable audit findings, if necessary University?s Response The University of Washington has established internal controls to carry out a risk assessment per Uniform Guidance, 2 CFR ? 200.332, Requirements for pass-through entities, and our UW Grants Information Memorandum (GIM) 8. This involves using various factors to assess risk. Part of our process to obtain the information needed from each subrecipient is through a certification process. The certification was obtained from the subrecipient, along with additional documentation from the subrecipient, such as an audited financial statement. We made a risk assessment using our standard risk criteria. We did misinterpret the response provided from the subrecipient regarding whether it expended $750,000 or more in federal awards during a fiscal year in order to obtain a single or program-specific audit from this subrecipient. While this was not obtained and reviewed, a risk assessment using our standard criteria was performed with the subrecipient rated as a medium risk, and subject to monitoring throughout the project, per GIM 8. The monitoring at the program level occurred during the period in question. We will be improving our required communications with subrecipients to have clear questions and responses regarding whether the subrecipient expended $750,000 or more in federal awards during the fiscal year in order to obtain a single or program-specific audit, follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations, and issue a written management decision for all applicable audit findings, if necessary. Auditor?s Remarks We thank the University for its cooperation and assistance during the audit. Whether the University performed a risk assessment for the subrecipient is not being questioned. The University did not adequately monitor the subrecipient to ensure it detected whether the subrecipient was required to receive a single audit, or program-specific audit in accordance with 2 CFR ?200.332(f). There is no other mechanism for the Federal government to monitor subrecipients of the University and, because a single audit of the subrecipient was not performed, neither the federal grantor nor the University had reasonable assurance of the subrecipient?s compliance with federal award requirements. We reaffirm our finding and will follow up on the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, establishes the following applicable requirements: Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient?s cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set for the in ?200.501 Audit requirements. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c). The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 8 ? Subrecipient Monitoring, states in part: Background Additionally, per the Federal Uniform Guidance, UW must evaluate each subrecipients? risk of noncompliance with federal regulations, include specific terms and conditions in the subaward as necessary, and monitor the activities of the subrecipient through various mechanisms. These mechanisms include: Training and technical assistance to subrecipients, on-site reviews, review of audit results, increased reporting requirements and enforcement action, if necessary. University Policy UW reviews each subrecipient entity according to an entity level comprehensive risk assessment prior to the issuance of a subaward. This risk assessment includes an entity level review of their fiscal systems, past audit activity, and if required, financial statements of the entity as well as the project specific activity proposed and that the required compliance approvals are obtained. When necessary, UW imposes limitations and requirements on the subrecipient through subaward terms and conditions per Federal Uniform Guidance, Section 200.521, prior to the issuance or renewal of a subaward. UW?s subrecipient monitoring requirements are comprised, at a minimum, of the following: ? Completion of the UW?s entity level comprehensive risk assessment (Certs & Reps, Annual Audit Certification) Subrecipient Monitoring ? Entity Level Entity level monitoring consists of a combination of the following: ? Initial Subrecipient Certification Form completion and assurance by subrecipient?s authorized official ? Annual audit assurance through an annual audit certification form ? Maintenance of a subrecipient profile list, which includes information on the entity?s past audit information and certifications ? Risk assessment carried out at each annual renewal of a subaward

2022-028 The University of Washington did not establish adequate internal controls to ensure payments to contractors and subrecipients for the Global AIDS program were allowable, properly supported and within the period of performance. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. To achieve the performance goals of the program, the Seattle headquarters of I-TECH (Seattle HQ) provides funding to subrecipients and contractors. Invoices submitted by contractors directly to Seattle HQ are reviewed and approved for payment by budget managers who have delegated authority from the Principal Investigator. Invoices submitted by subrecipients are reviewed and approved for payment by a Principal Investigator. Principal Investigators are also responsible for monitoring the subrecipient?s technical progress and performance. Seattle HQ also provides funding to country offices operating within the University?s global network. The country offices incur costs associated with furnishing supplies and equipment to address the HIV/AIDS epidemic, as well as staffing resources and acquiring goods and services from contractors to carry out the objectives of the program. Payments made by country offices are approved by Country Directors and Country Representatives as delegated by the University. Under the University?s policies, country offices are reimbursed for locally incurred expenses at least monthly. An invoice, accompanied by a schedule of expenses incurred, is submitted and approved by the Country Director and then by the Director of Finance at Seattle HQ, prior to payment. Country offices also responsible for obtaining and retaining supporting documentation for costs incurred and paid on each project. Monthly, Budget Managers review and approve a Budget Activity Report (BAR) that details the expenses charged to the project for the previous month to ensure accurate posting of already approved expenses. This review is also to determine whether the work performed during the billing period reconciles to costs claimed within the contractor?s invoice so that payment may be authorized. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls to ensure payments to contractors and subrecipients of the Global AIDS program were allowable properly supported and within the period of performance. Payments to country offices We used a statistical sampling method to randomly select and examine 58 out of 1,644 transactions for country offices. Of the 58 payments examined, we identified one payment (1.7 percent) that was not approved by the Country Director and the corresponding Budget Activity Report was not approved by the Director of Finance. Payments to contractors We used a statistical sampling method to randomly select and review 58 out of 3,040 payments to contractors. We found: ? Invoices for three payments (5 percent) were not approved by a Budget Manager ? Monthly Budget Activity Reports were not approved for 12 payments (20 percent) Subrecipient reimbursements We used a statistical sampling method to randomly select and review 55 out of 438 payments to subrecipients. We found the assigned Budget Manager did not review and approve the monthly Budget Activity Reports for 52 payments (94 percent). We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Program management did not require supporting documentation for each payment to be forwarded to and reviewed by headquarters personnel prior to payment authorization. Management also did not monitor the submission of invoices and Budget Activity Reports to ensure they were approved by the responsible Budget Manager, as required. Effect of Condition Without establishing adequate internal controls, the University cannot reasonably ensure it is using federal funds for allowable purposes and that expenditures of federal funds are supported by adequate documentation. Recommendations We recommend the University: ? Improve its internal controls to ensure invoices are properly approved by Principal Investigators, as required ? Improve its internal controls to ensure Budget Mangers review and approve monthly Budget Activity Reports before authorizing payments for projects incurring reimbursement requests ? Ensure it retains supporting documentation sufficient to show costs incurred and paid by the program are allowable, and to demonstrate the required managerial reviews have occurred prior to issuing payment University?s Response In response to the findings for the Global Aids Program, we would like to clarify the following: General Clarification: The draft finding inaccurately represents the role of BARS approvals as part of the internal controls to ensure payments to country offices, contractors and subrecipients are allowable, properly supported and within the period of performance. This is not the role of the BARS review process. Compliance, Budget Manager and PI reviews are the controls that ensure allowability of payments and BARS approvals are after-the-fact validations of accurate posting of already approved expenditures. We provided edits to the Background section to reflect our process. We request in light of this that the description of condition, cause of condition and recommendation sections of this finding be updated accordingly. Payments to country offices I-TECH country offices are not contractors; the offices are an extension of the University of Washington. Your review identified one of fifty-eight samples (1.7%) did not meet the approval requirements set forth in I-TECH?s standard operating procedure. Based on the error percentage, we disagree with this finding. Payments to contractors Payments to contractors have multiple approvals. Upon receipt, individual invoices are approved by the program/budget manager either by signature or email. Invoices are then sent to the I-TECH Accounts Payable Administrator for input to the University?s procurement system, ARIBA, which requires compliance approval from the Accounts Payable Supervisor or other manager, as well as funding approval from the budget manager prior to payment. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to contractors, they are reviews of the monthly expenses posted to the budget and the program manager?s concurrence that the expenses are as expected. The exceptions noted were payments made to country offices instead of contractors. The support for approvals were provided to the State Auditors on April 26, 2023, prior to the completion of fieldwork. We therefore disagree with this finding. We also request that the finding be adjusted to omit the 20% of missing BARS approvals as this is not related to the contractor payments. Subrecipient reimbursements Each subrecipient invoice is reviewed for reasonableness, allowability and allocability by the contracts manager and approved by both budget managers and principal investigators prior to being processed for payment in ARIBA. PI approvals were provided and verified for each subrecipient selection with no omissions noted by the auditors. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to subrecipients, they are after-the-fact reviews of the monthly expenses posted to the budget, intended as documentation of the program manager?s concurrence that the expenses are posted as expected. We acknowledge the instances detailed in the finding where we were unable to produce related BARS approvals for 52 of the transactions; however, we request that the finding be adjusted as these BARS approvals are not related to subrecipient invoice review and approvals. Our record keeping process for BARS approvals was to save the emails in a folder within our Finance Team mailbox. We learned during this review that emails beyond a certain date are deleted but maintained in the MS360 file. We?ve searched for the missing BARS approvals but have not yet been able to locate them. We have since begun saving the approvals to our server to ensure we have access to the data going forward. Auditor?s Remarks The University?s I-TECH Global Operations Manual stipulates that BARs will be generated, reviewed and approved monthly by the Budget Manager and management team. This information was provided to our Office as part of the University?s overall design of internal controls over payments to contractors, subrecipients and country offices. The University responded to our Office on April 20, 2023 adding that ?BAR review is the University?s key post payment control designed to ensure charges are accurately processed, coded and allowable on the budget charged.? We interpret this response to indicate the BAR review process is a monitoring control, and the University asserted on multiple occasions this is a key internal control, which is why we tested it. On January 5, our Office notified University management in writing that the BAR review process would be tested as a key control over the cost principles and period of performance requirements for Global AIDS expenditures. We received no additional inquiry or concerns from University management regarding this internal control until the draft finding was issued on April 14. We provided the University with a final written summary of our fieldwork in this area on April 6, 2023, after fieldwork had concluded. On April 7, the Finance Director responded to our Office in writing confirming they had no further questions or concerns regarding our testing results. It was not until after the University received this finding that additional documentation supporting expenditures tested during the audit were ultimately given to our Office. The basis for this audit finding is the key internal control failure rate of BAR approvals that exceeds our established materiality threshold of five percent, and constitutes a material weakness in internal control, which under the Uniform Guidance is required to be reported as an audit finding in accordance with 2 CFR 200.516 ? Audit findings. We reaffirm our finding and will follow up on the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 02 ? Acceptance of Sponsored Program Awards and Fiscal Compliance on Sponsored Program Accounts (Budget Numbers), states in part: Responsibilities Principal Investigator ? Supervises expenditure of sponsored program funds and approves sub-recipient invoices (see GIM 8) to assure: o That funds are used only for purposes that directly relate to and benefit the activity supported in the award. o That expenditures are consistent with all special terms, conditions, or limitations that apply to expenditures under the particular grant or contract. o That expenditures do not exceed the total funds authorized for a given period under the grant or contract. GIM 07 ? Sponsored Program Subaward Administration, states in part: Principal Investigator ? Review and approve subaward invoices. GIM 08 ? Subrecipient Monitoring, states in part: Roles & Responsibilities PI / Department Responsibilities Project level monitoring of subrecipient including: o Reviews that expenses are necessary, reasonable, and allocable to the work completed and are aligned with technical progress. o Approve invoices for payment. Subrecipient Monitoring ? Project Level Subrecipient invoices are reviewed and approved in accordance with the requirements of GIM 2 in the manner and frequency stated in the subaward. The University of Washington I-TECH Global Operations Manual (GRef 2.3), Section 2, Finance, Accounting Policy and Procedure Requirements, states in part: In addition to the Fiscal Guidelines set forth in the I-TECH Field Operations Manual, these country specific policies are implemented at I-TECH. 10. Budget Management and Reporting f. Reports that show the variance between the budget plan and the activity for each region and activity code will be generated, reviewed and approved by the budget managers and the Management Team each month.

2022-030 The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. Federal regulations require the University to monitor its subrecipients? activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single or program-specific audit. For the Global AIDS program, the Centers for Disease Control and Prevention requires foreign subrecipients to submit their audits directly to the federal government and pass-through entity within 30 days after receiving the auditor?s report or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes onto its subrecipients, the University must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a University-funded program, federal law requires the University to issue a management decision to the subrecipient within six months of the audit report?s acceptance by the federal government. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it appropriately followed up on findings and issued management decisions. We found the University did not have adequate internal controls in place to verify whether: ? Subrecipients received required audits, if necessary, and appropriate remedies were taken if audits were not filed ? Management decisions were required to be issued for subrecipients who required a single or program-specific audit We used a nonstatistical sampling method to randomly select and examine seven out of a total population of 21 subrecipients. We found the University did not adequately monitor one subrecipient (14 percent) to ensure it received a required single or program-specific audit. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Staff in the University?s Office of Sponsored Programs (OSP) used a spreadsheet to track subrecipient certifications and responses, and reviewed annual certifications from the subrecipient to monitor its audit status. However, OSP did not correctly interpret the subrecipient?s response and, therefore, did not require it to provide documentation of a single or program-specific audit. Additionally, management did not review the subrecipient?s federal assistance expenditures to detect that it required an audit and, therefore, also failed to adequately follow up to ensure any reported findings were resolved with appropriate corrective action, if required. Effect of Condition Without establishing adequate internal controls, the University cannot ensure all subrecipients that required a single or program-specific audit received one. Furthermore, the University cannot ensure it is following up on subrecipient audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitors them for effectiveness where required, the University cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the University: ? Follow policies and procedures to ensure subrecipients receive required single or program-specific audits ? Establish and follow effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations ? Follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations ? Issue a written management decision for all applicable audit findings, if necessary University?s Response The University of Washington has established internal controls to carry out a risk assessment per Uniform Guidance, 2 CFR ? 200.332, Requirements for pass-through entities, and our UW Grants Information Memorandum (GIM) 8. This involves using various factors to assess risk. Part of our process to obtain the information needed from each subrecipient is through a certification process. The certification was obtained from the subrecipient, along with additional documentation from the subrecipient, such as an audited financial statement. We made a risk assessment using our standard risk criteria. We did misinterpret the response provided from the subrecipient regarding whether it expended $750,000 or more in federal awards during a fiscal year in order to obtain a single or program-specific audit from this subrecipient. While this was not obtained and reviewed, a risk assessment using our standard criteria was performed with the subrecipient rated as a medium risk, and subject to monitoring throughout the project, per GIM 8. The monitoring at the program level occurred during the period in question. We will be improving our required communications with subrecipients to have clear questions and responses regarding whether the subrecipient expended $750,000 or more in federal awards during the fiscal year in order to obtain a single or program-specific audit, follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations, and issue a written management decision for all applicable audit findings, if necessary. Auditor?s Remarks We thank the University for its cooperation and assistance during the audit. Whether the University performed a risk assessment for the subrecipient is not being questioned. The University did not adequately monitor the subrecipient to ensure it detected whether the subrecipient was required to receive a single audit, or program-specific audit in accordance with 2 CFR ?200.332(f). There is no other mechanism for the Federal government to monitor subrecipients of the University and, because a single audit of the subrecipient was not performed, neither the federal grantor nor the University had reasonable assurance of the subrecipient?s compliance with federal award requirements. We reaffirm our finding and will follow up on the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, establishes the following applicable requirements: Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient?s cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set for the in ?200.501 Audit requirements. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c). The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 8 ? Subrecipient Monitoring, states in part: Background Additionally, per the Federal Uniform Guidance, UW must evaluate each subrecipients? risk of noncompliance with federal regulations, include specific terms and conditions in the subaward as necessary, and monitor the activities of the subrecipient through various mechanisms. These mechanisms include: Training and technical assistance to subrecipients, on-site reviews, review of audit results, increased reporting requirements and enforcement action, if necessary. University Policy UW reviews each subrecipient entity according to an entity level comprehensive risk assessment prior to the issuance of a subaward. This risk assessment includes an entity level review of their fiscal systems, past audit activity, and if required, financial statements of the entity as well as the project specific activity proposed and that the required compliance approvals are obtained. When necessary, UW imposes limitations and requirements on the subrecipient through subaward terms and conditions per Federal Uniform Guidance, Section 200.521, prior to the issuance or renewal of a subaward. UW?s subrecipient monitoring requirements are comprised, at a minimum, of the following: ? Completion of the UW?s entity level comprehensive risk assessment (Certs & Reps, Annual Audit Certification) Subrecipient Monitoring ? Entity Level Entity level monitoring consists of a combination of the following: ? Initial Subrecipient Certification Form completion and assurance by subrecipient?s authorized official ? Annual audit assurance through an annual audit certification form ? Maintenance of a subrecipient profile list, which includes information on the entity?s past audit information and certifications ? Risk assessment carried out at each annual renewal of a subaward

2022-028 The University of Washington did not establish adequate internal controls to ensure payments to contractors and subrecipients for the Global AIDS program were allowable, properly supported and within the period of performance. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. To achieve the performance goals of the program, the Seattle headquarters of I-TECH (Seattle HQ) provides funding to subrecipients and contractors. Invoices submitted by contractors directly to Seattle HQ are reviewed and approved for payment by budget managers who have delegated authority from the Principal Investigator. Invoices submitted by subrecipients are reviewed and approved for payment by a Principal Investigator. Principal Investigators are also responsible for monitoring the subrecipient?s technical progress and performance. Seattle HQ also provides funding to country offices operating within the University?s global network. The country offices incur costs associated with furnishing supplies and equipment to address the HIV/AIDS epidemic, as well as staffing resources and acquiring goods and services from contractors to carry out the objectives of the program. Payments made by country offices are approved by Country Directors and Country Representatives as delegated by the University. Under the University?s policies, country offices are reimbursed for locally incurred expenses at least monthly. An invoice, accompanied by a schedule of expenses incurred, is submitted and approved by the Country Director and then by the Director of Finance at Seattle HQ, prior to payment. Country offices also responsible for obtaining and retaining supporting documentation for costs incurred and paid on each project. Monthly, Budget Managers review and approve a Budget Activity Report (BAR) that details the expenses charged to the project for the previous month to ensure accurate posting of already approved expenses. This review is also to determine whether the work performed during the billing period reconciles to costs claimed within the contractor?s invoice so that payment may be authorized. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls to ensure payments to contractors and subrecipients of the Global AIDS program were allowable properly supported and within the period of performance. Payments to country offices We used a statistical sampling method to randomly select and examine 58 out of 1,644 transactions for country offices. Of the 58 payments examined, we identified one payment (1.7 percent) that was not approved by the Country Director and the corresponding Budget Activity Report was not approved by the Director of Finance. Payments to contractors We used a statistical sampling method to randomly select and review 58 out of 3,040 payments to contractors. We found: ? Invoices for three payments (5 percent) were not approved by a Budget Manager ? Monthly Budget Activity Reports were not approved for 12 payments (20 percent) Subrecipient reimbursements We used a statistical sampling method to randomly select and review 55 out of 438 payments to subrecipients. We found the assigned Budget Manager did not review and approve the monthly Budget Activity Reports for 52 payments (94 percent). We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Program management did not require supporting documentation for each payment to be forwarded to and reviewed by headquarters personnel prior to payment authorization. Management also did not monitor the submission of invoices and Budget Activity Reports to ensure they were approved by the responsible Budget Manager, as required. Effect of Condition Without establishing adequate internal controls, the University cannot reasonably ensure it is using federal funds for allowable purposes and that expenditures of federal funds are supported by adequate documentation. Recommendations We recommend the University: ? Improve its internal controls to ensure invoices are properly approved by Principal Investigators, as required ? Improve its internal controls to ensure Budget Mangers review and approve monthly Budget Activity Reports before authorizing payments for projects incurring reimbursement requests ? Ensure it retains supporting documentation sufficient to show costs incurred and paid by the program are allowable, and to demonstrate the required managerial reviews have occurred prior to issuing payment University?s Response In response to the findings for the Global Aids Program, we would like to clarify the following: General Clarification: The draft finding inaccurately represents the role of BARS approvals as part of the internal controls to ensure payments to country offices, contractors and subrecipients are allowable, properly supported and within the period of performance. This is not the role of the BARS review process. Compliance, Budget Manager and PI reviews are the controls that ensure allowability of payments and BARS approvals are after-the-fact validations of accurate posting of already approved expenditures. We provided edits to the Background section to reflect our process. We request in light of this that the description of condition, cause of condition and recommendation sections of this finding be updated accordingly. Payments to country offices I-TECH country offices are not contractors; the offices are an extension of the University of Washington. Your review identified one of fifty-eight samples (1.7%) did not meet the approval requirements set forth in I-TECH?s standard operating procedure. Based on the error percentage, we disagree with this finding. Payments to contractors Payments to contractors have multiple approvals. Upon receipt, individual invoices are approved by the program/budget manager either by signature or email. Invoices are then sent to the I-TECH Accounts Payable Administrator for input to the University?s procurement system, ARIBA, which requires compliance approval from the Accounts Payable Supervisor or other manager, as well as funding approval from the budget manager prior to payment. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to contractors, they are reviews of the monthly expenses posted to the budget and the program manager?s concurrence that the expenses are as expected. The exceptions noted were payments made to country offices instead of contractors. The support for approvals were provided to the State Auditors on April 26, 2023, prior to the completion of fieldwork. We therefore disagree with this finding. We also request that the finding be adjusted to omit the 20% of missing BARS approvals as this is not related to the contractor payments. Subrecipient reimbursements Each subrecipient invoice is reviewed for reasonableness, allowability and allocability by the contracts manager and approved by both budget managers and principal investigators prior to being processed for payment in ARIBA. PI approvals were provided and verified for each subrecipient selection with no omissions noted by the auditors. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to subrecipients, they are after-the-fact reviews of the monthly expenses posted to the budget, intended as documentation of the program manager?s concurrence that the expenses are posted as expected. We acknowledge the instances detailed in the finding where we were unable to produce related BARS approvals for 52 of the transactions; however, we request that the finding be adjusted as these BARS approvals are not related to subrecipient invoice review and approvals. Our record keeping process for BARS approvals was to save the emails in a folder within our Finance Team mailbox. We learned during this review that emails beyond a certain date are deleted but maintained in the MS360 file. We?ve searched for the missing BARS approvals but have not yet been able to locate them. We have since begun saving the approvals to our server to ensure we have access to the data going forward. Auditor?s Remarks The University?s I-TECH Global Operations Manual stipulates that BARs will be generated, reviewed and approved monthly by the Budget Manager and management team. This information was provided to our Office as part of the University?s overall design of internal controls over payments to contractors, subrecipients and country offices. The University responded to our Office on April 20, 2023 adding that ?BAR review is the University?s key post payment control designed to ensure charges are accurately processed, coded and allowable on the budget charged.? We interpret this response to indicate the BAR review process is a monitoring control, and the University asserted on multiple occasions this is a key internal control, which is why we tested it. On January 5, our Office notified University management in writing that the BAR review process would be tested as a key control over the cost principles and period of performance requirements for Global AIDS expenditures. We received no additional inquiry or concerns from University management regarding this internal control until the draft finding was issued on April 14. We provided the University with a final written summary of our fieldwork in this area on April 6, 2023, after fieldwork had concluded. On April 7, the Finance Director responded to our Office in writing confirming they had no further questions or concerns regarding our testing results. It was not until after the University received this finding that additional documentation supporting expenditures tested during the audit were ultimately given to our Office. The basis for this audit finding is the key internal control failure rate of BAR approvals that exceeds our established materiality threshold of five percent, and constitutes a material weakness in internal control, which under the Uniform Guidance is required to be reported as an audit finding in accordance with 2 CFR 200.516 ? Audit findings. We reaffirm our finding and will follow up on the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 02 ? Acceptance of Sponsored Program Awards and Fiscal Compliance on Sponsored Program Accounts (Budget Numbers), states in part: Responsibilities Principal Investigator ? Supervises expenditure of sponsored program funds and approves sub-recipient invoices (see GIM 8) to assure: o That funds are used only for purposes that directly relate to and benefit the activity supported in the award. o That expenditures are consistent with all special terms, conditions, or limitations that apply to expenditures under the particular grant or contract. o That expenditures do not exceed the total funds authorized for a given period under the grant or contract. GIM 07 ? Sponsored Program Subaward Administration, states in part: Principal Investigator ? Review and approve subaward invoices. GIM 08 ? Subrecipient Monitoring, states in part: Roles & Responsibilities PI / Department Responsibilities Project level monitoring of subrecipient including: o Reviews that expenses are necessary, reasonable, and allocable to the work completed and are aligned with technical progress. o Approve invoices for payment. Subrecipient Monitoring ? Project Level Subrecipient invoices are reviewed and approved in accordance with the requirements of GIM 2 in the manner and frequency stated in the subaward. The University of Washington I-TECH Global Operations Manual (GRef 2.3), Section 2, Finance, Accounting Policy and Procedure Requirements, states in part: In addition to the Fiscal Guidelines set forth in the I-TECH Field Operations Manual, these country specific policies are implemented at I-TECH. 10. Budget Management and Reporting f. Reports that show the variance between the budget plan and the activity for each region and activity code will be generated, reviewed and approved by the budget managers and the Management Team each month.

2022-030 The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. Federal regulations require the University to monitor its subrecipients? activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single or program-specific audit. For the Global AIDS program, the Centers for Disease Control and Prevention requires foreign subrecipients to submit their audits directly to the federal government and pass-through entity within 30 days after receiving the auditor?s report or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes onto its subrecipients, the University must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a University-funded program, federal law requires the University to issue a management decision to the subrecipient within six months of the audit report?s acceptance by the federal government. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it appropriately followed up on findings and issued management decisions. We found the University did not have adequate internal controls in place to verify whether: ? Subrecipients received required audits, if necessary, and appropriate remedies were taken if audits were not filed ? Management decisions were required to be issued for subrecipients who required a single or program-specific audit We used a nonstatistical sampling method to randomly select and examine seven out of a total population of 21 subrecipients. We found the University did not adequately monitor one subrecipient (14 percent) to ensure it received a required single or program-specific audit. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Staff in the University?s Office of Sponsored Programs (OSP) used a spreadsheet to track subrecipient certifications and responses, and reviewed annual certifications from the subrecipient to monitor its audit status. However, OSP did not correctly interpret the subrecipient?s response and, therefore, did not require it to provide documentation of a single or program-specific audit. Additionally, management did not review the subrecipient?s federal assistance expenditures to detect that it required an audit and, therefore, also failed to adequately follow up to ensure any reported findings were resolved with appropriate corrective action, if required. Effect of Condition Without establishing adequate internal controls, the University cannot ensure all subrecipients that required a single or program-specific audit received one. Furthermore, the University cannot ensure it is following up on subrecipient audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitors them for effectiveness where required, the University cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the University: ? Follow policies and procedures to ensure subrecipients receive required single or program-specific audits ? Establish and follow effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations ? Follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations ? Issue a written management decision for all applicable audit findings, if necessary University?s Response The University of Washington has established internal controls to carry out a risk assessment per Uniform Guidance, 2 CFR ? 200.332, Requirements for pass-through entities, and our UW Grants Information Memorandum (GIM) 8. This involves using various factors to assess risk. Part of our process to obtain the information needed from each subrecipient is through a certification process. The certification was obtained from the subrecipient, along with additional documentation from the subrecipient, such as an audited financial statement. We made a risk assessment using our standard risk criteria. We did misinterpret the response provided from the subrecipient regarding whether it expended $750,000 or more in federal awards during a fiscal year in order to obtain a single or program-specific audit from this subrecipient. While this was not obtained and reviewed, a risk assessment using our standard criteria was performed with the subrecipient rated as a medium risk, and subject to monitoring throughout the project, per GIM 8. The monitoring at the program level occurred during the period in question. We will be improving our required communications with subrecipients to have clear questions and responses regarding whether the subrecipient expended $750,000 or more in federal awards during the fiscal year in order to obtain a single or program-specific audit, follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations, and issue a written management decision for all applicable audit findings, if necessary. Auditor?s Remarks We thank the University for its cooperation and assistance during the audit. Whether the University performed a risk assessment for the subrecipient is not being questioned. The University did not adequately monitor the subrecipient to ensure it detected whether the subrecipient was required to receive a single audit, or program-specific audit in accordance with 2 CFR ?200.332(f). There is no other mechanism for the Federal government to monitor subrecipients of the University and, because a single audit of the subrecipient was not performed, neither the federal grantor nor the University had reasonable assurance of the subrecipient?s compliance with federal award requirements. We reaffirm our finding and will follow up on the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, establishes the following applicable requirements: Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient?s cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set for the in ?200.501 Audit requirements. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c). The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 8 ? Subrecipient Monitoring, states in part: Background Additionally, per the Federal Uniform Guidance, UW must evaluate each subrecipients? risk of noncompliance with federal regulations, include specific terms and conditions in the subaward as necessary, and monitor the activities of the subrecipient through various mechanisms. These mechanisms include: Training and technical assistance to subrecipients, on-site reviews, review of audit results, increased reporting requirements and enforcement action, if necessary. University Policy UW reviews each subrecipient entity according to an entity level comprehensive risk assessment prior to the issuance of a subaward. This risk assessment includes an entity level review of their fiscal systems, past audit activity, and if required, financial statements of the entity as well as the project specific activity proposed and that the required compliance approvals are obtained. When necessary, UW imposes limitations and requirements on the subrecipient through subaward terms and conditions per Federal Uniform Guidance, Section 200.521, prior to the issuance or renewal of a subaward. UW?s subrecipient monitoring requirements are comprised, at a minimum, of the following: ? Completion of the UW?s entity level comprehensive risk assessment (Certs & Reps, Annual Audit Certification) Subrecipient Monitoring ? Entity Level Entity level monitoring consists of a combination of the following: ? Initial Subrecipient Certification Form completion and assurance by subrecipient?s authorized official ? Annual audit assurance through an annual audit certification form ? Maintenance of a subrecipient profile list, which includes information on the entity?s past audit information and certifications ? Risk assessment carried out at each annual renewal of a subaward

2022-028 The University of Washington did not establish adequate internal controls to ensure payments to contractors and subrecipients for the Global AIDS program were allowable, properly supported and within the period of performance. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. To achieve the performance goals of the program, the Seattle headquarters of I-TECH (Seattle HQ) provides funding to subrecipients and contractors. Invoices submitted by contractors directly to Seattle HQ are reviewed and approved for payment by budget managers who have delegated authority from the Principal Investigator. Invoices submitted by subrecipients are reviewed and approved for payment by a Principal Investigator. Principal Investigators are also responsible for monitoring the subrecipient?s technical progress and performance. Seattle HQ also provides funding to country offices operating within the University?s global network. The country offices incur costs associated with furnishing supplies and equipment to address the HIV/AIDS epidemic, as well as staffing resources and acquiring goods and services from contractors to carry out the objectives of the program. Payments made by country offices are approved by Country Directors and Country Representatives as delegated by the University. Under the University?s policies, country offices are reimbursed for locally incurred expenses at least monthly. An invoice, accompanied by a schedule of expenses incurred, is submitted and approved by the Country Director and then by the Director of Finance at Seattle HQ, prior to payment. Country offices also responsible for obtaining and retaining supporting documentation for costs incurred and paid on each project. Monthly, Budget Managers review and approve a Budget Activity Report (BAR) that details the expenses charged to the project for the previous month to ensure accurate posting of already approved expenses. This review is also to determine whether the work performed during the billing period reconciles to costs claimed within the contractor?s invoice so that payment may be authorized. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls to ensure payments to contractors and subrecipients of the Global AIDS program were allowable properly supported and within the period of performance. Payments to country offices We used a statistical sampling method to randomly select and examine 58 out of 1,644 transactions for country offices. Of the 58 payments examined, we identified one payment (1.7 percent) that was not approved by the Country Director and the corresponding Budget Activity Report was not approved by the Director of Finance. Payments to contractors We used a statistical sampling method to randomly select and review 58 out of 3,040 payments to contractors. We found: ? Invoices for three payments (5 percent) were not approved by a Budget Manager ? Monthly Budget Activity Reports were not approved for 12 payments (20 percent) Subrecipient reimbursements We used a statistical sampling method to randomly select and review 55 out of 438 payments to subrecipients. We found the assigned Budget Manager did not review and approve the monthly Budget Activity Reports for 52 payments (94 percent). We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Program management did not require supporting documentation for each payment to be forwarded to and reviewed by headquarters personnel prior to payment authorization. Management also did not monitor the submission of invoices and Budget Activity Reports to ensure they were approved by the responsible Budget Manager, as required. Effect of Condition Without establishing adequate internal controls, the University cannot reasonably ensure it is using federal funds for allowable purposes and that expenditures of federal funds are supported by adequate documentation. Recommendations We recommend the University: ? Improve its internal controls to ensure invoices are properly approved by Principal Investigators, as required ? Improve its internal controls to ensure Budget Mangers review and approve monthly Budget Activity Reports before authorizing payments for projects incurring reimbursement requests ? Ensure it retains supporting documentation sufficient to show costs incurred and paid by the program are allowable, and to demonstrate the required managerial reviews have occurred prior to issuing payment University?s Response In response to the findings for the Global Aids Program, we would like to clarify the following: General Clarification: The draft finding inaccurately represents the role of BARS approvals as part of the internal controls to ensure payments to country offices, contractors and subrecipients are allowable, properly supported and within the period of performance. This is not the role of the BARS review process. Compliance, Budget Manager and PI reviews are the controls that ensure allowability of payments and BARS approvals are after-the-fact validations of accurate posting of already approved expenditures. We provided edits to the Background section to reflect our process. We request in light of this that the description of condition, cause of condition and recommendation sections of this finding be updated accordingly. Payments to country offices I-TECH country offices are not contractors; the offices are an extension of the University of Washington. Your review identified one of fifty-eight samples (1.7%) did not meet the approval requirements set forth in I-TECH?s standard operating procedure. Based on the error percentage, we disagree with this finding. Payments to contractors Payments to contractors have multiple approvals. Upon receipt, individual invoices are approved by the program/budget manager either by signature or email. Invoices are then sent to the I-TECH Accounts Payable Administrator for input to the University?s procurement system, ARIBA, which requires compliance approval from the Accounts Payable Supervisor or other manager, as well as funding approval from the budget manager prior to payment. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to contractors, they are reviews of the monthly expenses posted to the budget and the program manager?s concurrence that the expenses are as expected. The exceptions noted were payments made to country offices instead of contractors. The support for approvals were provided to the State Auditors on April 26, 2023, prior to the completion of fieldwork. We therefore disagree with this finding. We also request that the finding be adjusted to omit the 20% of missing BARS approvals as this is not related to the contractor payments. Subrecipient reimbursements Each subrecipient invoice is reviewed for reasonableness, allowability and allocability by the contracts manager and approved by both budget managers and principal investigators prior to being processed for payment in ARIBA. PI approvals were provided and verified for each subrecipient selection with no omissions noted by the auditors. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to subrecipients, they are after-the-fact reviews of the monthly expenses posted to the budget, intended as documentation of the program manager?s concurrence that the expenses are posted as expected. We acknowledge the instances detailed in the finding where we were unable to produce related BARS approvals for 52 of the transactions; however, we request that the finding be adjusted as these BARS approvals are not related to subrecipient invoice review and approvals. Our record keeping process for BARS approvals was to save the emails in a folder within our Finance Team mailbox. We learned during this review that emails beyond a certain date are deleted but maintained in the MS360 file. We?ve searched for the missing BARS approvals but have not yet been able to locate them. We have since begun saving the approvals to our server to ensure we have access to the data going forward. Auditor?s Remarks The University?s I-TECH Global Operations Manual stipulates that BARs will be generated, reviewed and approved monthly by the Budget Manager and management team. This information was provided to our Office as part of the University?s overall design of internal controls over payments to contractors, subrecipients and country offices. The University responded to our Office on April 20, 2023 adding that ?BAR review is the University?s key post payment control designed to ensure charges are accurately processed, coded and allowable on the budget charged.? We interpret this response to indicate the BAR review process is a monitoring control, and the University asserted on multiple occasions this is a key internal control, which is why we tested it. On January 5, our Office notified University management in writing that the BAR review process would be tested as a key control over the cost principles and period of performance requirements for Global AIDS expenditures. We received no additional inquiry or concerns from University management regarding this internal control until the draft finding was issued on April 14. We provided the University with a final written summary of our fieldwork in this area on April 6, 2023, after fieldwork had concluded. On April 7, the Finance Director responded to our Office in writing confirming they had no further questions or concerns regarding our testing results. It was not until after the University received this finding that additional documentation supporting expenditures tested during the audit were ultimately given to our Office. The basis for this audit finding is the key internal control failure rate of BAR approvals that exceeds our established materiality threshold of five percent, and constitutes a material weakness in internal control, which under the Uniform Guidance is required to be reported as an audit finding in accordance with 2 CFR 200.516 ? Audit findings. We reaffirm our finding and will follow up on the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 02 ? Acceptance of Sponsored Program Awards and Fiscal Compliance on Sponsored Program Accounts (Budget Numbers), states in part: Responsibilities Principal Investigator ? Supervises expenditure of sponsored program funds and approves sub-recipient invoices (see GIM 8) to assure: o That funds are used only for purposes that directly relate to and benefit the activity supported in the award. o That expenditures are consistent with all special terms, conditions, or limitations that apply to expenditures under the particular grant or contract. o That expenditures do not exceed the total funds authorized for a given period under the grant or contract. GIM 07 ? Sponsored Program Subaward Administration, states in part: Principal Investigator ? Review and approve subaward invoices. GIM 08 ? Subrecipient Monitoring, states in part: Roles & Responsibilities PI / Department Responsibilities Project level monitoring of subrecipient including: o Reviews that expenses are necessary, reasonable, and allocable to the work completed and are aligned with technical progress. o Approve invoices for payment. Subrecipient Monitoring ? Project Level Subrecipient invoices are reviewed and approved in accordance with the requirements of GIM 2 in the manner and frequency stated in the subaward. The University of Washington I-TECH Global Operations Manual (GRef 2.3), Section 2, Finance, Accounting Policy and Procedure Requirements, states in part: In addition to the Fiscal Guidelines set forth in the I-TECH Field Operations Manual, these country specific policies are implemented at I-TECH. 10. Budget Management and Reporting f. Reports that show the variance between the budget plan and the activity for each region and activity code will be generated, reviewed and approved by the budget managers and the Management Team each month.

2022-030 The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. Federal regulations require the University to monitor its subrecipients? activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single or program-specific audit. For the Global AIDS program, the Centers for Disease Control and Prevention requires foreign subrecipients to submit their audits directly to the federal government and pass-through entity within 30 days after receiving the auditor?s report or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes onto its subrecipients, the University must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a University-funded program, federal law requires the University to issue a management decision to the subrecipient within six months of the audit report?s acceptance by the federal government. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it appropriately followed up on findings and issued management decisions. We found the University did not have adequate internal controls in place to verify whether: ? Subrecipients received required audits, if necessary, and appropriate remedies were taken if audits were not filed ? Management decisions were required to be issued for subrecipients who required a single or program-specific audit We used a nonstatistical sampling method to randomly select and examine seven out of a total population of 21 subrecipients. We found the University did not adequately monitor one subrecipient (14 percent) to ensure it received a required single or program-specific audit. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Staff in the University?s Office of Sponsored Programs (OSP) used a spreadsheet to track subrecipient certifications and responses, and reviewed annual certifications from the subrecipient to monitor its audit status. However, OSP did not correctly interpret the subrecipient?s response and, therefore, did not require it to provide documentation of a single or program-specific audit. Additionally, management did not review the subrecipient?s federal assistance expenditures to detect that it required an audit and, therefore, also failed to adequately follow up to ensure any reported findings were resolved with appropriate corrective action, if required. Effect of Condition Without establishing adequate internal controls, the University cannot ensure all subrecipients that required a single or program-specific audit received one. Furthermore, the University cannot ensure it is following up on subrecipient audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitors them for effectiveness where required, the University cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the University: ? Follow policies and procedures to ensure subrecipients receive required single or program-specific audits ? Establish and follow effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations ? Follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations ? Issue a written management decision for all applicable audit findings, if necessary University?s Response The University of Washington has established internal controls to carry out a risk assessment per Uniform Guidance, 2 CFR ? 200.332, Requirements for pass-through entities, and our UW Grants Information Memorandum (GIM) 8. This involves using various factors to assess risk. Part of our process to obtain the information needed from each subrecipient is through a certification process. The certification was obtained from the subrecipient, along with additional documentation from the subrecipient, such as an audited financial statement. We made a risk assessment using our standard risk criteria. We did misinterpret the response provided from the subrecipient regarding whether it expended $750,000 or more in federal awards during a fiscal year in order to obtain a single or program-specific audit from this subrecipient. While this was not obtained and reviewed, a risk assessment using our standard criteria was performed with the subrecipient rated as a medium risk, and subject to monitoring throughout the project, per GIM 8. The monitoring at the program level occurred during the period in question. We will be improving our required communications with subrecipients to have clear questions and responses regarding whether the subrecipient expended $750,000 or more in federal awards during the fiscal year in order to obtain a single or program-specific audit, follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations, and issue a written management decision for all applicable audit findings, if necessary. Auditor?s Remarks We thank the University for its cooperation and assistance during the audit. Whether the University performed a risk assessment for the subrecipient is not being questioned. The University did not adequately monitor the subrecipient to ensure it detected whether the subrecipient was required to receive a single audit, or program-specific audit in accordance with 2 CFR ?200.332(f). There is no other mechanism for the Federal government to monitor subrecipients of the University and, because a single audit of the subrecipient was not performed, neither the federal grantor nor the University had reasonable assurance of the subrecipient?s compliance with federal award requirements. We reaffirm our finding and will follow up on the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, establishes the following applicable requirements: Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient?s cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set for the in ?200.501 Audit requirements. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c). The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 8 ? Subrecipient Monitoring, states in part: Background Additionally, per the Federal Uniform Guidance, UW must evaluate each subrecipients? risk of noncompliance with federal regulations, include specific terms and conditions in the subaward as necessary, and monitor the activities of the subrecipient through various mechanisms. These mechanisms include: Training and technical assistance to subrecipients, on-site reviews, review of audit results, increased reporting requirements and enforcement action, if necessary. University Policy UW reviews each subrecipient entity according to an entity level comprehensive risk assessment prior to the issuance of a subaward. This risk assessment includes an entity level review of their fiscal systems, past audit activity, and if required, financial statements of the entity as well as the project specific activity proposed and that the required compliance approvals are obtained. When necessary, UW imposes limitations and requirements on the subrecipient through subaward terms and conditions per Federal Uniform Guidance, Section 200.521, prior to the issuance or renewal of a subaward. UW?s subrecipient monitoring requirements are comprised, at a minimum, of the following: ? Completion of the UW?s entity level comprehensive risk assessment (Certs & Reps, Annual Audit Certification) Subrecipient Monitoring ? Entity Level Entity level monitoring consists of a combination of the following: ? Initial Subrecipient Certification Form completion and assurance by subrecipient?s authorized official ? Annual audit assurance through an annual audit certification form ? Maintenance of a subrecipient profile list, which includes information on the entity?s past audit information and certifications ? Risk assessment carried out at each annual renewal of a subaward

2022-028 The University of Washington did not establish adequate internal controls to ensure payments to contractors and subrecipients for the Global AIDS program were allowable, properly supported and within the period of performance. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. To achieve the performance goals of the program, the Seattle headquarters of I-TECH (Seattle HQ) provides funding to subrecipients and contractors. Invoices submitted by contractors directly to Seattle HQ are reviewed and approved for payment by budget managers who have delegated authority from the Principal Investigator. Invoices submitted by subrecipients are reviewed and approved for payment by a Principal Investigator. Principal Investigators are also responsible for monitoring the subrecipient?s technical progress and performance. Seattle HQ also provides funding to country offices operating within the University?s global network. The country offices incur costs associated with furnishing supplies and equipment to address the HIV/AIDS epidemic, as well as staffing resources and acquiring goods and services from contractors to carry out the objectives of the program. Payments made by country offices are approved by Country Directors and Country Representatives as delegated by the University. Under the University?s policies, country offices are reimbursed for locally incurred expenses at least monthly. An invoice, accompanied by a schedule of expenses incurred, is submitted and approved by the Country Director and then by the Director of Finance at Seattle HQ, prior to payment. Country offices also responsible for obtaining and retaining supporting documentation for costs incurred and paid on each project. Monthly, Budget Managers review and approve a Budget Activity Report (BAR) that details the expenses charged to the project for the previous month to ensure accurate posting of already approved expenses. This review is also to determine whether the work performed during the billing period reconciles to costs claimed within the contractor?s invoice so that payment may be authorized. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls to ensure payments to contractors and subrecipients of the Global AIDS program were allowable properly supported and within the period of performance. Payments to country offices We used a statistical sampling method to randomly select and examine 58 out of 1,644 transactions for country offices. Of the 58 payments examined, we identified one payment (1.7 percent) that was not approved by the Country Director and the corresponding Budget Activity Report was not approved by the Director of Finance. Payments to contractors We used a statistical sampling method to randomly select and review 58 out of 3,040 payments to contractors. We found: ? Invoices for three payments (5 percent) were not approved by a Budget Manager ? Monthly Budget Activity Reports were not approved for 12 payments (20 percent) Subrecipient reimbursements We used a statistical sampling method to randomly select and review 55 out of 438 payments to subrecipients. We found the assigned Budget Manager did not review and approve the monthly Budget Activity Reports for 52 payments (94 percent). We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Program management did not require supporting documentation for each payment to be forwarded to and reviewed by headquarters personnel prior to payment authorization. Management also did not monitor the submission of invoices and Budget Activity Reports to ensure they were approved by the responsible Budget Manager, as required. Effect of Condition Without establishing adequate internal controls, the University cannot reasonably ensure it is using federal funds for allowable purposes and that expenditures of federal funds are supported by adequate documentation. Recommendations We recommend the University: ? Improve its internal controls to ensure invoices are properly approved by Principal Investigators, as required ? Improve its internal controls to ensure Budget Mangers review and approve monthly Budget Activity Reports before authorizing payments for projects incurring reimbursement requests ? Ensure it retains supporting documentation sufficient to show costs incurred and paid by the program are allowable, and to demonstrate the required managerial reviews have occurred prior to issuing payment University?s Response In response to the findings for the Global Aids Program, we would like to clarify the following: General Clarification: The draft finding inaccurately represents the role of BARS approvals as part of the internal controls to ensure payments to country offices, contractors and subrecipients are allowable, properly supported and within the period of performance. This is not the role of the BARS review process. Compliance, Budget Manager and PI reviews are the controls that ensure allowability of payments and BARS approvals are after-the-fact validations of accurate posting of already approved expenditures. We provided edits to the Background section to reflect our process. We request in light of this that the description of condition, cause of condition and recommendation sections of this finding be updated accordingly. Payments to country offices I-TECH country offices are not contractors; the offices are an extension of the University of Washington. Your review identified one of fifty-eight samples (1.7%) did not meet the approval requirements set forth in I-TECH?s standard operating procedure. Based on the error percentage, we disagree with this finding. Payments to contractors Payments to contractors have multiple approvals. Upon receipt, individual invoices are approved by the program/budget manager either by signature or email. Invoices are then sent to the I-TECH Accounts Payable Administrator for input to the University?s procurement system, ARIBA, which requires compliance approval from the Accounts Payable Supervisor or other manager, as well as funding approval from the budget manager prior to payment. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to contractors, they are reviews of the monthly expenses posted to the budget and the program manager?s concurrence that the expenses are as expected. The exceptions noted were payments made to country offices instead of contractors. The support for approvals were provided to the State Auditors on April 26, 2023, prior to the completion of fieldwork. We therefore disagree with this finding. We also request that the finding be adjusted to omit the 20% of missing BARS approvals as this is not related to the contractor payments. Subrecipient reimbursements Each subrecipient invoice is reviewed for reasonableness, allowability and allocability by the contracts manager and approved by both budget managers and principal investigators prior to being processed for payment in ARIBA. PI approvals were provided and verified for each subrecipient selection with no omissions noted by the auditors. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to subrecipients, they are after-the-fact reviews of the monthly expenses posted to the budget, intended as documentation of the program manager?s concurrence that the expenses are posted as expected. We acknowledge the instances detailed in the finding where we were unable to produce related BARS approvals for 52 of the transactions; however, we request that the finding be adjusted as these BARS approvals are not related to subrecipient invoice review and approvals. Our record keeping process for BARS approvals was to save the emails in a folder within our Finance Team mailbox. We learned during this review that emails beyond a certain date are deleted but maintained in the MS360 file. We?ve searched for the missing BARS approvals but have not yet been able to locate them. We have since begun saving the approvals to our server to ensure we have access to the data going forward. Auditor?s Remarks The University?s I-TECH Global Operations Manual stipulates that BARs will be generated, reviewed and approved monthly by the Budget Manager and management team. This information was provided to our Office as part of the University?s overall design of internal controls over payments to contractors, subrecipients and country offices. The University responded to our Office on April 20, 2023 adding that ?BAR review is the University?s key post payment control designed to ensure charges are accurately processed, coded and allowable on the budget charged.? We interpret this response to indicate the BAR review process is a monitoring control, and the University asserted on multiple occasions this is a key internal control, which is why we tested it. On January 5, our Office notified University management in writing that the BAR review process would be tested as a key control over the cost principles and period of performance requirements for Global AIDS expenditures. We received no additional inquiry or concerns from University management regarding this internal control until the draft finding was issued on April 14. We provided the University with a final written summary of our fieldwork in this area on April 6, 2023, after fieldwork had concluded. On April 7, the Finance Director responded to our Office in writing confirming they had no further questions or concerns regarding our testing results. It was not until after the University received this finding that additional documentation supporting expenditures tested during the audit were ultimately given to our Office. The basis for this audit finding is the key internal control failure rate of BAR approvals that exceeds our established materiality threshold of five percent, and constitutes a material weakness in internal control, which under the Uniform Guidance is required to be reported as an audit finding in accordance with 2 CFR 200.516 ? Audit findings. We reaffirm our finding and will follow up on the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 02 ? Acceptance of Sponsored Program Awards and Fiscal Compliance on Sponsored Program Accounts (Budget Numbers), states in part: Responsibilities Principal Investigator ? Supervises expenditure of sponsored program funds and approves sub-recipient invoices (see GIM 8) to assure: o That funds are used only for purposes that directly relate to and benefit the activity supported in the award. o That expenditures are consistent with all special terms, conditions, or limitations that apply to expenditures under the particular grant or contract. o That expenditures do not exceed the total funds authorized for a given period under the grant or contract. GIM 07 ? Sponsored Program Subaward Administration, states in part: Principal Investigator ? Review and approve subaward invoices. GIM 08 ? Subrecipient Monitoring, states in part: Roles & Responsibilities PI / Department Responsibilities Project level monitoring of subrecipient including: o Reviews that expenses are necessary, reasonable, and allocable to the work completed and are aligned with technical progress. o Approve invoices for payment. Subrecipient Monitoring ? Project Level Subrecipient invoices are reviewed and approved in accordance with the requirements of GIM 2 in the manner and frequency stated in the subaward. The University of Washington I-TECH Global Operations Manual (GRef 2.3), Section 2, Finance, Accounting Policy and Procedure Requirements, states in part: In addition to the Fiscal Guidelines set forth in the I-TECH Field Operations Manual, these country specific policies are implemented at I-TECH. 10. Budget Management and Reporting f. Reports that show the variance between the budget plan and the activity for each region and activity code will be generated, reviewed and approved by the budget managers and the Management Team each month.

2022-030 The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. Federal regulations require the University to monitor its subrecipients? activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single or program-specific audit. For the Global AIDS program, the Centers for Disease Control and Prevention requires foreign subrecipients to submit their audits directly to the federal government and pass-through entity within 30 days after receiving the auditor?s report or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes onto its subrecipients, the University must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a University-funded program, federal law requires the University to issue a management decision to the subrecipient within six months of the audit report?s acceptance by the federal government. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it appropriately followed up on findings and issued management decisions. We found the University did not have adequate internal controls in place to verify whether: ? Subrecipients received required audits, if necessary, and appropriate remedies were taken if audits were not filed ? Management decisions were required to be issued for subrecipients who required a single or program-specific audit We used a nonstatistical sampling method to randomly select and examine seven out of a total population of 21 subrecipients. We found the University did not adequately monitor one subrecipient (14 percent) to ensure it received a required single or program-specific audit. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Staff in the University?s Office of Sponsored Programs (OSP) used a spreadsheet to track subrecipient certifications and responses, and reviewed annual certifications from the subrecipient to monitor its audit status. However, OSP did not correctly interpret the subrecipient?s response and, therefore, did not require it to provide documentation of a single or program-specific audit. Additionally, management did not review the subrecipient?s federal assistance expenditures to detect that it required an audit and, therefore, also failed to adequately follow up to ensure any reported findings were resolved with appropriate corrective action, if required. Effect of Condition Without establishing adequate internal controls, the University cannot ensure all subrecipients that required a single or program-specific audit received one. Furthermore, the University cannot ensure it is following up on subrecipient audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitors them for effectiveness where required, the University cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the University: ? Follow policies and procedures to ensure subrecipients receive required single or program-specific audits ? Establish and follow effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations ? Follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations ? Issue a written management decision for all applicable audit findings, if necessary University?s Response The University of Washington has established internal controls to carry out a risk assessment per Uniform Guidance, 2 CFR ? 200.332, Requirements for pass-through entities, and our UW Grants Information Memorandum (GIM) 8. This involves using various factors to assess risk. Part of our process to obtain the information needed from each subrecipient is through a certification process. The certification was obtained from the subrecipient, along with additional documentation from the subrecipient, such as an audited financial statement. We made a risk assessment using our standard risk criteria. We did misinterpret the response provided from the subrecipient regarding whether it expended $750,000 or more in federal awards during a fiscal year in order to obtain a single or program-specific audit from this subrecipient. While this was not obtained and reviewed, a risk assessment using our standard criteria was performed with the subrecipient rated as a medium risk, and subject to monitoring throughout the project, per GIM 8. The monitoring at the program level occurred during the period in question. We will be improving our required communications with subrecipients to have clear questions and responses regarding whether the subrecipient expended $750,000 or more in federal awards during the fiscal year in order to obtain a single or program-specific audit, follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations, and issue a written management decision for all applicable audit findings, if necessary. Auditor?s Remarks We thank the University for its cooperation and assistance during the audit. Whether the University performed a risk assessment for the subrecipient is not being questioned. The University did not adequately monitor the subrecipient to ensure it detected whether the subrecipient was required to receive a single audit, or program-specific audit in accordance with 2 CFR ?200.332(f). There is no other mechanism for the Federal government to monitor subrecipients of the University and, because a single audit of the subrecipient was not performed, neither the federal grantor nor the University had reasonable assurance of the subrecipient?s compliance with federal award requirements. We reaffirm our finding and will follow up on the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, establishes the following applicable requirements: Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient?s cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set for the in ?200.501 Audit requirements. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c). The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 8 ? Subrecipient Monitoring, states in part: Background Additionally, per the Federal Uniform Guidance, UW must evaluate each subrecipients? risk of noncompliance with federal regulations, include specific terms and conditions in the subaward as necessary, and monitor the activities of the subrecipient through various mechanisms. These mechanisms include: Training and technical assistance to subrecipients, on-site reviews, review of audit results, increased reporting requirements and enforcement action, if necessary. University Policy UW reviews each subrecipient entity according to an entity level comprehensive risk assessment prior to the issuance of a subaward. This risk assessment includes an entity level review of their fiscal systems, past audit activity, and if required, financial statements of the entity as well as the project specific activity proposed and that the required compliance approvals are obtained. When necessary, UW imposes limitations and requirements on the subrecipient through subaward terms and conditions per Federal Uniform Guidance, Section 200.521, prior to the issuance or renewal of a subaward. UW?s subrecipient monitoring requirements are comprised, at a minimum, of the following: ? Completion of the UW?s entity level comprehensive risk assessment (Certs & Reps, Annual Audit Certification) Subrecipient Monitoring ? Entity Level Entity level monitoring consists of a combination of the following: ? Initial Subrecipient Certification Form completion and assurance by subrecipient?s authorized official ? Annual audit assurance through an annual audit certification form ? Maintenance of a subrecipient profile list, which includes information on the entity?s past audit information and certifications ? Risk assessment carried out at each annual renewal of a subaward

2022-028 The University of Washington did not establish adequate internal controls to ensure payments to contractors and subrecipients for the Global AIDS program were allowable, properly supported and within the period of performance. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. To achieve the performance goals of the program, the Seattle headquarters of I-TECH (Seattle HQ) provides funding to subrecipients and contractors. Invoices submitted by contractors directly to Seattle HQ are reviewed and approved for payment by budget managers who have delegated authority from the Principal Investigator. Invoices submitted by subrecipients are reviewed and approved for payment by a Principal Investigator. Principal Investigators are also responsible for monitoring the subrecipient?s technical progress and performance. Seattle HQ also provides funding to country offices operating within the University?s global network. The country offices incur costs associated with furnishing supplies and equipment to address the HIV/AIDS epidemic, as well as staffing resources and acquiring goods and services from contractors to carry out the objectives of the program. Payments made by country offices are approved by Country Directors and Country Representatives as delegated by the University. Under the University?s policies, country offices are reimbursed for locally incurred expenses at least monthly. An invoice, accompanied by a schedule of expenses incurred, is submitted and approved by the Country Director and then by the Director of Finance at Seattle HQ, prior to payment. Country offices also responsible for obtaining and retaining supporting documentation for costs incurred and paid on each project. Monthly, Budget Managers review and approve a Budget Activity Report (BAR) that details the expenses charged to the project for the previous month to ensure accurate posting of already approved expenses. This review is also to determine whether the work performed during the billing period reconciles to costs claimed within the contractor?s invoice so that payment may be authorized. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls to ensure payments to contractors and subrecipients of the Global AIDS program were allowable properly supported and within the period of performance. Payments to country offices We used a statistical sampling method to randomly select and examine 58 out of 1,644 transactions for country offices. Of the 58 payments examined, we identified one payment (1.7 percent) that was not approved by the Country Director and the corresponding Budget Activity Report was not approved by the Director of Finance. Payments to contractors We used a statistical sampling method to randomly select and review 58 out of 3,040 payments to contractors. We found: ? Invoices for three payments (5 percent) were not approved by a Budget Manager ? Monthly Budget Activity Reports were not approved for 12 payments (20 percent) Subrecipient reimbursements We used a statistical sampling method to randomly select and review 55 out of 438 payments to subrecipients. We found the assigned Budget Manager did not review and approve the monthly Budget Activity Reports for 52 payments (94 percent). We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Program management did not require supporting documentation for each payment to be forwarded to and reviewed by headquarters personnel prior to payment authorization. Management also did not monitor the submission of invoices and Budget Activity Reports to ensure they were approved by the responsible Budget Manager, as required. Effect of Condition Without establishing adequate internal controls, the University cannot reasonably ensure it is using federal funds for allowable purposes and that expenditures of federal funds are supported by adequate documentation. Recommendations We recommend the University: ? Improve its internal controls to ensure invoices are properly approved by Principal Investigators, as required ? Improve its internal controls to ensure Budget Mangers review and approve monthly Budget Activity Reports before authorizing payments for projects incurring reimbursement requests ? Ensure it retains supporting documentation sufficient to show costs incurred and paid by the program are allowable, and to demonstrate the required managerial reviews have occurred prior to issuing payment University?s Response In response to the findings for the Global Aids Program, we would like to clarify the following: General Clarification: The draft finding inaccurately represents the role of BARS approvals as part of the internal controls to ensure payments to country offices, contractors and subrecipients are allowable, properly supported and within the period of performance. This is not the role of the BARS review process. Compliance, Budget Manager and PI reviews are the controls that ensure allowability of payments and BARS approvals are after-the-fact validations of accurate posting of already approved expenditures. We provided edits to the Background section to reflect our process. We request in light of this that the description of condition, cause of condition and recommendation sections of this finding be updated accordingly. Payments to country offices I-TECH country offices are not contractors; the offices are an extension of the University of Washington. Your review identified one of fifty-eight samples (1.7%) did not meet the approval requirements set forth in I-TECH?s standard operating procedure. Based on the error percentage, we disagree with this finding. Payments to contractors Payments to contractors have multiple approvals. Upon receipt, individual invoices are approved by the program/budget manager either by signature or email. Invoices are then sent to the I-TECH Accounts Payable Administrator for input to the University?s procurement system, ARIBA, which requires compliance approval from the Accounts Payable Supervisor or other manager, as well as funding approval from the budget manager prior to payment. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to contractors, they are reviews of the monthly expenses posted to the budget and the program manager?s concurrence that the expenses are as expected. The exceptions noted were payments made to country offices instead of contractors. The support for approvals were provided to the State Auditors on April 26, 2023, prior to the completion of fieldwork. We therefore disagree with this finding. We also request that the finding be adjusted to omit the 20% of missing BARS approvals as this is not related to the contractor payments. Subrecipient reimbursements Each subrecipient invoice is reviewed for reasonableness, allowability and allocability by the contracts manager and approved by both budget managers and principal investigators prior to being processed for payment in ARIBA. PI approvals were provided and verified for each subrecipient selection with no omissions noted by the auditors. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to subrecipients, they are after-the-fact reviews of the monthly expenses posted to the budget, intended as documentation of the program manager?s concurrence that the expenses are posted as expected. We acknowledge the instances detailed in the finding where we were unable to produce related BARS approvals for 52 of the transactions; however, we request that the finding be adjusted as these BARS approvals are not related to subrecipient invoice review and approvals. Our record keeping process for BARS approvals was to save the emails in a folder within our Finance Team mailbox. We learned during this review that emails beyond a certain date are deleted but maintained in the MS360 file. We?ve searched for the missing BARS approvals but have not yet been able to locate them. We have since begun saving the approvals to our server to ensure we have access to the data going forward. Auditor?s Remarks The University?s I-TECH Global Operations Manual stipulates that BARs will be generated, reviewed and approved monthly by the Budget Manager and management team. This information was provided to our Office as part of the University?s overall design of internal controls over payments to contractors, subrecipients and country offices. The University responded to our Office on April 20, 2023 adding that ?BAR review is the University?s key post payment control designed to ensure charges are accurately processed, coded and allowable on the budget charged.? We interpret this response to indicate the BAR review process is a monitoring control, and the University asserted on multiple occasions this is a key internal control, which is why we tested it. On January 5, our Office notified University management in writing that the BAR review process would be tested as a key control over the cost principles and period of performance requirements for Global AIDS expenditures. We received no additional inquiry or concerns from University management regarding this internal control until the draft finding was issued on April 14. We provided the University with a final written summary of our fieldwork in this area on April 6, 2023, after fieldwork had concluded. On April 7, the Finance Director responded to our Office in writing confirming they had no further questions or concerns regarding our testing results. It was not until after the University received this finding that additional documentation supporting expenditures tested during the audit were ultimately given to our Office. The basis for this audit finding is the key internal control failure rate of BAR approvals that exceeds our established materiality threshold of five percent, and constitutes a material weakness in internal control, which under the Uniform Guidance is required to be reported as an audit finding in accordance with 2 CFR 200.516 ? Audit findings. We reaffirm our finding and will follow up on the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 02 ? Acceptance of Sponsored Program Awards and Fiscal Compliance on Sponsored Program Accounts (Budget Numbers), states in part: Responsibilities Principal Investigator ? Supervises expenditure of sponsored program funds and approves sub-recipient invoices (see GIM 8) to assure: o That funds are used only for purposes that directly relate to and benefit the activity supported in the award. o That expenditures are consistent with all special terms, conditions, or limitations that apply to expenditures under the particular grant or contract. o That expenditures do not exceed the total funds authorized for a given period under the grant or contract. GIM 07 ? Sponsored Program Subaward Administration, states in part: Principal Investigator ? Review and approve subaward invoices. GIM 08 ? Subrecipient Monitoring, states in part: Roles & Responsibilities PI / Department Responsibilities Project level monitoring of subrecipient including: o Reviews that expenses are necessary, reasonable, and allocable to the work completed and are aligned with technical progress. o Approve invoices for payment. Subrecipient Monitoring ? Project Level Subrecipient invoices are reviewed and approved in accordance with the requirements of GIM 2 in the manner and frequency stated in the subaward. The University of Washington I-TECH Global Operations Manual (GRef 2.3), Section 2, Finance, Accounting Policy and Procedure Requirements, states in part: In addition to the Fiscal Guidelines set forth in the I-TECH Field Operations Manual, these country specific policies are implemented at I-TECH. 10. Budget Management and Reporting f. Reports that show the variance between the budget plan and the activity for each region and activity code will be generated, reviewed and approved by the budget managers and the Management Team each month.

2022-030 The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. Federal regulations require the University to monitor its subrecipients? activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single or program-specific audit. For the Global AIDS program, the Centers for Disease Control and Prevention requires foreign subrecipients to submit their audits directly to the federal government and pass-through entity within 30 days after receiving the auditor?s report or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes onto its subrecipients, the University must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a University-funded program, federal law requires the University to issue a management decision to the subrecipient within six months of the audit report?s acceptance by the federal government. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it appropriately followed up on findings and issued management decisions. We found the University did not have adequate internal controls in place to verify whether: ? Subrecipients received required audits, if necessary, and appropriate remedies were taken if audits were not filed ? Management decisions were required to be issued for subrecipients who required a single or program-specific audit We used a nonstatistical sampling method to randomly select and examine seven out of a total population of 21 subrecipients. We found the University did not adequately monitor one subrecipient (14 percent) to ensure it received a required single or program-specific audit. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Staff in the University?s Office of Sponsored Programs (OSP) used a spreadsheet to track subrecipient certifications and responses, and reviewed annual certifications from the subrecipient to monitor its audit status. However, OSP did not correctly interpret the subrecipient?s response and, therefore, did not require it to provide documentation of a single or program-specific audit. Additionally, management did not review the subrecipient?s federal assistance expenditures to detect that it required an audit and, therefore, also failed to adequately follow up to ensure any reported findings were resolved with appropriate corrective action, if required. Effect of Condition Without establishing adequate internal controls, the University cannot ensure all subrecipients that required a single or program-specific audit received one. Furthermore, the University cannot ensure it is following up on subrecipient audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitors them for effectiveness where required, the University cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the University: ? Follow policies and procedures to ensure subrecipients receive required single or program-specific audits ? Establish and follow effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations ? Follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations ? Issue a written management decision for all applicable audit findings, if necessary University?s Response The University of Washington has established internal controls to carry out a risk assessment per Uniform Guidance, 2 CFR ? 200.332, Requirements for pass-through entities, and our UW Grants Information Memorandum (GIM) 8. This involves using various factors to assess risk. Part of our process to obtain the information needed from each subrecipient is through a certification process. The certification was obtained from the subrecipient, along with additional documentation from the subrecipient, such as an audited financial statement. We made a risk assessment using our standard risk criteria. We did misinterpret the response provided from the subrecipient regarding whether it expended $750,000 or more in federal awards during a fiscal year in order to obtain a single or program-specific audit from this subrecipient. While this was not obtained and reviewed, a risk assessment using our standard criteria was performed with the subrecipient rated as a medium risk, and subject to monitoring throughout the project, per GIM 8. The monitoring at the program level occurred during the period in question. We will be improving our required communications with subrecipients to have clear questions and responses regarding whether the subrecipient expended $750,000 or more in federal awards during the fiscal year in order to obtain a single or program-specific audit, follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations, and issue a written management decision for all applicable audit findings, if necessary. Auditor?s Remarks We thank the University for its cooperation and assistance during the audit. Whether the University performed a risk assessment for the subrecipient is not being questioned. The University did not adequately monitor the subrecipient to ensure it detected whether the subrecipient was required to receive a single audit, or program-specific audit in accordance with 2 CFR ?200.332(f). There is no other mechanism for the Federal government to monitor subrecipients of the University and, because a single audit of the subrecipient was not performed, neither the federal grantor nor the University had reasonable assurance of the subrecipient?s compliance with federal award requirements. We reaffirm our finding and will follow up on the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, establishes the following applicable requirements: Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient?s cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set for the in ?200.501 Audit requirements. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c). The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 8 ? Subrecipient Monitoring, states in part: Background Additionally, per the Federal Uniform Guidance, UW must evaluate each subrecipients? risk of noncompliance with federal regulations, include specific terms and conditions in the subaward as necessary, and monitor the activities of the subrecipient through various mechanisms. These mechanisms include: Training and technical assistance to subrecipients, on-site reviews, review of audit results, increased reporting requirements and enforcement action, if necessary. University Policy UW reviews each subrecipient entity according to an entity level comprehensive risk assessment prior to the issuance of a subaward. This risk assessment includes an entity level review of their fiscal systems, past audit activity, and if required, financial statements of the entity as well as the project specific activity proposed and that the required compliance approvals are obtained. When necessary, UW imposes limitations and requirements on the subrecipient through subaward terms and conditions per Federal Uniform Guidance, Section 200.521, prior to the issuance or renewal of a subaward. UW?s subrecipient monitoring requirements are comprised, at a minimum, of the following: ? Completion of the UW?s entity level comprehensive risk assessment (Certs & Reps, Annual Audit Certification) Subrecipient Monitoring ? Entity Level Entity level monitoring consists of a combination of the following: ? Initial Subrecipient Certification Form completion and assurance by subrecipient?s authorized official ? Annual audit assurance through an annual audit certification form ? Maintenance of a subrecipient profile list, which includes information on the entity?s past audit information and certifications ? Risk assessment carried out at each annual renewal of a subaward

2022-028 The University of Washington did not establish adequate internal controls to ensure payments to contractors and subrecipients for the Global AIDS program were allowable, properly supported and within the period of performance. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. To achieve the performance goals of the program, the Seattle headquarters of I-TECH (Seattle HQ) provides funding to subrecipients and contractors. Invoices submitted by contractors directly to Seattle HQ are reviewed and approved for payment by budget managers who have delegated authority from the Principal Investigator. Invoices submitted by subrecipients are reviewed and approved for payment by a Principal Investigator. Principal Investigators are also responsible for monitoring the subrecipient?s technical progress and performance. Seattle HQ also provides funding to country offices operating within the University?s global network. The country offices incur costs associated with furnishing supplies and equipment to address the HIV/AIDS epidemic, as well as staffing resources and acquiring goods and services from contractors to carry out the objectives of the program. Payments made by country offices are approved by Country Directors and Country Representatives as delegated by the University. Under the University?s policies, country offices are reimbursed for locally incurred expenses at least monthly. An invoice, accompanied by a schedule of expenses incurred, is submitted and approved by the Country Director and then by the Director of Finance at Seattle HQ, prior to payment. Country offices also responsible for obtaining and retaining supporting documentation for costs incurred and paid on each project. Monthly, Budget Managers review and approve a Budget Activity Report (BAR) that details the expenses charged to the project for the previous month to ensure accurate posting of already approved expenses. This review is also to determine whether the work performed during the billing period reconciles to costs claimed within the contractor?s invoice so that payment may be authorized. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls to ensure payments to contractors and subrecipients of the Global AIDS program were allowable properly supported and within the period of performance. Payments to country offices We used a statistical sampling method to randomly select and examine 58 out of 1,644 transactions for country offices. Of the 58 payments examined, we identified one payment (1.7 percent) that was not approved by the Country Director and the corresponding Budget Activity Report was not approved by the Director of Finance. Payments to contractors We used a statistical sampling method to randomly select and review 58 out of 3,040 payments to contractors. We found: ? Invoices for three payments (5 percent) were not approved by a Budget Manager ? Monthly Budget Activity Reports were not approved for 12 payments (20 percent) Subrecipient reimbursements We used a statistical sampling method to randomly select and review 55 out of 438 payments to subrecipients. We found the assigned Budget Manager did not review and approve the monthly Budget Activity Reports for 52 payments (94 percent). We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Program management did not require supporting documentation for each payment to be forwarded to and reviewed by headquarters personnel prior to payment authorization. Management also did not monitor the submission of invoices and Budget Activity Reports to ensure they were approved by the responsible Budget Manager, as required. Effect of Condition Without establishing adequate internal controls, the University cannot reasonably ensure it is using federal funds for allowable purposes and that expenditures of federal funds are supported by adequate documentation. Recommendations We recommend the University: ? Improve its internal controls to ensure invoices are properly approved by Principal Investigators, as required ? Improve its internal controls to ensure Budget Mangers review and approve monthly Budget Activity Reports before authorizing payments for projects incurring reimbursement requests ? Ensure it retains supporting documentation sufficient to show costs incurred and paid by the program are allowable, and to demonstrate the required managerial reviews have occurred prior to issuing payment University?s Response In response to the findings for the Global Aids Program, we would like to clarify the following: General Clarification: The draft finding inaccurately represents the role of BARS approvals as part of the internal controls to ensure payments to country offices, contractors and subrecipients are allowable, properly supported and within the period of performance. This is not the role of the BARS review process. Compliance, Budget Manager and PI reviews are the controls that ensure allowability of payments and BARS approvals are after-the-fact validations of accurate posting of already approved expenditures. We provided edits to the Background section to reflect our process. We request in light of this that the description of condition, cause of condition and recommendation sections of this finding be updated accordingly. Payments to country offices I-TECH country offices are not contractors; the offices are an extension of the University of Washington. Your review identified one of fifty-eight samples (1.7%) did not meet the approval requirements set forth in I-TECH?s standard operating procedure. Based on the error percentage, we disagree with this finding. Payments to contractors Payments to contractors have multiple approvals. Upon receipt, individual invoices are approved by the program/budget manager either by signature or email. Invoices are then sent to the I-TECH Accounts Payable Administrator for input to the University?s procurement system, ARIBA, which requires compliance approval from the Accounts Payable Supervisor or other manager, as well as funding approval from the budget manager prior to payment. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to contractors, they are reviews of the monthly expenses posted to the budget and the program manager?s concurrence that the expenses are as expected. The exceptions noted were payments made to country offices instead of contractors. The support for approvals were provided to the State Auditors on April 26, 2023, prior to the completion of fieldwork. We therefore disagree with this finding. We also request that the finding be adjusted to omit the 20% of missing BARS approvals as this is not related to the contractor payments. Subrecipient reimbursements Each subrecipient invoice is reviewed for reasonableness, allowability and allocability by the contracts manager and approved by both budget managers and principal investigators prior to being processed for payment in ARIBA. PI approvals were provided and verified for each subrecipient selection with no omissions noted by the auditors. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to subrecipients, they are after-the-fact reviews of the monthly expenses posted to the budget, intended as documentation of the program manager?s concurrence that the expenses are posted as expected. We acknowledge the instances detailed in the finding where we were unable to produce related BARS approvals for 52 of the transactions; however, we request that the finding be adjusted as these BARS approvals are not related to subrecipient invoice review and approvals. Our record keeping process for BARS approvals was to save the emails in a folder within our Finance Team mailbox. We learned during this review that emails beyond a certain date are deleted but maintained in the MS360 file. We?ve searched for the missing BARS approvals but have not yet been able to locate them. We have since begun saving the approvals to our server to ensure we have access to the data going forward. Auditor?s Remarks The University?s I-TECH Global Operations Manual stipulates that BARs will be generated, reviewed and approved monthly by the Budget Manager and management team. This information was provided to our Office as part of the University?s overall design of internal controls over payments to contractors, subrecipients and country offices. The University responded to our Office on April 20, 2023 adding that ?BAR review is the University?s key post payment control designed to ensure charges are accurately processed, coded and allowable on the budget charged.? We interpret this response to indicate the BAR review process is a monitoring control, and the University asserted on multiple occasions this is a key internal control, which is why we tested it. On January 5, our Office notified University management in writing that the BAR review process would be tested as a key control over the cost principles and period of performance requirements for Global AIDS expenditures. We received no additional inquiry or concerns from University management regarding this internal control until the draft finding was issued on April 14. We provided the University with a final written summary of our fieldwork in this area on April 6, 2023, after fieldwork had concluded. On April 7, the Finance Director responded to our Office in writing confirming they had no further questions or concerns regarding our testing results. It was not until after the University received this finding that additional documentation supporting expenditures tested during the audit were ultimately given to our Office. The basis for this audit finding is the key internal control failure rate of BAR approvals that exceeds our established materiality threshold of five percent, and constitutes a material weakness in internal control, which under the Uniform Guidance is required to be reported as an audit finding in accordance with 2 CFR 200.516 ? Audit findings. We reaffirm our finding and will follow up on the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 02 ? Acceptance of Sponsored Program Awards and Fiscal Compliance on Sponsored Program Accounts (Budget Numbers), states in part: Responsibilities Principal Investigator ? Supervises expenditure of sponsored program funds and approves sub-recipient invoices (see GIM 8) to assure: o That funds are used only for purposes that directly relate to and benefit the activity supported in the award. o That expenditures are consistent with all special terms, conditions, or limitations that apply to expenditures under the particular grant or contract. o That expenditures do not exceed the total funds authorized for a given period under the grant or contract. GIM 07 ? Sponsored Program Subaward Administration, states in part: Principal Investigator ? Review and approve subaward invoices. GIM 08 ? Subrecipient Monitoring, states in part: Roles & Responsibilities PI / Department Responsibilities Project level monitoring of subrecipient including: o Reviews that expenses are necessary, reasonable, and allocable to the work completed and are aligned with technical progress. o Approve invoices for payment. Subrecipient Monitoring ? Project Level Subrecipient invoices are reviewed and approved in accordance with the requirements of GIM 2 in the manner and frequency stated in the subaward. The University of Washington I-TECH Global Operations Manual (GRef 2.3), Section 2, Finance, Accounting Policy and Procedure Requirements, states in part: In addition to the Fiscal Guidelines set forth in the I-TECH Field Operations Manual, these country specific policies are implemented at I-TECH. 10. Budget Management and Reporting f. Reports that show the variance between the budget plan and the activity for each region and activity code will be generated, reviewed and approved by the budget managers and the Management Team each month.

2022-030 The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. Federal regulations require the University to monitor its subrecipients? activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single or program-specific audit. For the Global AIDS program, the Centers for Disease Control and Prevention requires foreign subrecipients to submit their audits directly to the federal government and pass-through entity within 30 days after receiving the auditor?s report or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes onto its subrecipients, the University must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a University-funded program, federal law requires the University to issue a management decision to the subrecipient within six months of the audit report?s acceptance by the federal government. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it appropriately followed up on findings and issued management decisions. We found the University did not have adequate internal controls in place to verify whether: ? Subrecipients received required audits, if necessary, and appropriate remedies were taken if audits were not filed ? Management decisions were required to be issued for subrecipients who required a single or program-specific audit We used a nonstatistical sampling method to randomly select and examine seven out of a total population of 21 subrecipients. We found the University did not adequately monitor one subrecipient (14 percent) to ensure it received a required single or program-specific audit. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Staff in the University?s Office of Sponsored Programs (OSP) used a spreadsheet to track subrecipient certifications and responses, and reviewed annual certifications from the subrecipient to monitor its audit status. However, OSP did not correctly interpret the subrecipient?s response and, therefore, did not require it to provide documentation of a single or program-specific audit. Additionally, management did not review the subrecipient?s federal assistance expenditures to detect that it required an audit and, therefore, also failed to adequately follow up to ensure any reported findings were resolved with appropriate corrective action, if required. Effect of Condition Without establishing adequate internal controls, the University cannot ensure all subrecipients that required a single or program-specific audit received one. Furthermore, the University cannot ensure it is following up on subrecipient audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitors them for effectiveness where required, the University cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the University: ? Follow policies and procedures to ensure subrecipients receive required single or program-specific audits ? Establish and follow effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations ? Follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations ? Issue a written management decision for all applicable audit findings, if necessary University?s Response The University of Washington has established internal controls to carry out a risk assessment per Uniform Guidance, 2 CFR ? 200.332, Requirements for pass-through entities, and our UW Grants Information Memorandum (GIM) 8. This involves using various factors to assess risk. Part of our process to obtain the information needed from each subrecipient is through a certification process. The certification was obtained from the subrecipient, along with additional documentation from the subrecipient, such as an audited financial statement. We made a risk assessment using our standard risk criteria. We did misinterpret the response provided from the subrecipient regarding whether it expended $750,000 or more in federal awards during a fiscal year in order to obtain a single or program-specific audit from this subrecipient. While this was not obtained and reviewed, a risk assessment using our standard criteria was performed with the subrecipient rated as a medium risk, and subject to monitoring throughout the project, per GIM 8. The monitoring at the program level occurred during the period in question. We will be improving our required communications with subrecipients to have clear questions and responses regarding whether the subrecipient expended $750,000 or more in federal awards during the fiscal year in order to obtain a single or program-specific audit, follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations, and issue a written management decision for all applicable audit findings, if necessary. Auditor?s Remarks We thank the University for its cooperation and assistance during the audit. Whether the University performed a risk assessment for the subrecipient is not being questioned. The University did not adequately monitor the subrecipient to ensure it detected whether the subrecipient was required to receive a single audit, or program-specific audit in accordance with 2 CFR ?200.332(f). There is no other mechanism for the Federal government to monitor subrecipients of the University and, because a single audit of the subrecipient was not performed, neither the federal grantor nor the University had reasonable assurance of the subrecipient?s compliance with federal award requirements. We reaffirm our finding and will follow up on the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, establishes the following applicable requirements: Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient?s cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set for the in ?200.501 Audit requirements. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c). The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 8 ? Subrecipient Monitoring, states in part: Background Additionally, per the Federal Uniform Guidance, UW must evaluate each subrecipients? risk of noncompliance with federal regulations, include specific terms and conditions in the subaward as necessary, and monitor the activities of the subrecipient through various mechanisms. These mechanisms include: Training and technical assistance to subrecipients, on-site reviews, review of audit results, increased reporting requirements and enforcement action, if necessary. University Policy UW reviews each subrecipient entity according to an entity level comprehensive risk assessment prior to the issuance of a subaward. This risk assessment includes an entity level review of their fiscal systems, past audit activity, and if required, financial statements of the entity as well as the project specific activity proposed and that the required compliance approvals are obtained. When necessary, UW imposes limitations and requirements on the subrecipient through subaward terms and conditions per Federal Uniform Guidance, Section 200.521, prior to the issuance or renewal of a subaward. UW?s subrecipient monitoring requirements are comprised, at a minimum, of the following: ? Completion of the UW?s entity level comprehensive risk assessment (Certs & Reps, Annual Audit Certification) Subrecipient Monitoring ? Entity Level Entity level monitoring consists of a combination of the following: ? Initial Subrecipient Certification Form completion and assurance by subrecipient?s authorized official ? Annual audit assurance through an annual audit certification form ? Maintenance of a subrecipient profile list, which includes information on the entity?s past audit information and certifications ? Risk assessment carried out at each annual renewal of a subaward

2022-028 The University of Washington did not establish adequate internal controls to ensure payments to contractors and subrecipients for the Global AIDS program were allowable, properly supported and within the period of performance. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. To achieve the performance goals of the program, the Seattle headquarters of I-TECH (Seattle HQ) provides funding to subrecipients and contractors. Invoices submitted by contractors directly to Seattle HQ are reviewed and approved for payment by budget managers who have delegated authority from the Principal Investigator. Invoices submitted by subrecipients are reviewed and approved for payment by a Principal Investigator. Principal Investigators are also responsible for monitoring the subrecipient?s technical progress and performance. Seattle HQ also provides funding to country offices operating within the University?s global network. The country offices incur costs associated with furnishing supplies and equipment to address the HIV/AIDS epidemic, as well as staffing resources and acquiring goods and services from contractors to carry out the objectives of the program. Payments made by country offices are approved by Country Directors and Country Representatives as delegated by the University. Under the University?s policies, country offices are reimbursed for locally incurred expenses at least monthly. An invoice, accompanied by a schedule of expenses incurred, is submitted and approved by the Country Director and then by the Director of Finance at Seattle HQ, prior to payment. Country offices also responsible for obtaining and retaining supporting documentation for costs incurred and paid on each project. Monthly, Budget Managers review and approve a Budget Activity Report (BAR) that details the expenses charged to the project for the previous month to ensure accurate posting of already approved expenses. This review is also to determine whether the work performed during the billing period reconciles to costs claimed within the contractor?s invoice so that payment may be authorized. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls to ensure payments to contractors and subrecipients of the Global AIDS program were allowable properly supported and within the period of performance. Payments to country offices We used a statistical sampling method to randomly select and examine 58 out of 1,644 transactions for country offices. Of the 58 payments examined, we identified one payment (1.7 percent) that was not approved by the Country Director and the corresponding Budget Activity Report was not approved by the Director of Finance. Payments to contractors We used a statistical sampling method to randomly select and review 58 out of 3,040 payments to contractors. We found: ? Invoices for three payments (5 percent) were not approved by a Budget Manager ? Monthly Budget Activity Reports were not approved for 12 payments (20 percent) Subrecipient reimbursements We used a statistical sampling method to randomly select and review 55 out of 438 payments to subrecipients. We found the assigned Budget Manager did not review and approve the monthly Budget Activity Reports for 52 payments (94 percent). We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Program management did not require supporting documentation for each payment to be forwarded to and reviewed by headquarters personnel prior to payment authorization. Management also did not monitor the submission of invoices and Budget Activity Reports to ensure they were approved by the responsible Budget Manager, as required. Effect of Condition Without establishing adequate internal controls, the University cannot reasonably ensure it is using federal funds for allowable purposes and that expenditures of federal funds are supported by adequate documentation. Recommendations We recommend the University: ? Improve its internal controls to ensure invoices are properly approved by Principal Investigators, as required ? Improve its internal controls to ensure Budget Mangers review and approve monthly Budget Activity Reports before authorizing payments for projects incurring reimbursement requests ? Ensure it retains supporting documentation sufficient to show costs incurred and paid by the program are allowable, and to demonstrate the required managerial reviews have occurred prior to issuing payment University?s Response In response to the findings for the Global Aids Program, we would like to clarify the following: General Clarification: The draft finding inaccurately represents the role of BARS approvals as part of the internal controls to ensure payments to country offices, contractors and subrecipients are allowable, properly supported and within the period of performance. This is not the role of the BARS review process. Compliance, Budget Manager and PI reviews are the controls that ensure allowability of payments and BARS approvals are after-the-fact validations of accurate posting of already approved expenditures. We provided edits to the Background section to reflect our process. We request in light of this that the description of condition, cause of condition and recommendation sections of this finding be updated accordingly. Payments to country offices I-TECH country offices are not contractors; the offices are an extension of the University of Washington. Your review identified one of fifty-eight samples (1.7%) did not meet the approval requirements set forth in I-TECH?s standard operating procedure. Based on the error percentage, we disagree with this finding. Payments to contractors Payments to contractors have multiple approvals. Upon receipt, individual invoices are approved by the program/budget manager either by signature or email. Invoices are then sent to the I-TECH Accounts Payable Administrator for input to the University?s procurement system, ARIBA, which requires compliance approval from the Accounts Payable Supervisor or other manager, as well as funding approval from the budget manager prior to payment. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to contractors, they are reviews of the monthly expenses posted to the budget and the program manager?s concurrence that the expenses are as expected. The exceptions noted were payments made to country offices instead of contractors. The support for approvals were provided to the State Auditors on April 26, 2023, prior to the completion of fieldwork. We therefore disagree with this finding. We also request that the finding be adjusted to omit the 20% of missing BARS approvals as this is not related to the contractor payments. Subrecipient reimbursements Each subrecipient invoice is reviewed for reasonableness, allowability and allocability by the contracts manager and approved by both budget managers and principal investigators prior to being processed for payment in ARIBA. PI approvals were provided and verified for each subrecipient selection with no omissions noted by the auditors. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to subrecipients, they are after-the-fact reviews of the monthly expenses posted to the budget, intended as documentation of the program manager?s concurrence that the expenses are posted as expected. We acknowledge the instances detailed in the finding where we were unable to produce related BARS approvals for 52 of the transactions; however, we request that the finding be adjusted as these BARS approvals are not related to subrecipient invoice review and approvals. Our record keeping process for BARS approvals was to save the emails in a folder within our Finance Team mailbox. We learned during this review that emails beyond a certain date are deleted but maintained in the MS360 file. We?ve searched for the missing BARS approvals but have not yet been able to locate them. We have since begun saving the approvals to our server to ensure we have access to the data going forward. Auditor?s Remarks The University?s I-TECH Global Operations Manual stipulates that BARs will be generated, reviewed and approved monthly by the Budget Manager and management team. This information was provided to our Office as part of the University?s overall design of internal controls over payments to contractors, subrecipients and country offices. The University responded to our Office on April 20, 2023 adding that ?BAR review is the University?s key post payment control designed to ensure charges are accurately processed, coded and allowable on the budget charged.? We interpret this response to indicate the BAR review process is a monitoring control, and the University asserted on multiple occasions this is a key internal control, which is why we tested it. On January 5, our Office notified University management in writing that the BAR review process would be tested as a key control over the cost principles and period of performance requirements for Global AIDS expenditures. We received no additional inquiry or concerns from University management regarding this internal control until the draft finding was issued on April 14. We provided the University with a final written summary of our fieldwork in this area on April 6, 2023, after fieldwork had concluded. On April 7, the Finance Director responded to our Office in writing confirming they had no further questions or concerns regarding our testing results. It was not until after the University received this finding that additional documentation supporting expenditures tested during the audit were ultimately given to our Office. The basis for this audit finding is the key internal control failure rate of BAR approvals that exceeds our established materiality threshold of five percent, and constitutes a material weakness in internal control, which under the Uniform Guidance is required to be reported as an audit finding in accordance with 2 CFR 200.516 ? Audit findings. We reaffirm our finding and will follow up on the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 02 ? Acceptance of Sponsored Program Awards and Fiscal Compliance on Sponsored Program Accounts (Budget Numbers), states in part: Responsibilities Principal Investigator ? Supervises expenditure of sponsored program funds and approves sub-recipient invoices (see GIM 8) to assure: o That funds are used only for purposes that directly relate to and benefit the activity supported in the award. o That expenditures are consistent with all special terms, conditions, or limitations that apply to expenditures under the particular grant or contract. o That expenditures do not exceed the total funds authorized for a given period under the grant or contract. GIM 07 ? Sponsored Program Subaward Administration, states in part: Principal Investigator ? Review and approve subaward invoices. GIM 08 ? Subrecipient Monitoring, states in part: Roles & Responsibilities PI / Department Responsibilities Project level monitoring of subrecipient including: o Reviews that expenses are necessary, reasonable, and allocable to the work completed and are aligned with technical progress. o Approve invoices for payment. Subrecipient Monitoring ? Project Level Subrecipient invoices are reviewed and approved in accordance with the requirements of GIM 2 in the manner and frequency stated in the subaward. The University of Washington I-TECH Global Operations Manual (GRef 2.3), Section 2, Finance, Accounting Policy and Procedure Requirements, states in part: In addition to the Fiscal Guidelines set forth in the I-TECH Field Operations Manual, these country specific policies are implemented at I-TECH. 10. Budget Management and Reporting f. Reports that show the variance between the budget plan and the activity for each region and activity code will be generated, reviewed and approved by the budget managers and the Management Team each month.

2022-030 The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. Federal regulations require the University to monitor its subrecipients? activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single or program-specific audit. For the Global AIDS program, the Centers for Disease Control and Prevention requires foreign subrecipients to submit their audits directly to the federal government and pass-through entity within 30 days after receiving the auditor?s report or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes onto its subrecipients, the University must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a University-funded program, federal law requires the University to issue a management decision to the subrecipient within six months of the audit report?s acceptance by the federal government. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it appropriately followed up on findings and issued management decisions. We found the University did not have adequate internal controls in place to verify whether: ? Subrecipients received required audits, if necessary, and appropriate remedies were taken if audits were not filed ? Management decisions were required to be issued for subrecipients who required a single or program-specific audit We used a nonstatistical sampling method to randomly select and examine seven out of a total population of 21 subrecipients. We found the University did not adequately monitor one subrecipient (14 percent) to ensure it received a required single or program-specific audit. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Staff in the University?s Office of Sponsored Programs (OSP) used a spreadsheet to track subrecipient certifications and responses, and reviewed annual certifications from the subrecipient to monitor its audit status. However, OSP did not correctly interpret the subrecipient?s response and, therefore, did not require it to provide documentation of a single or program-specific audit. Additionally, management did not review the subrecipient?s federal assistance expenditures to detect that it required an audit and, therefore, also failed to adequately follow up to ensure any reported findings were resolved with appropriate corrective action, if required. Effect of Condition Without establishing adequate internal controls, the University cannot ensure all subrecipients that required a single or program-specific audit received one. Furthermore, the University cannot ensure it is following up on subrecipient audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitors them for effectiveness where required, the University cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the University: ? Follow policies and procedures to ensure subrecipients receive required single or program-specific audits ? Establish and follow effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations ? Follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations ? Issue a written management decision for all applicable audit findings, if necessary University?s Response The University of Washington has established internal controls to carry out a risk assessment per Uniform Guidance, 2 CFR ? 200.332, Requirements for pass-through entities, and our UW Grants Information Memorandum (GIM) 8. This involves using various factors to assess risk. Part of our process to obtain the information needed from each subrecipient is through a certification process. The certification was obtained from the subrecipient, along with additional documentation from the subrecipient, such as an audited financial statement. We made a risk assessment using our standard risk criteria. We did misinterpret the response provided from the subrecipient regarding whether it expended $750,000 or more in federal awards during a fiscal year in order to obtain a single or program-specific audit from this subrecipient. While this was not obtained and reviewed, a risk assessment using our standard criteria was performed with the subrecipient rated as a medium risk, and subject to monitoring throughout the project, per GIM 8. The monitoring at the program level occurred during the period in question. We will be improving our required communications with subrecipients to have clear questions and responses regarding whether the subrecipient expended $750,000 or more in federal awards during the fiscal year in order to obtain a single or program-specific audit, follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations, and issue a written management decision for all applicable audit findings, if necessary. Auditor?s Remarks We thank the University for its cooperation and assistance during the audit. Whether the University performed a risk assessment for the subrecipient is not being questioned. The University did not adequately monitor the subrecipient to ensure it detected whether the subrecipient was required to receive a single audit, or program-specific audit in accordance with 2 CFR ?200.332(f). There is no other mechanism for the Federal government to monitor subrecipients of the University and, because a single audit of the subrecipient was not performed, neither the federal grantor nor the University had reasonable assurance of the subrecipient?s compliance with federal award requirements. We reaffirm our finding and will follow up on the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, establishes the following applicable requirements: Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient?s cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set for the in ?200.501 Audit requirements. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c). The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 8 ? Subrecipient Monitoring, states in part: Background Additionally, per the Federal Uniform Guidance, UW must evaluate each subrecipients? risk of noncompliance with federal regulations, include specific terms and conditions in the subaward as necessary, and monitor the activities of the subrecipient through various mechanisms. These mechanisms include: Training and technical assistance to subrecipients, on-site reviews, review of audit results, increased reporting requirements and enforcement action, if necessary. University Policy UW reviews each subrecipient entity according to an entity level comprehensive risk assessment prior to the issuance of a subaward. This risk assessment includes an entity level review of their fiscal systems, past audit activity, and if required, financial statements of the entity as well as the project specific activity proposed and that the required compliance approvals are obtained. When necessary, UW imposes limitations and requirements on the subrecipient through subaward terms and conditions per Federal Uniform Guidance, Section 200.521, prior to the issuance or renewal of a subaward. UW?s subrecipient monitoring requirements are comprised, at a minimum, of the following: ? Completion of the UW?s entity level comprehensive risk assessment (Certs & Reps, Annual Audit Certification) Subrecipient Monitoring ? Entity Level Entity level monitoring consists of a combination of the following: ? Initial Subrecipient Certification Form completion and assurance by subrecipient?s authorized official ? Annual audit assurance through an annual audit certification form ? Maintenance of a subrecipient profile list, which includes information on the entity?s past audit information and certifications ? Risk assessment carried out at each annual renewal of a subaward

2022-028 The University of Washington did not establish adequate internal controls to ensure payments to contractors and subrecipients for the Global AIDS program were allowable, properly supported and within the period of performance. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. To achieve the performance goals of the program, the Seattle headquarters of I-TECH (Seattle HQ) provides funding to subrecipients and contractors. Invoices submitted by contractors directly to Seattle HQ are reviewed and approved for payment by budget managers who have delegated authority from the Principal Investigator. Invoices submitted by subrecipients are reviewed and approved for payment by a Principal Investigator. Principal Investigators are also responsible for monitoring the subrecipient?s technical progress and performance. Seattle HQ also provides funding to country offices operating within the University?s global network. The country offices incur costs associated with furnishing supplies and equipment to address the HIV/AIDS epidemic, as well as staffing resources and acquiring goods and services from contractors to carry out the objectives of the program. Payments made by country offices are approved by Country Directors and Country Representatives as delegated by the University. Under the University?s policies, country offices are reimbursed for locally incurred expenses at least monthly. An invoice, accompanied by a schedule of expenses incurred, is submitted and approved by the Country Director and then by the Director of Finance at Seattle HQ, prior to payment. Country offices also responsible for obtaining and retaining supporting documentation for costs incurred and paid on each project. Monthly, Budget Managers review and approve a Budget Activity Report (BAR) that details the expenses charged to the project for the previous month to ensure accurate posting of already approved expenses. This review is also to determine whether the work performed during the billing period reconciles to costs claimed within the contractor?s invoice so that payment may be authorized. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls to ensure payments to contractors and subrecipients of the Global AIDS program were allowable properly supported and within the period of performance. Payments to country offices We used a statistical sampling method to randomly select and examine 58 out of 1,644 transactions for country offices. Of the 58 payments examined, we identified one payment (1.7 percent) that was not approved by the Country Director and the corresponding Budget Activity Report was not approved by the Director of Finance. Payments to contractors We used a statistical sampling method to randomly select and review 58 out of 3,040 payments to contractors. We found: ? Invoices for three payments (5 percent) were not approved by a Budget Manager ? Monthly Budget Activity Reports were not approved for 12 payments (20 percent) Subrecipient reimbursements We used a statistical sampling method to randomly select and review 55 out of 438 payments to subrecipients. We found the assigned Budget Manager did not review and approve the monthly Budget Activity Reports for 52 payments (94 percent). We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Program management did not require supporting documentation for each payment to be forwarded to and reviewed by headquarters personnel prior to payment authorization. Management also did not monitor the submission of invoices and Budget Activity Reports to ensure they were approved by the responsible Budget Manager, as required. Effect of Condition Without establishing adequate internal controls, the University cannot reasonably ensure it is using federal funds for allowable purposes and that expenditures of federal funds are supported by adequate documentation. Recommendations We recommend the University: ? Improve its internal controls to ensure invoices are properly approved by Principal Investigators, as required ? Improve its internal controls to ensure Budget Mangers review and approve monthly Budget Activity Reports before authorizing payments for projects incurring reimbursement requests ? Ensure it retains supporting documentation sufficient to show costs incurred and paid by the program are allowable, and to demonstrate the required managerial reviews have occurred prior to issuing payment University?s Response In response to the findings for the Global Aids Program, we would like to clarify the following: General Clarification: The draft finding inaccurately represents the role of BARS approvals as part of the internal controls to ensure payments to country offices, contractors and subrecipients are allowable, properly supported and within the period of performance. This is not the role of the BARS review process. Compliance, Budget Manager and PI reviews are the controls that ensure allowability of payments and BARS approvals are after-the-fact validations of accurate posting of already approved expenditures. We provided edits to the Background section to reflect our process. We request in light of this that the description of condition, cause of condition and recommendation sections of this finding be updated accordingly. Payments to country offices I-TECH country offices are not contractors; the offices are an extension of the University of Washington. Your review identified one of fifty-eight samples (1.7%) did not meet the approval requirements set forth in I-TECH?s standard operating procedure. Based on the error percentage, we disagree with this finding. Payments to contractors Payments to contractors have multiple approvals. Upon receipt, individual invoices are approved by the program/budget manager either by signature or email. Invoices are then sent to the I-TECH Accounts Payable Administrator for input to the University?s procurement system, ARIBA, which requires compliance approval from the Accounts Payable Supervisor or other manager, as well as funding approval from the budget manager prior to payment. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to contractors, they are reviews of the monthly expenses posted to the budget and the program manager?s concurrence that the expenses are as expected. The exceptions noted were payments made to country offices instead of contractors. The support for approvals were provided to the State Auditors on April 26, 2023, prior to the completion of fieldwork. We therefore disagree with this finding. We also request that the finding be adjusted to omit the 20% of missing BARS approvals as this is not related to the contractor payments. Subrecipient reimbursements Each subrecipient invoice is reviewed for reasonableness, allowability and allocability by the contracts manager and approved by both budget managers and principal investigators prior to being processed for payment in ARIBA. PI approvals were provided and verified for each subrecipient selection with no omissions noted by the auditors. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to subrecipients, they are after-the-fact reviews of the monthly expenses posted to the budget, intended as documentation of the program manager?s concurrence that the expenses are posted as expected. We acknowledge the instances detailed in the finding where we were unable to produce related BARS approvals for 52 of the transactions; however, we request that the finding be adjusted as these BARS approvals are not related to subrecipient invoice review and approvals. Our record keeping process for BARS approvals was to save the emails in a folder within our Finance Team mailbox. We learned during this review that emails beyond a certain date are deleted but maintained in the MS360 file. We?ve searched for the missing BARS approvals but have not yet been able to locate them. We have since begun saving the approvals to our server to ensure we have access to the data going forward. Auditor?s Remarks The University?s I-TECH Global Operations Manual stipulates that BARs will be generated, reviewed and approved monthly by the Budget Manager and management team. This information was provided to our Office as part of the University?s overall design of internal controls over payments to contractors, subrecipients and country offices. The University responded to our Office on April 20, 2023 adding that ?BAR review is the University?s key post payment control designed to ensure charges are accurately processed, coded and allowable on the budget charged.? We interpret this response to indicate the BAR review process is a monitoring control, and the University asserted on multiple occasions this is a key internal control, which is why we tested it. On January 5, our Office notified University management in writing that the BAR review process would be tested as a key control over the cost principles and period of performance requirements for Global AIDS expenditures. We received no additional inquiry or concerns from University management regarding this internal control until the draft finding was issued on April 14. We provided the University with a final written summary of our fieldwork in this area on April 6, 2023, after fieldwork had concluded. On April 7, the Finance Director responded to our Office in writing confirming they had no further questions or concerns regarding our testing results. It was not until after the University received this finding that additional documentation supporting expenditures tested during the audit were ultimately given to our Office. The basis for this audit finding is the key internal control failure rate of BAR approvals that exceeds our established materiality threshold of five percent, and constitutes a material weakness in internal control, which under the Uniform Guidance is required to be reported as an audit finding in accordance with 2 CFR 200.516 ? Audit findings. We reaffirm our finding and will follow up on the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 02 ? Acceptance of Sponsored Program Awards and Fiscal Compliance on Sponsored Program Accounts (Budget Numbers), states in part: Responsibilities Principal Investigator ? Supervises expenditure of sponsored program funds and approves sub-recipient invoices (see GIM 8) to assure: o That funds are used only for purposes that directly relate to and benefit the activity supported in the award. o That expenditures are consistent with all special terms, conditions, or limitations that apply to expenditures under the particular grant or contract. o That expenditures do not exceed the total funds authorized for a given period under the grant or contract. GIM 07 ? Sponsored Program Subaward Administration, states in part: Principal Investigator ? Review and approve subaward invoices. GIM 08 ? Subrecipient Monitoring, states in part: Roles & Responsibilities PI / Department Responsibilities Project level monitoring of subrecipient including: o Reviews that expenses are necessary, reasonable, and allocable to the work completed and are aligned with technical progress. o Approve invoices for payment. Subrecipient Monitoring ? Project Level Subrecipient invoices are reviewed and approved in accordance with the requirements of GIM 2 in the manner and frequency stated in the subaward. The University of Washington I-TECH Global Operations Manual (GRef 2.3), Section 2, Finance, Accounting Policy and Procedure Requirements, states in part: In addition to the Fiscal Guidelines set forth in the I-TECH Field Operations Manual, these country specific policies are implemented at I-TECH. 10. Budget Management and Reporting f. Reports that show the variance between the budget plan and the activity for each region and activity code will be generated, reviewed and approved by the budget managers and the Management Team each month.

2022-030 The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. Federal regulations require the University to monitor its subrecipients? activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single or program-specific audit. For the Global AIDS program, the Centers for Disease Control and Prevention requires foreign subrecipients to submit their audits directly to the federal government and pass-through entity within 30 days after receiving the auditor?s report or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes onto its subrecipients, the University must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a University-funded program, federal law requires the University to issue a management decision to the subrecipient within six months of the audit report?s acceptance by the federal government. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it appropriately followed up on findings and issued management decisions. We found the University did not have adequate internal controls in place to verify whether: ? Subrecipients received required audits, if necessary, and appropriate remedies were taken if audits were not filed ? Management decisions were required to be issued for subrecipients who required a single or program-specific audit We used a nonstatistical sampling method to randomly select and examine seven out of a total population of 21 subrecipients. We found the University did not adequately monitor one subrecipient (14 percent) to ensure it received a required single or program-specific audit. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Staff in the University?s Office of Sponsored Programs (OSP) used a spreadsheet to track subrecipient certifications and responses, and reviewed annual certifications from the subrecipient to monitor its audit status. However, OSP did not correctly interpret the subrecipient?s response and, therefore, did not require it to provide documentation of a single or program-specific audit. Additionally, management did not review the subrecipient?s federal assistance expenditures to detect that it required an audit and, therefore, also failed to adequately follow up to ensure any reported findings were resolved with appropriate corrective action, if required. Effect of Condition Without establishing adequate internal controls, the University cannot ensure all subrecipients that required a single or program-specific audit received one. Furthermore, the University cannot ensure it is following up on subrecipient audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitors them for effectiveness where required, the University cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the University: ? Follow policies and procedures to ensure subrecipients receive required single or program-specific audits ? Establish and follow effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations ? Follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations ? Issue a written management decision for all applicable audit findings, if necessary University?s Response The University of Washington has established internal controls to carry out a risk assessment per Uniform Guidance, 2 CFR ? 200.332, Requirements for pass-through entities, and our UW Grants Information Memorandum (GIM) 8. This involves using various factors to assess risk. Part of our process to obtain the information needed from each subrecipient is through a certification process. The certification was obtained from the subrecipient, along with additional documentation from the subrecipient, such as an audited financial statement. We made a risk assessment using our standard risk criteria. We did misinterpret the response provided from the subrecipient regarding whether it expended $750,000 or more in federal awards during a fiscal year in order to obtain a single or program-specific audit from this subrecipient. While this was not obtained and reviewed, a risk assessment using our standard criteria was performed with the subrecipient rated as a medium risk, and subject to monitoring throughout the project, per GIM 8. The monitoring at the program level occurred during the period in question. We will be improving our required communications with subrecipients to have clear questions and responses regarding whether the subrecipient expended $750,000 or more in federal awards during the fiscal year in order to obtain a single or program-specific audit, follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations, and issue a written management decision for all applicable audit findings, if necessary. Auditor?s Remarks We thank the University for its cooperation and assistance during the audit. Whether the University performed a risk assessment for the subrecipient is not being questioned. The University did not adequately monitor the subrecipient to ensure it detected whether the subrecipient was required to receive a single audit, or program-specific audit in accordance with 2 CFR ?200.332(f). There is no other mechanism for the Federal government to monitor subrecipients of the University and, because a single audit of the subrecipient was not performed, neither the federal grantor nor the University had reasonable assurance of the subrecipient?s compliance with federal award requirements. We reaffirm our finding and will follow up on the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, establishes the following applicable requirements: Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient?s cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set for the in ?200.501 Audit requirements. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c). The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 8 ? Subrecipient Monitoring, states in part: Background Additionally, per the Federal Uniform Guidance, UW must evaluate each subrecipients? risk of noncompliance with federal regulations, include specific terms and conditions in the subaward as necessary, and monitor the activities of the subrecipient through various mechanisms. These mechanisms include: Training and technical assistance to subrecipients, on-site reviews, review of audit results, increased reporting requirements and enforcement action, if necessary. University Policy UW reviews each subrecipient entity according to an entity level comprehensive risk assessment prior to the issuance of a subaward. This risk assessment includes an entity level review of their fiscal systems, past audit activity, and if required, financial statements of the entity as well as the project specific activity proposed and that the required compliance approvals are obtained. When necessary, UW imposes limitations and requirements on the subrecipient through subaward terms and conditions per Federal Uniform Guidance, Section 200.521, prior to the issuance or renewal of a subaward. UW?s subrecipient monitoring requirements are comprised, at a minimum, of the following: ? Completion of the UW?s entity level comprehensive risk assessment (Certs & Reps, Annual Audit Certification) Subrecipient Monitoring ? Entity Level Entity level monitoring consists of a combination of the following: ? Initial Subrecipient Certification Form completion and assurance by subrecipient?s authorized official ? Annual audit assurance through an annual audit certification form ? Maintenance of a subrecipient profile list, which includes information on the entity?s past audit information and certifications ? Risk assessment carried out at each annual renewal of a subaward

2022-028 The University of Washington did not establish adequate internal controls to ensure payments to contractors and subrecipients for the Global AIDS program were allowable, properly supported and within the period of performance. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. To achieve the performance goals of the program, the Seattle headquarters of I-TECH (Seattle HQ) provides funding to subrecipients and contractors. Invoices submitted by contractors directly to Seattle HQ are reviewed and approved for payment by budget managers who have delegated authority from the Principal Investigator. Invoices submitted by subrecipients are reviewed and approved for payment by a Principal Investigator. Principal Investigators are also responsible for monitoring the subrecipient?s technical progress and performance. Seattle HQ also provides funding to country offices operating within the University?s global network. The country offices incur costs associated with furnishing supplies and equipment to address the HIV/AIDS epidemic, as well as staffing resources and acquiring goods and services from contractors to carry out the objectives of the program. Payments made by country offices are approved by Country Directors and Country Representatives as delegated by the University. Under the University?s policies, country offices are reimbursed for locally incurred expenses at least monthly. An invoice, accompanied by a schedule of expenses incurred, is submitted and approved by the Country Director and then by the Director of Finance at Seattle HQ, prior to payment. Country offices also responsible for obtaining and retaining supporting documentation for costs incurred and paid on each project. Monthly, Budget Managers review and approve a Budget Activity Report (BAR) that details the expenses charged to the project for the previous month to ensure accurate posting of already approved expenses. This review is also to determine whether the work performed during the billing period reconciles to costs claimed within the contractor?s invoice so that payment may be authorized. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls to ensure payments to contractors and subrecipients of the Global AIDS program were allowable properly supported and within the period of performance. Payments to country offices We used a statistical sampling method to randomly select and examine 58 out of 1,644 transactions for country offices. Of the 58 payments examined, we identified one payment (1.7 percent) that was not approved by the Country Director and the corresponding Budget Activity Report was not approved by the Director of Finance. Payments to contractors We used a statistical sampling method to randomly select and review 58 out of 3,040 payments to contractors. We found: ? Invoices for three payments (5 percent) were not approved by a Budget Manager ? Monthly Budget Activity Reports were not approved for 12 payments (20 percent) Subrecipient reimbursements We used a statistical sampling method to randomly select and review 55 out of 438 payments to subrecipients. We found the assigned Budget Manager did not review and approve the monthly Budget Activity Reports for 52 payments (94 percent). We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Program management did not require supporting documentation for each payment to be forwarded to and reviewed by headquarters personnel prior to payment authorization. Management also did not monitor the submission of invoices and Budget Activity Reports to ensure they were approved by the responsible Budget Manager, as required. Effect of Condition Without establishing adequate internal controls, the University cannot reasonably ensure it is using federal funds for allowable purposes and that expenditures of federal funds are supported by adequate documentation. Recommendations We recommend the University: ? Improve its internal controls to ensure invoices are properly approved by Principal Investigators, as required ? Improve its internal controls to ensure Budget Mangers review and approve monthly Budget Activity Reports before authorizing payments for projects incurring reimbursement requests ? Ensure it retains supporting documentation sufficient to show costs incurred and paid by the program are allowable, and to demonstrate the required managerial reviews have occurred prior to issuing payment University?s Response In response to the findings for the Global Aids Program, we would like to clarify the following: General Clarification: The draft finding inaccurately represents the role of BARS approvals as part of the internal controls to ensure payments to country offices, contractors and subrecipients are allowable, properly supported and within the period of performance. This is not the role of the BARS review process. Compliance, Budget Manager and PI reviews are the controls that ensure allowability of payments and BARS approvals are after-the-fact validations of accurate posting of already approved expenditures. We provided edits to the Background section to reflect our process. We request in light of this that the description of condition, cause of condition and recommendation sections of this finding be updated accordingly. Payments to country offices I-TECH country offices are not contractors; the offices are an extension of the University of Washington. Your review identified one of fifty-eight samples (1.7%) did not meet the approval requirements set forth in I-TECH?s standard operating procedure. Based on the error percentage, we disagree with this finding. Payments to contractors Payments to contractors have multiple approvals. Upon receipt, individual invoices are approved by the program/budget manager either by signature or email. Invoices are then sent to the I-TECH Accounts Payable Administrator for input to the University?s procurement system, ARIBA, which requires compliance approval from the Accounts Payable Supervisor or other manager, as well as funding approval from the budget manager prior to payment. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to contractors, they are reviews of the monthly expenses posted to the budget and the program manager?s concurrence that the expenses are as expected. The exceptions noted were payments made to country offices instead of contractors. The support for approvals were provided to the State Auditors on April 26, 2023, prior to the completion of fieldwork. We therefore disagree with this finding. We also request that the finding be adjusted to omit the 20% of missing BARS approvals as this is not related to the contractor payments. Subrecipient reimbursements Each subrecipient invoice is reviewed for reasonableness, allowability and allocability by the contracts manager and approved by both budget managers and principal investigators prior to being processed for payment in ARIBA. PI approvals were provided and verified for each subrecipient selection with no omissions noted by the auditors. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to subrecipients, they are after-the-fact reviews of the monthly expenses posted to the budget, intended as documentation of the program manager?s concurrence that the expenses are posted as expected. We acknowledge the instances detailed in the finding where we were unable to produce related BARS approvals for 52 of the transactions; however, we request that the finding be adjusted as these BARS approvals are not related to subrecipient invoice review and approvals. Our record keeping process for BARS approvals was to save the emails in a folder within our Finance Team mailbox. We learned during this review that emails beyond a certain date are deleted but maintained in the MS360 file. We?ve searched for the missing BARS approvals but have not yet been able to locate them. We have since begun saving the approvals to our server to ensure we have access to the data going forward. Auditor?s Remarks The University?s I-TECH Global Operations Manual stipulates that BARs will be generated, reviewed and approved monthly by the Budget Manager and management team. This information was provided to our Office as part of the University?s overall design of internal controls over payments to contractors, subrecipients and country offices. The University responded to our Office on April 20, 2023 adding that ?BAR review is the University?s key post payment control designed to ensure charges are accurately processed, coded and allowable on the budget charged.? We interpret this response to indicate the BAR review process is a monitoring control, and the University asserted on multiple occasions this is a key internal control, which is why we tested it. On January 5, our Office notified University management in writing that the BAR review process would be tested as a key control over the cost principles and period of performance requirements for Global AIDS expenditures. We received no additional inquiry or concerns from University management regarding this internal control until the draft finding was issued on April 14. We provided the University with a final written summary of our fieldwork in this area on April 6, 2023, after fieldwork had concluded. On April 7, the Finance Director responded to our Office in writing confirming they had no further questions or concerns regarding our testing results. It was not until after the University received this finding that additional documentation supporting expenditures tested during the audit were ultimately given to our Office. The basis for this audit finding is the key internal control failure rate of BAR approvals that exceeds our established materiality threshold of five percent, and constitutes a material weakness in internal control, which under the Uniform Guidance is required to be reported as an audit finding in accordance with 2 CFR 200.516 ? Audit findings. We reaffirm our finding and will follow up on the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 02 ? Acceptance of Sponsored Program Awards and Fiscal Compliance on Sponsored Program Accounts (Budget Numbers), states in part: Responsibilities Principal Investigator ? Supervises expenditure of sponsored program funds and approves sub-recipient invoices (see GIM 8) to assure: o That funds are used only for purposes that directly relate to and benefit the activity supported in the award. o That expenditures are consistent with all special terms, conditions, or limitations that apply to expenditures under the particular grant or contract. o That expenditures do not exceed the total funds authorized for a given period under the grant or contract. GIM 07 ? Sponsored Program Subaward Administration, states in part: Principal Investigator ? Review and approve subaward invoices. GIM 08 ? Subrecipient Monitoring, states in part: Roles & Responsibilities PI / Department Responsibilities Project level monitoring of subrecipient including: o Reviews that expenses are necessary, reasonable, and allocable to the work completed and are aligned with technical progress. o Approve invoices for payment. Subrecipient Monitoring ? Project Level Subrecipient invoices are reviewed and approved in accordance with the requirements of GIM 2 in the manner and frequency stated in the subaward. The University of Washington I-TECH Global Operations Manual (GRef 2.3), Section 2, Finance, Accounting Policy and Procedure Requirements, states in part: In addition to the Fiscal Guidelines set forth in the I-TECH Field Operations Manual, these country specific policies are implemented at I-TECH. 10. Budget Management and Reporting f. Reports that show the variance between the budget plan and the activity for each region and activity code will be generated, reviewed and approved by the budget managers and the Management Team each month.

2022-030 The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. Federal regulations require the University to monitor its subrecipients? activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single or program-specific audit. For the Global AIDS program, the Centers for Disease Control and Prevention requires foreign subrecipients to submit their audits directly to the federal government and pass-through entity within 30 days after receiving the auditor?s report or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes onto its subrecipients, the University must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a University-funded program, federal law requires the University to issue a management decision to the subrecipient within six months of the audit report?s acceptance by the federal government. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it appropriately followed up on findings and issued management decisions. We found the University did not have adequate internal controls in place to verify whether: ? Subrecipients received required audits, if necessary, and appropriate remedies were taken if audits were not filed ? Management decisions were required to be issued for subrecipients who required a single or program-specific audit We used a nonstatistical sampling method to randomly select and examine seven out of a total population of 21 subrecipients. We found the University did not adequately monitor one subrecipient (14 percent) to ensure it received a required single or program-specific audit. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Staff in the University?s Office of Sponsored Programs (OSP) used a spreadsheet to track subrecipient certifications and responses, and reviewed annual certifications from the subrecipient to monitor its audit status. However, OSP did not correctly interpret the subrecipient?s response and, therefore, did not require it to provide documentation of a single or program-specific audit. Additionally, management did not review the subrecipient?s federal assistance expenditures to detect that it required an audit and, therefore, also failed to adequately follow up to ensure any reported findings were resolved with appropriate corrective action, if required. Effect of Condition Without establishing adequate internal controls, the University cannot ensure all subrecipients that required a single or program-specific audit received one. Furthermore, the University cannot ensure it is following up on subrecipient audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitors them for effectiveness where required, the University cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the University: ? Follow policies and procedures to ensure subrecipients receive required single or program-specific audits ? Establish and follow effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations ? Follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations ? Issue a written management decision for all applicable audit findings, if necessary University?s Response The University of Washington has established internal controls to carry out a risk assessment per Uniform Guidance, 2 CFR ? 200.332, Requirements for pass-through entities, and our UW Grants Information Memorandum (GIM) 8. This involves using various factors to assess risk. Part of our process to obtain the information needed from each subrecipient is through a certification process. The certification was obtained from the subrecipient, along with additional documentation from the subrecipient, such as an audited financial statement. We made a risk assessment using our standard risk criteria. We did misinterpret the response provided from the subrecipient regarding whether it expended $750,000 or more in federal awards during a fiscal year in order to obtain a single or program-specific audit from this subrecipient. While this was not obtained and reviewed, a risk assessment using our standard criteria was performed with the subrecipient rated as a medium risk, and subject to monitoring throughout the project, per GIM 8. The monitoring at the program level occurred during the period in question. We will be improving our required communications with subrecipients to have clear questions and responses regarding whether the subrecipient expended $750,000 or more in federal awards during the fiscal year in order to obtain a single or program-specific audit, follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations, and issue a written management decision for all applicable audit findings, if necessary. Auditor?s Remarks We thank the University for its cooperation and assistance during the audit. Whether the University performed a risk assessment for the subrecipient is not being questioned. The University did not adequately monitor the subrecipient to ensure it detected whether the subrecipient was required to receive a single audit, or program-specific audit in accordance with 2 CFR ?200.332(f). There is no other mechanism for the Federal government to monitor subrecipients of the University and, because a single audit of the subrecipient was not performed, neither the federal grantor nor the University had reasonable assurance of the subrecipient?s compliance with federal award requirements. We reaffirm our finding and will follow up on the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, establishes the following applicable requirements: Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient?s cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set for the in ?200.501 Audit requirements. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c). The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 8 ? Subrecipient Monitoring, states in part: Background Additionally, per the Federal Uniform Guidance, UW must evaluate each subrecipients? risk of noncompliance with federal regulations, include specific terms and conditions in the subaward as necessary, and monitor the activities of the subrecipient through various mechanisms. These mechanisms include: Training and technical assistance to subrecipients, on-site reviews, review of audit results, increased reporting requirements and enforcement action, if necessary. University Policy UW reviews each subrecipient entity according to an entity level comprehensive risk assessment prior to the issuance of a subaward. This risk assessment includes an entity level review of their fiscal systems, past audit activity, and if required, financial statements of the entity as well as the project specific activity proposed and that the required compliance approvals are obtained. When necessary, UW imposes limitations and requirements on the subrecipient through subaward terms and conditions per Federal Uniform Guidance, Section 200.521, prior to the issuance or renewal of a subaward. UW?s subrecipient monitoring requirements are comprised, at a minimum, of the following: ? Completion of the UW?s entity level comprehensive risk assessment (Certs & Reps, Annual Audit Certification) Subrecipient Monitoring ? Entity Level Entity level monitoring consists of a combination of the following: ? Initial Subrecipient Certification Form completion and assurance by subrecipient?s authorized official ? Annual audit assurance through an annual audit certification form ? Maintenance of a subrecipient profile list, which includes information on the entity?s past audit information and certifications ? Risk assessment carried out at each annual renewal of a subaward

2022-031 The Department of Health did not have adequate internal controls over and did not comply with requirements to ensure payments to providers were allowable, met cost principles, and were within the period of performance for the Immunization Cooperative Agreements program. Assistance Listing Number and Title: 93.268 Immunization Cooperative Agreements 93.268 COVID-19 Immunization Cooperative Agreements Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 5 NH23IP922619-03-00; 6 NH23IP922619-03-01; 6 NH23IP922619-03-02; 6 NH23IP922619-02-01; 6 NH23IP922619-02-02; 6 NH23IP922619-02-03; 6 NH23IP922619-02-04; 6 NH23IP922619-02-06 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: $4,287,159 Background The Department of Health administers the Immunization Cooperative Agreements program, which aims to reduce and ultimately eliminate vaccine-preventable diseases by increasing and maintaining high immunization coverage. Emphasis is placed on populations at highest risk for underimmunization and disease, including children eligible under the Vaccines for Children program. In fiscal year 2022, the Department spent more than $44.2 million in federal program funds, about $14.2 million of which it disbursed to subrecipients. The Department also received more than $94.5 million in non-cash assistance from the federal grantor in the form of vaccines. To help carry out the program?s objectives, the Department issues consolidated contracts to Local Health Jurisdictions that are classified as subrecipients. A consolidated contract is for one subrecipient that combines funding for multiple federal programs. Subrecipients are awarded federal funds on a reimbursement basis only. The Department assigns each subrecipient a risk level based on standardized criteria, and it maintains a matrix that specifies the documentation that subrecipients at each risk level are required to submit with every reimbursement. There are varying requirements among low, moderate and high-risk subrecipients for each of the following expense categories: ? Salaries and benefits ? Equipment ($5,000 or more) ? Materials, supplies, and other ? Travel (in-state and out-of-state) ? Contracts and sub-subrecipients ? Administrative/indirect costs The Department?s Fiscal Monitoring Unit (FMU) also conducts fiscal reviews of each subrecipient to review source documentation to ensure payments are for allowable activities and within the period of performance. During the audit period, subrecipients submitted invoices to the Department?s accounting unit where staff, on a weekly basis, compiled a list of all consolidated contract invoices into one email. The emails were sent to Department program staff requesting review to ensure the payment was allowable and within the period of performance. The emails consisted of 30 to 50 invoice requests with hundreds of pages of supporting documentation. Each invoice listed in the email would be considered approved if program staff did not respond. To address concerns about an invoice, program staff were required to email the accounting unit within 10 business days to withhold payment until the items in question were resolved. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments to providers were allowable, met cost principles, and were within the program?s period of performance. Department program staff used the documentation matrix when reviewing subrecipient payments to ensure they were for allowable activities, met cost principles, were within the period of performance, and included required supporting documentation. However, program staff did not document their review or approval, so we were unable to determine if the proper reviews occurred. During the audit period, the FMU conducted a fiscal monitoring review for four subrecipients that received program funds. We reviewed the fiscal monitoring activity for all four subrecipients and determined none of the four reviews included a detailed transaction review of program payments to ensure they had adequate supporting documentation. We used a statistical sampling method to randomly select and review 55 out of 432 provider payments. Additionally, we judgmentally reviewed two individually significant payments that exceeded $1.2 million each. In total, we examined more than $9.3 million in provider payments as part of the audit. Of the 57 payments examined, we identified 27 payments that did not have the required supporting documentation for the subrecipients? assigned risk level. This included one of the individually significant payments. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department?s established procedures allowed for paying providers without ensuring program staff reviewed and determined the payment was allowable, within the grant?s period of performance, and adequately supported. Furthermore, program management did not ensure staff followed the existing review procedures. In addition, management had not established guidance for how many transactions a fiscal reviewer needed to review to source documentation in order to have assurance the program funds were spent in accordance with grant requirements. Management also did not ensure transactions selected for review by the FMU represented all subawards issued to the subrecipient. Effect of Condition and Questioned Costs Without establishing adequate internal controls, the Department cannot reasonably ensure it is using federal funds for allowable purposes. By not ensuring subrecipients submitted required supporting documentation, staff could not adequately verify the reimbursement claims, and the Department could not ensure its subrecipients complied with the subaward?s terms and conditions. The 27 payments for which the Department did not have required supporting documentation from subrecipients totaled $4,287,159 in known questioned costs. Based on these results, we estimate that the total amount of likely improper payments using federal funds to be $5,503,611. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs,? as required by 2 CFR ? 200.516(3). To ensure a representative sample, we stratified the population by dollar amount. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Improve internal controls to ensure that it obtains adequate supporting documentation from subrecipients before reimbursing them ? Improve internal controls to ensure program staff review and approve expenditures to verify they are for allowable activities and within the period of performance prior to payment ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department?s Response We appreciate the State Auditor?s Office (SAO) audit of the Immunization Cooperative Agreement. The Department is committed to ensuring our programs comply with federal regulations and understand that it is SAO?s point of view that we did not have adequate controls over provider payments to ensure allowability in meeting cost principles and meeting period of performance. The Department partially agrees with SAO?s findings. The Department does agree and has already taken steps to improve internal controls over ensuring payments to providers contain support in line with our A-19 matrix and risk assessed of our subrecipients. Immunization staff who review invoices have been provided additional training and tracking sheets have been developed which enables staff to record details from backup documentation reviews. This ensures the proper level of review is completed and aligns with the agency?s A-19 documentation matrix. We will also be addressing the control weakness identified with the consolidated contract payment process and documenting our review and approval by program staff to ensure allowability and that funds were spent within the period of performance. It should be noted that the current process over provider payments at the Department of Health has been in place for well over a decade and has been through several annual audits by the State Auditor?s Office and separate federal reviews by our federal funders without issue. The defined process of consolidated contract payments was in response to issues arising with timely payment of funds to our local government partners. The consolidated contracts are an essential tool in providing such funding on a large scale. This process balances many needs in tracking payments, providing documentation to the programs for review as well as allowing for timely distribution of funding to the local health jurisdictions (LHJs) for state and federal programs in order to serve the residents of the State of Washington. It also simplifies the invoicing and payment process as well as reconciliation between DOH and the LHJs. We would also note that for the exceptions identified with the Fiscal Monitoring Unit (FMU) visits, for all four reviews the totality of costs charged to Immunizations during the scope of those reviews were for staffing costs. FMU test staffing as a centralized function to determine if appropriate internal controls are being utilized to ensure costs are reasonable, necessary, allowable, and allocable. During review of these agencies, FMU did not find any instances of unallowable salary costs for time keeping samples that were tested. We would respectfully disagree with the number of exceptions and questioned costs identified. While the level of support did not meet our internal policies, which are held to a higher standard than federal requirements, the level of documentation received from the subrecipient accounting system gave us assurance that the transactions/costs questioned met federal cost principles for allowability and period of performance. This, along with the following additional overall internal monitoring and policy processes support our overall assurance of the allowability of payments: ? Program staff maintain detailed budget information for each subrecipient by project area, and as A-19s are submitted, program and accounting staff update budget spreadsheets. When reviewing the support provided by the subrecipient, they ensure amounts submitted by project are reasonable and are in alignment with expectations for the budget period submitted. ? The immunization program refers to the federal Immunization Program Operations Manual (IPOM) to determine allowable costs, purchase, and procurement procedures. This information is available to all subrecipients. ? FMU provides technical assistance and training, not only to program staff, but to the subrecipients while onsite and at the request of the entities receiving funding. ? Program staff provide technical assistance, policies, and training to Immunization subrecipients related to both allowability and compliance as it relates to programmatic processes. As a compensating control, each subrecipient of federal funds receive a monitoring visit from our Fiscal Monitoring Unit (FMU) once every two years. During the course of these visits monitoring staff perform walk-throughs and assessments of the internal controls surrounding the A19 payment process. They select the most recent three A19?s submitted for funding and review all charges to appropriate source documentation to ensure allowability using cost principles as a basis. Auditor?s Remarks Department management has implemented procedures to ensure adequate documentation is reviewed to support reimbursement requests from subrecipients receiving federal funds. Our testing was based on these documentation requirements, but we do not agree that these requirements are higher than the Uniform Guidance requires. We found that payments were made without the required level of support to ensure they were allowable and met cost principles. The Department asserts that the fiscal monitoring performed every two years compensates for the lack of adequate documentation. However, we found the fiscal monitoring transaction level review for payroll and vendor reimbursement requests did not include a review of any Immunization program payments and therefore gave no assurance that grant funds were spent on allowable activities and were adequately supported. We reaffirm our finding and will follow up on the status of the Department?s corrective action during our next audit period. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. Washington State Department of Health A-19 Documentation Matrix Approved by FMU 11/30/20 This is the backup documentation required based on the determined risk level. Please ensure the detailed GL expenditure report clearly aligns with the A19 form. More supporting documentation may be requested by programs at any time due to programmatic requirements regardless of risk category. Expenditure Category Low-Risk Moderate-Risk High-Risk Salaries and Benefits A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked Note: Salaries and benefits must be broken out as separate line items. A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked Note: Salaries and benefits must be broken out as separate line items. A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked AND ? Time Sheets for all staff direct charging to the award Note: Salaries and benefits must be broken out as separate line items. Equipment ($5,000 or more) A-19 and a detailed GL expenditure report that provides vendor name and amount Note: Pre-approval documentation must be provided A-19 and a detailed GL expenditure report that provides vendor name, amount AND ? Item Description Note: Pre-approval documentation must be provided A-19 and a detailed GL expenditure report that provides vendor name, amount, item description AND ? Invoice ? Supporting documentation reflecting authorizing official?s approval. Materials, Supplies, and Other A-19 and a detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation. A-19 and a detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item AND Invoices for transactions over $1,000 Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation. A-19 and detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item AND Invoices for transactions over $200. Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation Travel A-19 and a detailed GL expenditure report that provides: ? Employee name Note: Pre-approval documentation from DOH for any out of state travel must be provided. A-19 and a detailed GL expenditure report that provides: ? Employee name AND ? Travel expense form* ? All itemized receipts * Travel expense form should include employee signature, supervisor approval and purpose. Note: Pre-approval documentation from DOH for any out of state travel must be provided. A-19 and a detailed GL expenditure report that provides: ? Employee name ? Travel expense form* ? All itemized receipts AND Pre-approval required for any flights and overnight stays. *Travel expense form should include employee signature, supervisor approval and purpose. Note: Pre-approval documentation from DOH for any out of state travel must be provided. Contracts and Sub-Subrecipients A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name AND ? Invoices for individual transactions over $1,000.00 A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name AND ? Invoices for individual transactions over $200.00. NOTE: Indirect costs included on A19s must include verification of the following: ? Indirect plan is current and on file with DOH ? Indirect rate is being applied accurately to allowable expenditures ? If the indirect cost rate plan has expired, no indirect costs can be charged

2022-031 The Department of Health did not have adequate internal controls over and did not comply with requirements to ensure payments to providers were allowable, met cost principles, and were within the period of performance for the Immunization Cooperative Agreements program. Assistance Listing Number and Title: 93.268 Immunization Cooperative Agreements 93.268 COVID-19 Immunization Cooperative Agreements Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 5 NH23IP922619-03-00; 6 NH23IP922619-03-01; 6 NH23IP922619-03-02; 6 NH23IP922619-02-01; 6 NH23IP922619-02-02; 6 NH23IP922619-02-03; 6 NH23IP922619-02-04; 6 NH23IP922619-02-06 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: $4,287,159 Background The Department of Health administers the Immunization Cooperative Agreements program, which aims to reduce and ultimately eliminate vaccine-preventable diseases by increasing and maintaining high immunization coverage. Emphasis is placed on populations at highest risk for underimmunization and disease, including children eligible under the Vaccines for Children program. In fiscal year 2022, the Department spent more than $44.2 million in federal program funds, about $14.2 million of which it disbursed to subrecipients. The Department also received more than $94.5 million in non-cash assistance from the federal grantor in the form of vaccines. To help carry out the program?s objectives, the Department issues consolidated contracts to Local Health Jurisdictions that are classified as subrecipients. A consolidated contract is for one subrecipient that combines funding for multiple federal programs. Subrecipients are awarded federal funds on a reimbursement basis only. The Department assigns each subrecipient a risk level based on standardized criteria, and it maintains a matrix that specifies the documentation that subrecipients at each risk level are required to submit with every reimbursement. There are varying requirements among low, moderate and high-risk subrecipients for each of the following expense categories: ? Salaries and benefits ? Equipment ($5,000 or more) ? Materials, supplies, and other ? Travel (in-state and out-of-state) ? Contracts and sub-subrecipients ? Administrative/indirect costs The Department?s Fiscal Monitoring Unit (FMU) also conducts fiscal reviews of each subrecipient to review source documentation to ensure payments are for allowable activities and within the period of performance. During the audit period, subrecipients submitted invoices to the Department?s accounting unit where staff, on a weekly basis, compiled a list of all consolidated contract invoices into one email. The emails were sent to Department program staff requesting review to ensure the payment was allowable and within the period of performance. The emails consisted of 30 to 50 invoice requests with hundreds of pages of supporting documentation. Each invoice listed in the email would be considered approved if program staff did not respond. To address concerns about an invoice, program staff were required to email the accounting unit within 10 business days to withhold payment until the items in question were resolved. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments to providers were allowable, met cost principles, and were within the program?s period of performance. Department program staff used the documentation matrix when reviewing subrecipient payments to ensure they were for allowable activities, met cost principles, were within the period of performance, and included required supporting documentation. However, program staff did not document their review or approval, so we were unable to determine if the proper reviews occurred. During the audit period, the FMU conducted a fiscal monitoring review for four subrecipients that received program funds. We reviewed the fiscal monitoring activity for all four subrecipients and determined none of the four reviews included a detailed transaction review of program payments to ensure they had adequate supporting documentation. We used a statistical sampling method to randomly select and review 55 out of 432 provider payments. Additionally, we judgmentally reviewed two individually significant payments that exceeded $1.2 million each. In total, we examined more than $9.3 million in provider payments as part of the audit. Of the 57 payments examined, we identified 27 payments that did not have the required supporting documentation for the subrecipients? assigned risk level. This included one of the individually significant payments. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department?s established procedures allowed for paying providers without ensuring program staff reviewed and determined the payment was allowable, within the grant?s period of performance, and adequately supported. Furthermore, program management did not ensure staff followed the existing review procedures. In addition, management had not established guidance for how many transactions a fiscal reviewer needed to review to source documentation in order to have assurance the program funds were spent in accordance with grant requirements. Management also did not ensure transactions selected for review by the FMU represented all subawards issued to the subrecipient. Effect of Condition and Questioned Costs Without establishing adequate internal controls, the Department cannot reasonably ensure it is using federal funds for allowable purposes. By not ensuring subrecipients submitted required supporting documentation, staff could not adequately verify the reimbursement claims, and the Department could not ensure its subrecipients complied with the subaward?s terms and conditions. The 27 payments for which the Department did not have required supporting documentation from subrecipients totaled $4,287,159 in known questioned costs. Based on these results, we estimate that the total amount of likely improper payments using federal funds to be $5,503,611. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs,? as required by 2 CFR ? 200.516(3). To ensure a representative sample, we stratified the population by dollar amount. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Improve internal controls to ensure that it obtains adequate supporting documentation from subrecipients before reimbursing them ? Improve internal controls to ensure program staff review and approve expenditures to verify they are for allowable activities and within the period of performance prior to payment ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department?s Response We appreciate the State Auditor?s Office (SAO) audit of the Immunization Cooperative Agreement. The Department is committed to ensuring our programs comply with federal regulations and understand that it is SAO?s point of view that we did not have adequate controls over provider payments to ensure allowability in meeting cost principles and meeting period of performance. The Department partially agrees with SAO?s findings. The Department does agree and has already taken steps to improve internal controls over ensuring payments to providers contain support in line with our A-19 matrix and risk assessed of our subrecipients. Immunization staff who review invoices have been provided additional training and tracking sheets have been developed which enables staff to record details from backup documentation reviews. This ensures the proper level of review is completed and aligns with the agency?s A-19 documentation matrix. We will also be addressing the control weakness identified with the consolidated contract payment process and documenting our review and approval by program staff to ensure allowability and that funds were spent within the period of performance. It should be noted that the current process over provider payments at the Department of Health has been in place for well over a decade and has been through several annual audits by the State Auditor?s Office and separate federal reviews by our federal funders without issue. The defined process of consolidated contract payments was in response to issues arising with timely payment of funds to our local government partners. The consolidated contracts are an essential tool in providing such funding on a large scale. This process balances many needs in tracking payments, providing documentation to the programs for review as well as allowing for timely distribution of funding to the local health jurisdictions (LHJs) for state and federal programs in order to serve the residents of the State of Washington. It also simplifies the invoicing and payment process as well as reconciliation between DOH and the LHJs. We would also note that for the exceptions identified with the Fiscal Monitoring Unit (FMU) visits, for all four reviews the totality of costs charged to Immunizations during the scope of those reviews were for staffing costs. FMU test staffing as a centralized function to determine if appropriate internal controls are being utilized to ensure costs are reasonable, necessary, allowable, and allocable. During review of these agencies, FMU did not find any instances of unallowable salary costs for time keeping samples that were tested. We would respectfully disagree with the number of exceptions and questioned costs identified. While the level of support did not meet our internal policies, which are held to a higher standard than federal requirements, the level of documentation received from the subrecipient accounting system gave us assurance that the transactions/costs questioned met federal cost principles for allowability and period of performance. This, along with the following additional overall internal monitoring and policy processes support our overall assurance of the allowability of payments: ? Program staff maintain detailed budget information for each subrecipient by project area, and as A-19s are submitted, program and accounting staff update budget spreadsheets. When reviewing the support provided by the subrecipient, they ensure amounts submitted by project are reasonable and are in alignment with expectations for the budget period submitted. ? The immunization program refers to the federal Immunization Program Operations Manual (IPOM) to determine allowable costs, purchase, and procurement procedures. This information is available to all subrecipients. ? FMU provides technical assistance and training, not only to program staff, but to the subrecipients while onsite and at the request of the entities receiving funding. ? Program staff provide technical assistance, policies, and training to Immunization subrecipients related to both allowability and compliance as it relates to programmatic processes. As a compensating control, each subrecipient of federal funds receive a monitoring visit from our Fiscal Monitoring Unit (FMU) once every two years. During the course of these visits monitoring staff perform walk-throughs and assessments of the internal controls surrounding the A19 payment process. They select the most recent three A19?s submitted for funding and review all charges to appropriate source documentation to ensure allowability using cost principles as a basis. Auditor?s Remarks Department management has implemented procedures to ensure adequate documentation is reviewed to support reimbursement requests from subrecipients receiving federal funds. Our testing was based on these documentation requirements, but we do not agree that these requirements are higher than the Uniform Guidance requires. We found that payments were made without the required level of support to ensure they were allowable and met cost principles. The Department asserts that the fiscal monitoring performed every two years compensates for the lack of adequate documentation. However, we found the fiscal monitoring transaction level review for payroll and vendor reimbursement requests did not include a review of any Immunization program payments and therefore gave no assurance that grant funds were spent on allowable activities and were adequately supported. We reaffirm our finding and will follow up on the status of the Department?s corrective action during our next audit period. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. Washington State Department of Health A-19 Documentation Matrix Approved by FMU 11/30/20 This is the backup documentation required based on the determined risk level. Please ensure the detailed GL expenditure report clearly aligns with the A19 form. More supporting documentation may be requested by programs at any time due to programmatic requirements regardless of risk category. Expenditure Category Low-Risk Moderate-Risk High-Risk Salaries and Benefits A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked Note: Salaries and benefits must be broken out as separate line items. A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked Note: Salaries and benefits must be broken out as separate line items. A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked AND ? Time Sheets for all staff direct charging to the award Note: Salaries and benefits must be broken out as separate line items. Equipment ($5,000 or more) A-19 and a detailed GL expenditure report that provides vendor name and amount Note: Pre-approval documentation must be provided A-19 and a detailed GL expenditure report that provides vendor name, amount AND ? Item Description Note: Pre-approval documentation must be provided A-19 and a detailed GL expenditure report that provides vendor name, amount, item description AND ? Invoice ? Supporting documentation reflecting authorizing official?s approval. Materials, Supplies, and Other A-19 and a detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation. A-19 and a detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item AND Invoices for transactions over $1,000 Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation. A-19 and detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item AND Invoices for transactions over $200. Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation Travel A-19 and a detailed GL expenditure report that provides: ? Employee name Note: Pre-approval documentation from DOH for any out of state travel must be provided. A-19 and a detailed GL expenditure report that provides: ? Employee name AND ? Travel expense form* ? All itemized receipts * Travel expense form should include employee signature, supervisor approval and purpose. Note: Pre-approval documentation from DOH for any out of state travel must be provided. A-19 and a detailed GL expenditure report that provides: ? Employee name ? Travel expense form* ? All itemized receipts AND Pre-approval required for any flights and overnight stays. *Travel expense form should include employee signature, supervisor approval and purpose. Note: Pre-approval documentation from DOH for any out of state travel must be provided. Contracts and Sub-Subrecipients A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name AND ? Invoices for individual transactions over $1,000.00 A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name AND ? Invoices for individual transactions over $200.00. NOTE: Indirect costs included on A19s must include verification of the following: ? Indirect plan is current and on file with DOH ? Indirect rate is being applied accurately to allowable expenditures ? If the indirect cost rate plan has expired, no indirect costs can be charged

2022-031 The Department of Health did not have adequate internal controls over and did not comply with requirements to ensure payments to providers were allowable, met cost principles, and were within the period of performance for the Immunization Cooperative Agreements program. Assistance Listing Number and Title: 93.268 Immunization Cooperative Agreements 93.268 COVID-19 Immunization Cooperative Agreements Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 5 NH23IP922619-03-00; 6 NH23IP922619-03-01; 6 NH23IP922619-03-02; 6 NH23IP922619-02-01; 6 NH23IP922619-02-02; 6 NH23IP922619-02-03; 6 NH23IP922619-02-04; 6 NH23IP922619-02-06 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: $4,287,159 Background The Department of Health administers the Immunization Cooperative Agreements program, which aims to reduce and ultimately eliminate vaccine-preventable diseases by increasing and maintaining high immunization coverage. Emphasis is placed on populations at highest risk for underimmunization and disease, including children eligible under the Vaccines for Children program. In fiscal year 2022, the Department spent more than $44.2 million in federal program funds, about $14.2 million of which it disbursed to subrecipients. The Department also received more than $94.5 million in non-cash assistance from the federal grantor in the form of vaccines. To help carry out the program?s objectives, the Department issues consolidated contracts to Local Health Jurisdictions that are classified as subrecipients. A consolidated contract is for one subrecipient that combines funding for multiple federal programs. Subrecipients are awarded federal funds on a reimbursement basis only. The Department assigns each subrecipient a risk level based on standardized criteria, and it maintains a matrix that specifies the documentation that subrecipients at each risk level are required to submit with every reimbursement. There are varying requirements among low, moderate and high-risk subrecipients for each of the following expense categories: ? Salaries and benefits ? Equipment ($5,000 or more) ? Materials, supplies, and other ? Travel (in-state and out-of-state) ? Contracts and sub-subrecipients ? Administrative/indirect costs The Department?s Fiscal Monitoring Unit (FMU) also conducts fiscal reviews of each subrecipient to review source documentation to ensure payments are for allowable activities and within the period of performance. During the audit period, subrecipients submitted invoices to the Department?s accounting unit where staff, on a weekly basis, compiled a list of all consolidated contract invoices into one email. The emails were sent to Department program staff requesting review to ensure the payment was allowable and within the period of performance. The emails consisted of 30 to 50 invoice requests with hundreds of pages of supporting documentation. Each invoice listed in the email would be considered approved if program staff did not respond. To address concerns about an invoice, program staff were required to email the accounting unit within 10 business days to withhold payment until the items in question were resolved. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments to providers were allowable, met cost principles, and were within the program?s period of performance. Department program staff used the documentation matrix when reviewing subrecipient payments to ensure they were for allowable activities, met cost principles, were within the period of performance, and included required supporting documentation. However, program staff did not document their review or approval, so we were unable to determine if the proper reviews occurred. During the audit period, the FMU conducted a fiscal monitoring review for four subrecipients that received program funds. We reviewed the fiscal monitoring activity for all four subrecipients and determined none of the four reviews included a detailed transaction review of program payments to ensure they had adequate supporting documentation. We used a statistical sampling method to randomly select and review 55 out of 432 provider payments. Additionally, we judgmentally reviewed two individually significant payments that exceeded $1.2 million each. In total, we examined more than $9.3 million in provider payments as part of the audit. Of the 57 payments examined, we identified 27 payments that did not have the required supporting documentation for the subrecipients? assigned risk level. This included one of the individually significant payments. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department?s established procedures allowed for paying providers without ensuring program staff reviewed and determined the payment was allowable, within the grant?s period of performance, and adequately supported. Furthermore, program management did not ensure staff followed the existing review procedures. In addition, management had not established guidance for how many transactions a fiscal reviewer needed to review to source documentation in order to have assurance the program funds were spent in accordance with grant requirements. Management also did not ensure transactions selected for review by the FMU represented all subawards issued to the subrecipient. Effect of Condition and Questioned Costs Without establishing adequate internal controls, the Department cannot reasonably ensure it is using federal funds for allowable purposes. By not ensuring subrecipients submitted required supporting documentation, staff could not adequately verify the reimbursement claims, and the Department could not ensure its subrecipients complied with the subaward?s terms and conditions. The 27 payments for which the Department did not have required supporting documentation from subrecipients totaled $4,287,159 in known questioned costs. Based on these results, we estimate that the total amount of likely improper payments using federal funds to be $5,503,611. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs,? as required by 2 CFR ? 200.516(3). To ensure a representative sample, we stratified the population by dollar amount. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Improve internal controls to ensure that it obtains adequate supporting documentation from subrecipients before reimbursing them ? Improve internal controls to ensure program staff review and approve expenditures to verify they are for allowable activities and within the period of performance prior to payment ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department?s Response We appreciate the State Auditor?s Office (SAO) audit of the Immunization Cooperative Agreement. The Department is committed to ensuring our programs comply with federal regulations and understand that it is SAO?s point of view that we did not have adequate controls over provider payments to ensure allowability in meeting cost principles and meeting period of performance. The Department partially agrees with SAO?s findings. The Department does agree and has already taken steps to improve internal controls over ensuring payments to providers contain support in line with our A-19 matrix and risk assessed of our subrecipients. Immunization staff who review invoices have been provided additional training and tracking sheets have been developed which enables staff to record details from backup documentation reviews. This ensures the proper level of review is completed and aligns with the agency?s A-19 documentation matrix. We will also be addressing the control weakness identified with the consolidated contract payment process and documenting our review and approval by program staff to ensure allowability and that funds were spent within the period of performance. It should be noted that the current process over provider payments at the Department of Health has been in place for well over a decade and has been through several annual audits by the State Auditor?s Office and separate federal reviews by our federal funders without issue. The defined process of consolidated contract payments was in response to issues arising with timely payment of funds to our local government partners. The consolidated contracts are an essential tool in providing such funding on a large scale. This process balances many needs in tracking payments, providing documentation to the programs for review as well as allowing for timely distribution of funding to the local health jurisdictions (LHJs) for state and federal programs in order to serve the residents of the State of Washington. It also simplifies the invoicing and payment process as well as reconciliation between DOH and the LHJs. We would also note that for the exceptions identified with the Fiscal Monitoring Unit (FMU) visits, for all four reviews the totality of costs charged to Immunizations during the scope of those reviews were for staffing costs. FMU test staffing as a centralized function to determine if appropriate internal controls are being utilized to ensure costs are reasonable, necessary, allowable, and allocable. During review of these agencies, FMU did not find any instances of unallowable salary costs for time keeping samples that were tested. We would respectfully disagree with the number of exceptions and questioned costs identified. While the level of support did not meet our internal policies, which are held to a higher standard than federal requirements, the level of documentation received from the subrecipient accounting system gave us assurance that the transactions/costs questioned met federal cost principles for allowability and period of performance. This, along with the following additional overall internal monitoring and policy processes support our overall assurance of the allowability of payments: ? Program staff maintain detailed budget information for each subrecipient by project area, and as A-19s are submitted, program and accounting staff update budget spreadsheets. When reviewing the support provided by the subrecipient, they ensure amounts submitted by project are reasonable and are in alignment with expectations for the budget period submitted. ? The immunization program refers to the federal Immunization Program Operations Manual (IPOM) to determine allowable costs, purchase, and procurement procedures. This information is available to all subrecipients. ? FMU provides technical assistance and training, not only to program staff, but to the subrecipients while onsite and at the request of the entities receiving funding. ? Program staff provide technical assistance, policies, and training to Immunization subrecipients related to both allowability and compliance as it relates to programmatic processes. As a compensating control, each subrecipient of federal funds receive a monitoring visit from our Fiscal Monitoring Unit (FMU) once every two years. During the course of these visits monitoring staff perform walk-throughs and assessments of the internal controls surrounding the A19 payment process. They select the most recent three A19?s submitted for funding and review all charges to appropriate source documentation to ensure allowability using cost principles as a basis. Auditor?s Remarks Department management has implemented procedures to ensure adequate documentation is reviewed to support reimbursement requests from subrecipients receiving federal funds. Our testing was based on these documentation requirements, but we do not agree that these requirements are higher than the Uniform Guidance requires. We found that payments were made without the required level of support to ensure they were allowable and met cost principles. The Department asserts that the fiscal monitoring performed every two years compensates for the lack of adequate documentation. However, we found the fiscal monitoring transaction level review for payroll and vendor reimbursement requests did not include a review of any Immunization program payments and therefore gave no assurance that grant funds were spent on allowable activities and were adequately supported. We reaffirm our finding and will follow up on the status of the Department?s corrective action during our next audit period. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. Washington State Department of Health A-19 Documentation Matrix Approved by FMU 11/30/20 This is the backup documentation required based on the determined risk level. Please ensure the detailed GL expenditure report clearly aligns with the A19 form. More supporting documentation may be requested by programs at any time due to programmatic requirements regardless of risk category. Expenditure Category Low-Risk Moderate-Risk High-Risk Salaries and Benefits A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked Note: Salaries and benefits must be broken out as separate line items. A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked Note: Salaries and benefits must be broken out as separate line items. A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked AND ? Time Sheets for all staff direct charging to the award Note: Salaries and benefits must be broken out as separate line items. Equipment ($5,000 or more) A-19 and a detailed GL expenditure report that provides vendor name and amount Note: Pre-approval documentation must be provided A-19 and a detailed GL expenditure report that provides vendor name, amount AND ? Item Description Note: Pre-approval documentation must be provided A-19 and a detailed GL expenditure report that provides vendor name, amount, item description AND ? Invoice ? Supporting documentation reflecting authorizing official?s approval. Materials, Supplies, and Other A-19 and a detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation. A-19 and a detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item AND Invoices for transactions over $1,000 Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation. A-19 and detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item AND Invoices for transactions over $200. Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation Travel A-19 and a detailed GL expenditure report that provides: ? Employee name Note: Pre-approval documentation from DOH for any out of state travel must be provided. A-19 and a detailed GL expenditure report that provides: ? Employee name AND ? Travel expense form* ? All itemized receipts * Travel expense form should include employee signature, supervisor approval and purpose. Note: Pre-approval documentation from DOH for any out of state travel must be provided. A-19 and a detailed GL expenditure report that provides: ? Employee name ? Travel expense form* ? All itemized receipts AND Pre-approval required for any flights and overnight stays. *Travel expense form should include employee signature, supervisor approval and purpose. Note: Pre-approval documentation from DOH for any out of state travel must be provided. Contracts and Sub-Subrecipients A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name AND ? Invoices for individual transactions over $1,000.00 A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name AND ? Invoices for individual transactions over $200.00. NOTE: Indirect costs included on A19s must include verification of the following: ? Indirect plan is current and on file with DOH ? Indirect rate is being applied accurately to allowable expenditures ? If the indirect cost rate plan has expired, no indirect costs can be charged

2022-033 The Department of Health did not have adequate internal controls over and did not comply with fiscal monitoring requirements to ensure subrecipients of the Epidemiology and Laboratory Capacity for Infectious Diseases program only used funds for allowable activities and met cost principles. Assistance Listing Number and Title: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases 93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Health and Human Services Federal Award Number: NU50CK000515-01-00; NU50CK000515-01-06; NU50CK000515-01-07; NU50CK000515-01-08; NU50CK000515-01-09; NU50CK000515-02-00; NU50CK000515-02-01; NU50CK000515-02-03; NU50CK000515-02-04; NU50CK000515-02-06; NU50CK000515-02-07; NU50CK000515-02-09; NU50CK000515-03-00; NU50CK000515-03-01; NU50CK000515-03-03 Pass-through Entity: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Subrecipient Monitoring Known Questioned Cost Amount: $1,644,873 Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local, and territories? public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction, and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory, and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports several specific infectious disease programs and projects and provides special appropriations in response to infectious disease emergencies. The Department spent almost $330 million in federal grant funds in fiscal year 2022, about $103 million of which it disbursed to subrecipients. To help carry out the program?s objectives, the Department issues consolidated contracts to Local Health Jurisdictions that are classified as subrecipients. A consolidated contract is for one subrecipient that combines funding for multiple federal programs. Subrecipients are awarded federal funds on a reimbursement basis only. The Department assigns each subrecipient a risk level based on standardized criteria, and it maintains a matrix that specifies the documentation that subrecipients at each risk level are required to submit with every reimbursement. There are varying requirements among low, moderate and high-risk subrecipients for each of the following expense categories: ? Salaries and benefits ? Equipment ($5,000 or more) ? Materials, supplies, and other ? Travel (in-state and out-of-state) ? Contracts and sub-subrecipients ? Administrative/indirect costs The Department?s Fiscal Monitoring Unit (FMU) also conducts fiscal reviews of each subrecipient every two years to review source documentation to ensure payments are for allowable activities. A fiscal reviewer completes a standardized template to document what federal programs and reimbursement payment samples are reviewed. The fiscal reviewer judgmentally determines how many samples to test. During the audit period, subrecipients submitted invoices to the Department?s accounting unit where staff, on a weekly basis, compiled a list of all consolidated contract invoices into one email. The emails were sent to Department program staff requesting review to ensure the payment was allowable. The emails consisted of 30 to 50 invoice requests with hundreds of pages of supporting documentation. Each invoice listed in the email would be considered approved if program staff did not respond. To address concerns about an invoice, program staff were required to email the accounting unit within 10 business days to withhold payment until the items in question were resolved. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments to providers were allowable and met cost principles. Department program staff were required to use the documentation matrix when reviewing subrecipient payments to ensure they were for allowable activities, met cost principles, and included required supporting documentation. However, program staff did not document their review or approval to the accounting unit that issues payment, so we were unable to determine if the proper reviews occurred. We used a statistical sampling method to randomly select and review 57 out of 880 provider payments. Additionally, we judgmentally reviewed three individually significant payments that exceeded $5.5 million each. In total, we examined more than $75.4 million in provider payments as part of the audit. Of the 57 randomly selected payments examined, we identified four payments (7 percent) that did not have the required supporting documentation for the subrecipients? assigned risk level. For fiscal monitoring, we used a nonstatistical sampling method to randomly select and examine five out of a total of eight subrecipients that received a review during the audit period. We found that none of the detailed transactions reviewed were noted as being for the ELC program. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department?s established procedures allowed for paying providers without ensuring program staff reviewed and determined the payment was allowable and adequately supported. Furthermore, program management did not ensure staff followed the existing review procedures. In addition, management had not established guidance for how many transactions a fiscal reviewer needed to review to source documentation in order to have assurance the program funds were spent in accordance with grant requirements. Management also decided that all pandemic-related programs would be documented as ?COVID? on the detailed testing section of the standardized template. Therefore, it was not possible to determine if any ELC transactions were reviewed. Effect of Condition and Questioned Costs Without establishing adequate internal controls, the Department cannot reasonably ensure it is using federal funds for allowable purposes. By not ensuring subrecipients submitted required supporting documentation, staff could not adequately verify the reimbursement claims, and the Department could not ensure its subrecipients complied with the subaward?s terms and conditions. Allowing staff to select samples without adequate guidance from management does not provide the Department with reasonable assurance that subrecipients spent program funds in accordance with grant requirements and federal regulations. Additionally, because the reviewers do not document which specific pandemic-related federal program is being covered in the transaction-level testing, management cannot perform sufficient oversight to ensure the Department has met federal requirements. The four payments for which the Department did not have required supporting documentation from subrecipients totaled $1,644,873 in known questioned costs. Based on these results, we estimate that the total amount of likely improper payments using federal funds to be $2,905,694. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflect this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs,? as required by 2 CFR ? 200.516(3). To ensure a representative sample, we stratified the population by dollar amount (if applicable). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Improve internal controls to ensure that it obtains adequate supporting documentation from subrecipients before reimbursing them ? Improve internal controls to ensure program staff review and approve expenditures to verify they are for allowable activities prior to payment ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department?s Response We appreciate the State Auditor?s Office (SAO) audit of the Epidemiology and Laboratory Capacity (ELC) for Infectious Diseases program. The Department of Health (DOH) is committed to ensuring our programs comply with federal regulations and would like to thank SAO for their work over the activities allowed and subrecipient monitoring requirements on the audit. The Department partially agrees with the finding. DOH would like to note that during the timeframe of this audit the Department and ELC program was in full COVID pandemic response mode. DOH was the leading agency charged with implementing a statewide response to an unprecedented pandemic. During this audit period, DOH?s ELC Grants, and fiscal teams managed 27 newly awarded ELC grants totaling close to one billion dollars, which included applications, planning, restructuring, and monitoring. There were many emergency declarations that were also in place as well, creating new processes that staff were not familiar with, which created an environment where many of the normal day-to-day operations were pushed to their limits as well as the staff performing them. The COVID pandemic has shown us where we may have gaps in our processes, and we are diligently working to not only fill those gaps but to be better prepared for the next emergency response. The Department does agree and is taking steps to improve internal controls over ensuring payments to providers contain support in line with our A19 matrix and risk assessed of our subrecipients. ELC staff who review invoices will be provided additional training and tracking sheets have been developed which enables staff to record details from backup documentation reviews. This ensures the proper level of review is completed and aligns with the agency?s A-19 documentation matrix. Moving forward we?ve updated our A19 matrix to be more in line with federal guidance and the identified risk levels. The Department partially agrees with SAO?s assessment of a material weakness in internal controls over Subrecipient Monitoring. DOH agrees that the detailed transactions reviewed identified as being for ?COVID? should have been specified to the specific revenue source and will do so in future monitoring visits. However, the Department would disagree that this is a material weakness over the subrecipient monitoring process. While the specific revenue source was not identified in testing allowability, monitoring staff document key control systems such as payroll and disbursements when conducting a fiscal monitoring site visit. When testing, this ensures those controls are operating effectively and provide assurance that amounts reported for reimbursement are allowable and accurate. Thus, not all transactions for that period may be tested. The Department respectfully disagrees with SAO?s assessment of a material weakness in internal controls over the consolidated contract provider payment process to ensure allowability in meeting cost principles with our ELC program. When accounting staff send the A19 consolidated contract invoices to the applicable programs ELC program staff review invoice support for allowability and period of performance and keep a spreadsheet with a breakdown of the total payment requested for ELC. If the payment has no issues or concerns, the total payment is logged in the spreadsheet and staff save the spreadsheet to denote no issues and evidence of review and that full payment can be made. If there is a question on allowable cost, period of performance, a need for additional backup documentation or an error, program ELC staff will update spreadsheet with the amounts in question and communicate with the Local Health Jurisdiction, document the correspondence, and contact the accounting consolidated contract payment desk to withhold the specific amount of payment until the issue is resolved. Once resolved staff update the spreadsheet to denote the issue has been resolved and email accounting to release the payment amount in question. It should be noted that the current process over provider payments at the Department of Health has been in place for well over a decade and has been through several annual audits by the State Auditor?s Office and separate federal reviews by our federal funders without issue. The defined process of consolidated contract payments was in response to issues arising with timely payment of funds to our local government partners. The consolidated contracts are an essential tool in providing such funding on a large scale. This process balances many needs in tracking payments, providing documentation to the programs for review as well as allowing for timely distribution of funding to the local health jurisdictions (LHJs) for state and federal programs in order to serve the residents of the State of Washington. It also simplifies the invoicing and payment process as well as reconciliation between DOH and the LHJs. We would also respectfully disagree with the number of exceptions and questioned costs identified. While the level of support did not meet our internal policies, which are held to a higher standard than federal requirements, the level of documentation received from the subrecipient accounting system gave us assurance that the transactions/costs questioned met federal cost principles for allowability and period of performance. This, along with the following additional overall internal monitoring and policy processes support our overall assurance of the allowability of payments: ? Detailed ELC budgets were originally submitted by the subrecipient, reviewed and approved by Program staff so that they can ensure costs will be reasonable and are in alignment with expectations for the budget period submitted over time. No payment is made to an entity without that approved budget. ? The ELC program has allowable cost guidance documents that are provided to the subrecipients initially, on their SOWs, and after any changes. ? The ELC program/contract managers meet with subrecipients routinely (monthly or bi-monthly) to monitor progress of the work, resources, capacity, and budget management are discussed as well. ? Program staff provide technical assistance and policies to subrecipients related to both allowability and compliance as it relates to programmatic processes. Auditor?s Remarks Department management has implemented procedures to ensure adequate documentation is reviewed to support reimbursement requests from subrecipients receiving federal funds. Our testing was based on these documentation requirements, but we do not agree that these requirements are higher than the Uniform Guidance requires. We found that payments were made without the required level of support to ensure they were allowable and met cost principles. The Department asserts that the fiscal monitoring performed every two years compensates for the lack of adequate documentation. However, we found the fiscal monitoring transaction level review for payroll and vendor reimbursement requests did not specifically include a review of any ELC payments and therefore gave no assurance that grant funds were spent on allowable activities and were adequately supported. We reaffirm our finding and will follow up on the status of the Department?s corrective action during our next audit period. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Washington State Department of Health A-19 Documentation Matrix Approved by FMU 11/30/20 This is the backup documentation required based on the determined risk level. Please ensure the detailed GL expenditure report clearly aligns with the A19 form. More supporting documentation may be requested by programs at any time due to programmatic requirements regardless of risk category. Expenditure Category Low-Risk Moderate-Risk High-Risk Salaries and Benefits A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked Note: Salaries and benefits must be broken out as separate line items. A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked Note: Salaries and benefits must be broken out as separate line items. A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked AND ? Time Sheets for all staff direct charging to the award Note: Salaries and benefits must be broken out as separate line items. Equipment ($5,000 or more) A-19 and a detailed GL expenditure report that provides vendor name and amount Note: Pre-approval documentation must be provided A-19 and a detailed GL expenditure report that provides vendor name, amount AND ? Item Description Note: Pre-approval documentation must be provided A-19 and a detailed GL expenditure report that provides vendor name, amount, item description AND ? Invoice ? Supporting documentation reflecting authorizing official?s approval. Materials, Supplies, and Other A-19 and a detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation. A-19 and a detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item AND Invoices for transactions over $1,000 Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation. A-19 and detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item AND Invoices for transactions over $200. Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation Travel A-19 and a detailed GL expenditure report that provides: ? Employee name Note: Pre-approval documentation from DOH for any out of state travel must be provided. A-19 and a detailed GL expenditure report that provides: ? Employee name AND ? Travel expense form* ? All itemized receipts * Travel expense form should include employee signature, supervisor approval and purpose. Note: Pre-approval documentation from DOH for any out of state travel must be provided. A-19 and a detailed GL expenditure report that provides: ? Employee name ? Travel expense form* ? All itemized receipts AND Pre-approval required for any flights and overnight stays. *Travel expense form should include employee signature, supervisor approval and purpose. Note: Pre-approval documentation from DOH for any out of state travel must be provided. Contracts and Sub-Subrecipients A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name AND ? Invoices for individual transactions over $1,000.00 A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name AND ? Invoices for individual transactions over $200.00. NOTE: Indirect costs included on A19s must include verification of the following: ? Indirect plan is current and on file with DOH ? Indirect rate is being applied accurately to allowable expenditures ? If the indirect cost rate plan has expired, no indirect costs can be charged

2022-033 The Department of Health did not have adequate internal controls over and did not comply with fiscal monitoring requirements to ensure subrecipients of the Epidemiology and Laboratory Capacity for Infectious Diseases program only used funds for allowable activities and met cost principles. Assistance Listing Number and Title: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases 93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Health and Human Services Federal Award Number: NU50CK000515-01-00; NU50CK000515-01-06; NU50CK000515-01-07; NU50CK000515-01-08; NU50CK000515-01-09; NU50CK000515-02-00; NU50CK000515-02-01; NU50CK000515-02-03; NU50CK000515-02-04; NU50CK000515-02-06; NU50CK000515-02-07; NU50CK000515-02-09; NU50CK000515-03-00; NU50CK000515-03-01; NU50CK000515-03-03 Pass-through Entity: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Subrecipient Monitoring Known Questioned Cost Amount: $1,644,873 Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local, and territories? public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction, and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory, and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports several specific infectious disease programs and projects and provides special appropriations in response to infectious disease emergencies. The Department spent almost $330 million in federal grant funds in fiscal year 2022, about $103 million of which it disbursed to subrecipients. To help carry out the program?s objectives, the Department issues consolidated contracts to Local Health Jurisdictions that are classified as subrecipients. A consolidated contract is for one subrecipient that combines funding for multiple federal programs. Subrecipients are awarded federal funds on a reimbursement basis only. The Department assigns each subrecipient a risk level based on standardized criteria, and it maintains a matrix that specifies the documentation that subrecipients at each risk level are required to submit with every reimbursement. There are varying requirements among low, moderate and high-risk subrecipients for each of the following expense categories: ? Salaries and benefits ? Equipment ($5,000 or more) ? Materials, supplies, and other ? Travel (in-state and out-of-state) ? Contracts and sub-subrecipients ? Administrative/indirect costs The Department?s Fiscal Monitoring Unit (FMU) also conducts fiscal reviews of each subrecipient every two years to review source documentation to ensure payments are for allowable activities. A fiscal reviewer completes a standardized template to document what federal programs and reimbursement payment samples are reviewed. The fiscal reviewer judgmentally determines how many samples to test. During the audit period, subrecipients submitted invoices to the Department?s accounting unit where staff, on a weekly basis, compiled a list of all consolidated contract invoices into one email. The emails were sent to Department program staff requesting review to ensure the payment was allowable. The emails consisted of 30 to 50 invoice requests with hundreds of pages of supporting documentation. Each invoice listed in the email would be considered approved if program staff did not respond. To address concerns about an invoice, program staff were required to email the accounting unit within 10 business days to withhold payment until the items in question were resolved. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments to providers were allowable and met cost principles. Department program staff were required to use the documentation matrix when reviewing subrecipient payments to ensure they were for allowable activities, met cost principles, and included required supporting documentation. However, program staff did not document their review or approval to the accounting unit that issues payment, so we were unable to determine if the proper reviews occurred. We used a statistical sampling method to randomly select and review 57 out of 880 provider payments. Additionally, we judgmentally reviewed three individually significant payments that exceeded $5.5 million each. In total, we examined more than $75.4 million in provider payments as part of the audit. Of the 57 randomly selected payments examined, we identified four payments (7 percent) that did not have the required supporting documentation for the subrecipients? assigned risk level. For fiscal monitoring, we used a nonstatistical sampling method to randomly select and examine five out of a total of eight subrecipients that received a review during the audit period. We found that none of the detailed transactions reviewed were noted as being for the ELC program. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department?s established procedures allowed for paying providers without ensuring program staff reviewed and determined the payment was allowable and adequately supported. Furthermore, program management did not ensure staff followed the existing review procedures. In addition, management had not established guidance for how many transactions a fiscal reviewer needed to review to source documentation in order to have assurance the program funds were spent in accordance with grant requirements. Management also decided that all pandemic-related programs would be documented as ?COVID? on the detailed testing section of the standardized template. Therefore, it was not possible to determine if any ELC transactions were reviewed. Effect of Condition and Questioned Costs Without establishing adequate internal controls, the Department cannot reasonably ensure it is using federal funds for allowable purposes. By not ensuring subrecipients submitted required supporting documentation, staff could not adequately verify the reimbursement claims, and the Department could not ensure its subrecipients complied with the subaward?s terms and conditions. Allowing staff to select samples without adequate guidance from management does not provide the Department with reasonable assurance that subrecipients spent program funds in accordance with grant requirements and federal regulations. Additionally, because the reviewers do not document which specific pandemic-related federal program is being covered in the transaction-level testing, management cannot perform sufficient oversight to ensure the Department has met federal requirements. The four payments for which the Department did not have required supporting documentation from subrecipients totaled $1,644,873 in known questioned costs. Based on these results, we estimate that the total amount of likely improper payments using federal funds to be $2,905,694. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflect this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs,? as required by 2 CFR ? 200.516(3). To ensure a representative sample, we stratified the population by dollar amount (if applicable). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Improve internal controls to ensure that it obtains adequate supporting documentation from subrecipients before reimbursing them ? Improve internal controls to ensure program staff review and approve expenditures to verify they are for allowable activities prior to payment ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department?s Response We appreciate the State Auditor?s Office (SAO) audit of the Epidemiology and Laboratory Capacity (ELC) for Infectious Diseases program. The Department of Health (DOH) is committed to ensuring our programs comply with federal regulations and would like to thank SAO for their work over the activities allowed and subrecipient monitoring requirements on the audit. The Department partially agrees with the finding. DOH would like to note that during the timeframe of this audit the Department and ELC program was in full COVID pandemic response mode. DOH was the leading agency charged with implementing a statewide response to an unprecedented pandemic. During this audit period, DOH?s ELC Grants, and fiscal teams managed 27 newly awarded ELC grants totaling close to one billion dollars, which included applications, planning, restructuring, and monitoring. There were many emergency declarations that were also in place as well, creating new processes that staff were not familiar with, which created an environment where many of the normal day-to-day operations were pushed to their limits as well as the staff performing them. The COVID pandemic has shown us where we may have gaps in our processes, and we are diligently working to not only fill those gaps but to be better prepared for the next emergency response. The Department does agree and is taking steps to improve internal controls over ensuring payments to providers contain support in line with our A19 matrix and risk assessed of our subrecipients. ELC staff who review invoices will be provided additional training and tracking sheets have been developed which enables staff to record details from backup documentation reviews. This ensures the proper level of review is completed and aligns with the agency?s A-19 documentation matrix. Moving forward we?ve updated our A19 matrix to be more in line with federal guidance and the identified risk levels. The Department partially agrees with SAO?s assessment of a material weakness in internal controls over Subrecipient Monitoring. DOH agrees that the detailed transactions reviewed identified as being for ?COVID? should have been specified to the specific revenue source and will do so in future monitoring visits. However, the Department would disagree that this is a material weakness over the subrecipient monitoring process. While the specific revenue source was not identified in testing allowability, monitoring staff document key control systems such as payroll and disbursements when conducting a fiscal monitoring site visit. When testing, this ensures those controls are operating effectively and provide assurance that amounts reported for reimbursement are allowable and accurate. Thus, not all transactions for that period may be tested. The Department respectfully disagrees with SAO?s assessment of a material weakness in internal controls over the consolidated contract provider payment process to ensure allowability in meeting cost principles with our ELC program. When accounting staff send the A19 consolidated contract invoices to the applicable programs ELC program staff review invoice support for allowability and period of performance and keep a spreadsheet with a breakdown of the total payment requested for ELC. If the payment has no issues or concerns, the total payment is logged in the spreadsheet and staff save the spreadsheet to denote no issues and evidence of review and that full payment can be made. If there is a question on allowable cost, period of performance, a need for additional backup documentation or an error, program ELC staff will update spreadsheet with the amounts in question and communicate with the Local Health Jurisdiction, document the correspondence, and contact the accounting consolidated contract payment desk to withhold the specific amount of payment until the issue is resolved. Once resolved staff update the spreadsheet to denote the issue has been resolved and email accounting to release the payment amount in question. It should be noted that the current process over provider payments at the Department of Health has been in place for well over a decade and has been through several annual audits by the State Auditor?s Office and separate federal reviews by our federal funders without issue. The defined process of consolidated contract payments was in response to issues arising with timely payment of funds to our local government partners. The consolidated contracts are an essential tool in providing such funding on a large scale. This process balances many needs in tracking payments, providing documentation to the programs for review as well as allowing for timely distribution of funding to the local health jurisdictions (LHJs) for state and federal programs in order to serve the residents of the State of Washington. It also simplifies the invoicing and payment process as well as reconciliation between DOH and the LHJs. We would also respectfully disagree with the number of exceptions and questioned costs identified. While the level of support did not meet our internal policies, which are held to a higher standard than federal requirements, the level of documentation received from the subrecipient accounting system gave us assurance that the transactions/costs questioned met federal cost principles for allowability and period of performance. This, along with the following additional overall internal monitoring and policy processes support our overall assurance of the allowability of payments: ? Detailed ELC budgets were originally submitted by the subrecipient, reviewed and approved by Program staff so that they can ensure costs will be reasonable and are in alignment with expectations for the budget period submitted over time. No payment is made to an entity without that approved budget. ? The ELC program has allowable cost guidance documents that are provided to the subrecipients initially, on their SOWs, and after any changes. ? The ELC program/contract managers meet with subrecipients routinely (monthly or bi-monthly) to monitor progress of the work, resources, capacity, and budget management are discussed as well. ? Program staff provide technical assistance and policies to subrecipients related to both allowability and compliance as it relates to programmatic processes. Auditor?s Remarks Department management has implemented procedures to ensure adequate documentation is reviewed to support reimbursement requests from subrecipients receiving federal funds. Our testing was based on these documentation requirements, but we do not agree that these requirements are higher than the Uniform Guidance requires. We found that payments were made without the required level of support to ensure they were allowable and met cost principles. The Department asserts that the fiscal monitoring performed every two years compensates for the lack of adequate documentation. However, we found the fiscal monitoring transaction level review for payroll and vendor reimbursement requests did not specifically include a review of any ELC payments and therefore gave no assurance that grant funds were spent on allowable activities and were adequately supported. We reaffirm our finding and will follow up on the status of the Department?s corrective action during our next audit period. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Washington State Department of Health A-19 Documentation Matrix Approved by FMU 11/30/20 This is the backup documentation required based on the determined risk level. Please ensure the detailed GL expenditure report clearly aligns with the A19 form. More supporting documentation may be requested by programs at any time due to programmatic requirements regardless of risk category. Expenditure Category Low-Risk Moderate-Risk High-Risk Salaries and Benefits A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked Note: Salaries and benefits must be broken out as separate line items. A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked Note: Salaries and benefits must be broken out as separate line items. A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked AND ? Time Sheets for all staff direct charging to the award Note: Salaries and benefits must be broken out as separate line items. Equipment ($5,000 or more) A-19 and a detailed GL expenditure report that provides vendor name and amount Note: Pre-approval documentation must be provided A-19 and a detailed GL expenditure report that provides vendor name, amount AND ? Item Description Note: Pre-approval documentation must be provided A-19 and a detailed GL expenditure report that provides vendor name, amount, item description AND ? Invoice ? Supporting documentation reflecting authorizing official?s approval. Materials, Supplies, and Other A-19 and a detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation. A-19 and a detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item AND Invoices for transactions over $1,000 Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation. A-19 and detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item AND Invoices for transactions over $200. Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation Travel A-19 and a detailed GL expenditure report that provides: ? Employee name Note: Pre-approval documentation from DOH for any out of state travel must be provided. A-19 and a detailed GL expenditure report that provides: ? Employee name AND ? Travel expense form* ? All itemized receipts * Travel expense form should include employee signature, supervisor approval and purpose. Note: Pre-approval documentation from DOH for any out of state travel must be provided. A-19 and a detailed GL expenditure report that provides: ? Employee name ? Travel expense form* ? All itemized receipts AND Pre-approval required for any flights and overnight stays. *Travel expense form should include employee signature, supervisor approval and purpose. Note: Pre-approval documentation from DOH for any out of state travel must be provided. Contracts and Sub-Subrecipients A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name AND ? Invoices for individual transactions over $1,000.00 A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name AND ? Invoices for individual transactions over $200.00. NOTE: Indirect costs included on A19s must include verification of the following: ? Indirect plan is current and on file with DOH ? Indirect rate is being applied accurately to allowable expenditures ? If the indirect cost rate plan has expired, no indirect costs can be charged

2022-036 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with client eligibility requirements for child care services paid with the Child Care and Development Fund and Temporary Assistance for Needy Families funds. Assistance Listing Number and Title: 93.558, Temporary Assistance for Needy Families 93.575, Child Care and Development Block Grant 93.575, COVID-19 Child Care and Development Block Grant 93.596, Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2003WACCDF; 2103WACCDF; 2203WACCDF; 2003WACCC3; 2103WACDC6; 2103WACSC6; 2103WACCC5; 2103WACCDD; 2203WACCDD; 2101WATANF; 2201WATANF Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Eligibility Known Questioned Cost Amount: Temporary Assistance for Needy Families ? $5,689 Child Care and Development Fund ? $5,078 Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grant to help eligible working families pay for child care. In fiscal year 2022, the Department spent $668.6 million in CCDF federal funding. The Department of Social and Health Services (DSHS) administers the Temporary Assistance for Needy Families (TANF) grant. To meet one of the program?s primary purposes of helping clients obtain employment, TANF grant funds may be used to pay clients? child care costs. If a client obtains employment and is no longer eligible for the program, TANF funds may still be used to pay child care costs to help the client maintain employment. In fiscal year 2022, the Department spent more than $260.5 million in CCDF and $67.7 million in TANF federal grant funds on child care subsidy payments to providers. Some payments made for child care are paid for by both the CCDF and TANF grants. While the two federal programs are separate, the requirements and policies in Washington for child care payments are consolidated under the Working Connections Child Care program. As of July 1, 2019, the responsibility for making and documenting child care eligibility determinations under the CCDF and TANF grants was transferred from DSHS to the Department. For a family to be eligible for child care assistance, state and federal rules require that at the time of application or reapplication, children must: ? Reside in Washington and be a citizen or legal resident of the United States; ? Be younger than 13 years, or if for verified special needs, be younger than 19 years; ? Reside with a parent(s) or guardian whose countable income does not exceed 200 percent of the federal poverty level at application or 220 percent at reapplication for July, August and September 2021 but in October 2021 changed to 60 percent of the state median income at application or 65 percent of the state median income at reapplication; ? Reside with a parent(s) or guardian who works or attends a job-training or education program, or needs to be receiving protective services. State rules describe the information clients must provide to the Department to verify their eligibility. The information must be accurate, complete, consistent and from a reliable source. This information includes, but is not limited to, employer and hourly wage information, proof of an approved activity under TANF, and family household size and composition. Once determined to be eligible for the program, a client is eligible for one year unless a change in income causes the client to exceed 85 percent of the state?s median income The Department requires that clients self-report such income changes. A written notice communicates the recipients? reporting requirement and the specific dollar threshold applicable to the household?s annual income. Once the client?s income exceeds this cutoff level, the Department terminates services. The Department has access to systems that contain wage and household benefit and composition data for some, but not all, child care recipients. The Department uses this information in part to determine program eligibility, benefit level, including client copayment, and the amount of child care the family is eligible to receive. If an ineligible client receives assistance, the payment made to the child care provider is not allowable and the client must repay the ineligible amount. The Department also uses household income to determine the amount families must contribute for their monthly copay to providers. Beginning July 1, 2021, monthly copayments were calculated using an updated schedule described in Washington Administrative Code 110-15-0075. Federal regulations require the Department to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the past 10 audits, we reported findings related to eligibility for the Working Connections Child Care program. In these prior audits, we reported the Department did not have adequate internal controls over the eligibility process for child care subsidy recipients. These were reported as finding numbers 2021-035, 2020-039, 2019-032, 2018-030, 2017-026, 2016-023, 2015-026, 2014-026, 2013-017 and 2012-30. Description of Condition The Department did not have adequate internal controls over and did not comply with client eligibility requirements for CCDF and TANF. During the audit period the Department determined 69,815 children were eligible for child care. We used a statistical sampling method to randomly select and examine 59 of these determinations. In four instances (6.8 percent), we found the Department made eligibility determinations improperly, did not obtain required documentation, incorrectly assessed copayment, or did not verify information before authorizing services. Specifically, we found: ? Two cases (3.4 percent) where the Department had incorrectly determined household composition and did not obtain sufficient data for all parents in the household to make an accurate eligibility determination. ? One case (1.7 percent) where the Department did not follow procedure for verifying employment, which led to an incorrect household income calculation. ? One case (1.7 percent) where the copay was incorrectly assessed, which resulted in an underpayment due to a system error. Though the Department has established internal controls, they were insufficient for ensuring material compliance with client eligibility requirements. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Department staff made eligibility determinations without obtaining sufficient supporting documentation to ensure households were eligible to receive assistance. This deviated from the standard policies and procedures the Department has established, and management did not monitor sufficiently to ensure staff made proper eligibility determinations. Further, the incorrect copay calculation was due to system error. Effect of Condition and Questioned Costs By not implementing adequate internal controls, the Department is at higher risk of paying providers for child care services when clients are ineligible. Of the four client eligibility determinations that had errors, three resulted in $10,767 of federal overpayments to providers. The Department used $5,078 in CCDF grant funds and $5,689 in TANF grant funds for these payments. Because we used a statistical sampling method to randomly select the payments examined in the audit, we estimate the amount of likely improper payments to be $6,008,693 for the CCDF grant and $6,731,953 for the TANF grant. Although we identified known and likely questioned costs, we do not have reasonable assurance that the payments in question are appropriately represented in the Department?s accounting records because of the grant management practice issue reported in findings 2022-035 and 2022-041. Additionally, the payments in question are duplicative of the costs already questioned in the aforementioned provider payment findings. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs,? as required by 2 CFR ? 200.516(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department improve its internal controls over determining client eligibility to ensure it: ? Reviews eligibility determinations sufficiently to detect improper eligibility determinations ? Reviews sufficient support for clients? income and household composition information for accuracy We also recommend the Department consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Department`s Response The Department appreciates, acknowledges, and supports SAO?s mission, which is to hold state and local government accountable for the use of public resources. Further, we appreciate SAO?s work with us over the past year to strengthen the auditing process. Due to recent changes to CCSP directed by the Legislature, the Department anticipates continued reduction in eligibility determination errors. The Fair Start for Kids Act (FSKA) required the Department to make several changes that expanded eligibility during SFY 2022. The FSKA increased the State Median Income (SMI) threshold, allowing more two parent households to be eligible for child care subsidy. The FSKA also capped copayments to $115 for applicants and $215 for reapplicants, greatly reducing the copay amounts for typical two parent households. These changes are disincentives for fraud as struggling families receive needed benefits and are more likely to provide accurate and complete information. This is supported by the overall reduction in investigation requests submitted to the Office of Fraud and Accountability. In the federal fiscal year prior to the implementation of the FSKA, the Department submitted 1,405 requests for investigations. The year following FSKA implementation requests for investigations fell to 912. The Department continues to explore ways to remove the possibility for improper use of CCDF funds. The Department agrees with the SAO that there is a need to review household composition at application and reapplication to improve reliability of eligibility decisions. The Department accesses data across available state systems to confirm information, including household composition provided by clients. Unfortunately, there is no household composition verification system, and information provided to other state agencies is often provided by client self-attestation. The Department continues to balance verification requirements with providing timely benefit decisions to support family access to high quality child care. Eighty-six percent of households receiving child care subsidies are headed by single parents. Supporting these families with child care is essential for their continued participation in work, education, and other social service programs. The Department provides training for eligibility in the specific areas of household composition and income determination and improvements to training are ongoing. The Department recently made changes to the professional development and training process to improve staff skills and accuracy. Staff training is in a continuous improvement cycle and evolves with staff needs and changes in rule. The Department will continue to improve processes and internal controls and create and deliver staff training based on current data trends and patterns. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs. Washington Administrative Code (WAC) 110-15-0015 ? Determining family size, states in part: (1) DCYF determines a consumer?s family size as follows: (a) For a single parent, including a minor parent living independently, DCYF counts the consumer and the consumer?s children; (b) For unmarried parents who have at least one mutual child, DCYF counts both parents and all of their children living in the household; (c) Unmarried parents who have no mutual children are counted as separate WCCC households, the unmarried parents and their respective children living in the household; (d) For married parents, DCYF counts both parents and all of their children living in the household; (e) For parents who are undocumented aliens as defined in WAC 388-424-0001, DCYF counts the parents and children, documented and undocumented, and all other family rules in this section apply. Children needing care must meet citizenship requirements described in WAC 110-15-0005; (f) For a legal guardian verified by a legal or court document, adult sibling or step-sibling, nephew, niece, aunt, uncle, grandparent, any of these relatives with the prefix ?great,? such as a ?great-nephew,? or an in loco parentis custodian who is not related to the child as described in WAC 110-15-0005, DCYF counts only the children and only the children?s income is counted; (g) For a parent who is out of the household because of employer requirements, such as training or military service, and expected to return to the household, DCYF counts the consumer, the absent parent, and the children; (h) For a parent who is voluntarily out of the household for reasons other than requirements of the employer, such as unapproved schooling and visiting family members, and is expected to return to the household, DCYF counts the consumer, the absent parent, and the children. WAC 110-15-0020 and all other family and household rules in this section apply; (i) For a parent who is out of the country and waiting for legal reentry in to the United States, DCYF counts only the consumer and children residing in the United States and all other family and household rules in this section apply; (j) An incarcerated parent is not part of the household count for determining income and eligibility. DCYF counts the remaining household members using all other family rules in this section; and (k) For a parent incarcerated at a Washington state correctional facility whose child lives with them at the facility, DCYF counts the parent and child as their own household. (2) When the household consists of the consumer?s own child and another child identified in subsection (1)(f) of this section, the household may be combined into one household or kept as distinct households for the benefit of the consumer. WAC 110-15-0065 ? Calculation of income, states in part: DSHS uses a consumer?s countable income when determining income eligibility and copayment. A consumer?s countable income is the sum of all income listed in WAC 110-15-0060 minus any child support paid out through a court order, division of child support administrative order, or tribal government order. (1) To determine a consumer?s income, DSHS either: (a) Calculates an average monthly income by: (i) Determining the number of months, weeks or pay periods it took the consumer?s WCCC household to earn the income; and dividing the income by the same number of months, weeks or pay periods. (ii) If the past wages are no longer reflective of the current income, DSHS may accept the employer?s statement of current, anticipated wages for future income determination. (b) When the consumer begins new employment and has less than three months of wages, DSHS uses the best available estimate of the consumer?s WCCC household?s current income: (i) As verified by the consumer?s employer; or (ii) As provided by the consumer through a verbal or written statement documenting the new employment at the time of application, reapplication or change reporting, and wage verification within sixty days of DSHS request. (2) If a consumer receives a lump sum payment (such as money from the sale of property or back child support payment) in the month of application or during the consumer?s WCCC eligibility: (a) DSHS calculates a monthly amount by dividing the lump sum payment by twelve; (b) DSHS adds the monthly amount to the consumer?s expected average monthly income: (i) For the month it was received; and (ii) For the remaining months of the current eligibility period; and (c) To remain eligible for WCCC the consumer must meet WCCC income guidelines after the lump sum payment is applied. WAC 110-15-0075 ? Determining income eligibility and copayment amounts, states (effective prior to October 1, 2021): (1) DCYF takes the following steps to determine a consumer?s eligibility and copayment, whether care is provided under a WCCC voucher or contract: (a) Determine the consumer?s family size (under WAC 110-15-0015); (b) Determine the consumer?s countable income (under WAC 110-15-0065). (2) DCYF calculates the consumer?s copayment as follows: If a consumer?s income is: Then the consumer?s copayment is: (a) At or below 82% of the federal poverty guidelines (FPG). $15 (b) Above 82% of the FPG up to 137.5% of the FPG. $65 (c) Above 137.5% of the FPG through 200% of the FPG. The dollar amount equal to subtracting 137.5% of the FPG from countable income, multiplying by 50%, then adding $65, up to a maximum of $115. (3) DCYF does not prorate the copayment when a consumer uses care for part of a month. (4) The FPG is updated every year. The WCCC eligibility level is updated at the same time every year to remain current with the FPG. WAC 110-15-0075 ? Determining income eligibility and copayment amounts, states (effective beginning October 1, 2021): (1) DCYF takes the following steps to determine consumers? eligibility and copayments, when care is provided under a WCCC voucher or contract: (a) Determine their family size as described in WAC 110-15-0015; and (b) Determine their countable income as described in WAC 110-15-0065. (2) DCYF calculates consumers? copayments as follows: If the household?s income is: Then the household?s maximum monthly copayment is: At or below 20 percent of the SMI Waived Above 20 percent and at or below 36 percent of the SMI $65 Above 36 percent and at or below 50 percent of the SMI $90 Above 50 percent and at or below 60 percent of the SMI $115 At reapplication, above 60 percent and at or below 65 percent of the SMI $215 (3) DCYF does not prorate copayments when consumers use care for only part of a month. (4) For parents age 21 years or younger who attend high school or are working towards completing a high school equivalency certificate, copayments are not required.

2022-036 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with client eligibility requirements for child care services paid with the Child Care and Development Fund and Temporary Assistance for Needy Families funds. Assistance Listing Number and Title: 93.558, Temporary Assistance for Needy Families 93.575, Child Care and Development Block Grant 93.575, COVID-19 Child Care and Development Block Grant 93.596, Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2003WACCDF; 2103WACCDF; 2203WACCDF; 2003WACCC3; 2103WACDC6; 2103WACSC6; 2103WACCC5; 2103WACCDD; 2203WACCDD; 2101WATANF; 2201WATANF Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Eligibility Known Questioned Cost Amount: Temporary Assistance for Needy Families ? $5,689 Child Care and Development Fund ? $5,078 Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grant to help eligible working families pay for child care. In fiscal year 2022, the Department spent $668.6 million in CCDF federal funding. The Department of Social and Health Services (DSHS) administers the Temporary Assistance for Needy Families (TANF) grant. To meet one of the program?s primary purposes of helping clients obtain employment, TANF grant funds may be used to pay clients? child care costs. If a client obtains employment and is no longer eligible for the program, TANF funds may still be used to pay child care costs to help the client maintain employment. In fiscal year 2022, the Department spent more than $260.5 million in CCDF and $67.7 million in TANF federal grant funds on child care subsidy payments to providers. Some payments made for child care are paid for by both the CCDF and TANF grants. While the two federal programs are separate, the requirements and policies in Washington for child care payments are consolidated under the Working Connections Child Care program. As of July 1, 2019, the responsibility for making and documenting child care eligibility determinations under the CCDF and TANF grants was transferred from DSHS to the Department. For a family to be eligible for child care assistance, state and federal rules require that at the time of application or reapplication, children must: ? Reside in Washington and be a citizen or legal resident of the United States; ? Be younger than 13 years, or if for verified special needs, be younger than 19 years; ? Reside with a parent(s) or guardian whose countable income does not exceed 200 percent of the federal poverty level at application or 220 percent at reapplication for July, August and September 2021 but in October 2021 changed to 60 percent of the state median income at application or 65 percent of the state median income at reapplication; ? Reside with a parent(s) or guardian who works or attends a job-training or education program, or needs to be receiving protective services. State rules describe the information clients must provide to the Department to verify their eligibility. The information must be accurate, complete, consistent and from a reliable source. This information includes, but is not limited to, employer and hourly wage information, proof of an approved activity under TANF, and family household size and composition. Once determined to be eligible for the program, a client is eligible for one year unless a change in income causes the client to exceed 85 percent of the state?s median income The Department requires that clients self-report such income changes. A written notice communicates the recipients? reporting requirement and the specific dollar threshold applicable to the household?s annual income. Once the client?s income exceeds this cutoff level, the Department terminates services. The Department has access to systems that contain wage and household benefit and composition data for some, but not all, child care recipients. The Department uses this information in part to determine program eligibility, benefit level, including client copayment, and the amount of child care the family is eligible to receive. If an ineligible client receives assistance, the payment made to the child care provider is not allowable and the client must repay the ineligible amount. The Department also uses household income to determine the amount families must contribute for their monthly copay to providers. Beginning July 1, 2021, monthly copayments were calculated using an updated schedule described in Washington Administrative Code 110-15-0075. Federal regulations require the Department to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the past 10 audits, we reported findings related to eligibility for the Working Connections Child Care program. In these prior audits, we reported the Department did not have adequate internal controls over the eligibility process for child care subsidy recipients. These were reported as finding numbers 2021-035, 2020-039, 2019-032, 2018-030, 2017-026, 2016-023, 2015-026, 2014-026, 2013-017 and 2012-30. Description of Condition The Department did not have adequate internal controls over and did not comply with client eligibility requirements for CCDF and TANF. During the audit period the Department determined 69,815 children were eligible for child care. We used a statistical sampling method to randomly select and examine 59 of these determinations. In four instances (6.8 percent), we found the Department made eligibility determinations improperly, did not obtain required documentation, incorrectly assessed copayment, or did not verify information before authorizing services. Specifically, we found: ? Two cases (3.4 percent) where the Department had incorrectly determined household composition and did not obtain sufficient data for all parents in the household to make an accurate eligibility determination. ? One case (1.7 percent) where the Department did not follow procedure for verifying employment, which led to an incorrect household income calculation. ? One case (1.7 percent) where the copay was incorrectly assessed, which resulted in an underpayment due to a system error. Though the Department has established internal controls, they were insufficient for ensuring material compliance with client eligibility requirements. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Department staff made eligibility determinations without obtaining sufficient supporting documentation to ensure households were eligible to receive assistance. This deviated from the standard policies and procedures the Department has established, and management did not monitor sufficiently to ensure staff made proper eligibility determinations. Further, the incorrect copay calculation was due to system error. Effect of Condition and Questioned Costs By not implementing adequate internal controls, the Department is at higher risk of paying providers for child care services when clients are ineligible. Of the four client eligibility determinations that had errors, three resulted in $10,767 of federal overpayments to providers. The Department used $5,078 in CCDF grant funds and $5,689 in TANF grant funds for these payments. Because we used a statistical sampling method to randomly select the payments examined in the audit, we estimate the amount of likely improper payments to be $6,008,693 for the CCDF grant and $6,731,953 for the TANF grant. Although we identified known and likely questioned costs, we do not have reasonable assurance that the payments in question are appropriately represented in the Department?s accounting records because of the grant management practice issue reported in findings 2022-035 and 2022-041. Additionally, the payments in question are duplicative of the costs already questioned in the aforementioned provider payment findings. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs,? as required by 2 CFR ? 200.516(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department improve its internal controls over determining client eligibility to ensure it: ? Reviews eligibility determinations sufficiently to detect improper eligibility determinations ? Reviews sufficient support for clients? income and household composition information for accuracy We also recommend the Department consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Department`s Response The Department appreciates, acknowledges, and supports SAO?s mission, which is to hold state and local government accountable for the use of public resources. Further, we appreciate SAO?s work with us over the past year to strengthen the auditing process. Due to recent changes to CCSP directed by the Legislature, the Department anticipates continued reduction in eligibility determination errors. The Fair Start for Kids Act (FSKA) required the Department to make several changes that expanded eligibility during SFY 2022. The FSKA increased the State Median Income (SMI) threshold, allowing more two parent households to be eligible for child care subsidy. The FSKA also capped copayments to $115 for applicants and $215 for reapplicants, greatly reducing the copay amounts for typical two parent households. These changes are disincentives for fraud as struggling families receive needed benefits and are more likely to provide accurate and complete information. This is supported by the overall reduction in investigation requests submitted to the Office of Fraud and Accountability. In the federal fiscal year prior to the implementation of the FSKA, the Department submitted 1,405 requests for investigations. The year following FSKA implementation requests for investigations fell to 912. The Department continues to explore ways to remove the possibility for improper use of CCDF funds. The Department agrees with the SAO that there is a need to review household composition at application and reapplication to improve reliability of eligibility decisions. The Department accesses data across available state systems to confirm information, including household composition provided by clients. Unfortunately, there is no household composition verification system, and information provided to other state agencies is often provided by client self-attestation. The Department continues to balance verification requirements with providing timely benefit decisions to support family access to high quality child care. Eighty-six percent of households receiving child care subsidies are headed by single parents. Supporting these families with child care is essential for their continued participation in work, education, and other social service programs. The Department provides training for eligibility in the specific areas of household composition and income determination and improvements to training are ongoing. The Department recently made changes to the professional development and training process to improve staff skills and accuracy. Staff training is in a continuous improvement cycle and evolves with staff needs and changes in rule. The Department will continue to improve processes and internal controls and create and deliver staff training based on current data trends and patterns. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs. Washington Administrative Code (WAC) 110-15-0015 ? Determining family size, states in part: (1) DCYF determines a consumer?s family size as follows: (a) For a single parent, including a minor parent living independently, DCYF counts the consumer and the consumer?s children; (b) For unmarried parents who have at least one mutual child, DCYF counts both parents and all of their children living in the household; (c) Unmarried parents who have no mutual children are counted as separate WCCC households, the unmarried parents and their respective children living in the household; (d) For married parents, DCYF counts both parents and all of their children living in the household; (e) For parents who are undocumented aliens as defined in WAC 388-424-0001, DCYF counts the parents and children, documented and undocumented, and all other family rules in this section apply. Children needing care must meet citizenship requirements described in WAC 110-15-0005; (f) For a legal guardian verified by a legal or court document, adult sibling or step-sibling, nephew, niece, aunt, uncle, grandparent, any of these relatives with the prefix ?great,? such as a ?great-nephew,? or an in loco parentis custodian who is not related to the child as described in WAC 110-15-0005, DCYF counts only the children and only the children?s income is counted; (g) For a parent who is out of the household because of employer requirements, such as training or military service, and expected to return to the household, DCYF counts the consumer, the absent parent, and the children; (h) For a parent who is voluntarily out of the household for reasons other than requirements of the employer, such as unapproved schooling and visiting family members, and is expected to return to the household, DCYF counts the consumer, the absent parent, and the children. WAC 110-15-0020 and all other family and household rules in this section apply; (i) For a parent who is out of the country and waiting for legal reentry in to the United States, DCYF counts only the consumer and children residing in the United States and all other family and household rules in this section apply; (j) An incarcerated parent is not part of the household count for determining income and eligibility. DCYF counts the remaining household members using all other family rules in this section; and (k) For a parent incarcerated at a Washington state correctional facility whose child lives with them at the facility, DCYF counts the parent and child as their own household. (2) When the household consists of the consumer?s own child and another child identified in subsection (1)(f) of this section, the household may be combined into one household or kept as distinct households for the benefit of the consumer. WAC 110-15-0065 ? Calculation of income, states in part: DSHS uses a consumer?s countable income when determining income eligibility and copayment. A consumer?s countable income is the sum of all income listed in WAC 110-15-0060 minus any child support paid out through a court order, division of child support administrative order, or tribal government order. (1) To determine a consumer?s income, DSHS either: (a) Calculates an average monthly income by: (i) Determining the number of months, weeks or pay periods it took the consumer?s WCCC household to earn the income; and dividing the income by the same number of months, weeks or pay periods. (ii) If the past wages are no longer reflective of the current income, DSHS may accept the employer?s statement of current, anticipated wages for future income determination. (b) When the consumer begins new employment and has less than three months of wages, DSHS uses the best available estimate of the consumer?s WCCC household?s current income: (i) As verified by the consumer?s employer; or (ii) As provided by the consumer through a verbal or written statement documenting the new employment at the time of application, reapplication or change reporting, and wage verification within sixty days of DSHS request. (2) If a consumer receives a lump sum payment (such as money from the sale of property or back child support payment) in the month of application or during the consumer?s WCCC eligibility: (a) DSHS calculates a monthly amount by dividing the lump sum payment by twelve; (b) DSHS adds the monthly amount to the consumer?s expected average monthly income: (i) For the month it was received; and (ii) For the remaining months of the current eligibility period; and (c) To remain eligible for WCCC the consumer must meet WCCC income guidelines after the lump sum payment is applied. WAC 110-15-0075 ? Determining income eligibility and copayment amounts, states (effective prior to October 1, 2021): (1) DCYF takes the following steps to determine a consumer?s eligibility and copayment, whether care is provided under a WCCC voucher or contract: (a) Determine the consumer?s family size (under WAC 110-15-0015); (b) Determine the consumer?s countable income (under WAC 110-15-0065). (2) DCYF calculates the consumer?s copayment as follows: If a consumer?s income is: Then the consumer?s copayment is: (a) At or below 82% of the federal poverty guidelines (FPG). $15 (b) Above 82% of the FPG up to 137.5% of the FPG. $65 (c) Above 137.5% of the FPG through 200% of the FPG. The dollar amount equal to subtracting 137.5% of the FPG from countable income, multiplying by 50%, then adding $65, up to a maximum of $115. (3) DCYF does not prorate the copayment when a consumer uses care for part of a month. (4) The FPG is updated every year. The WCCC eligibility level is updated at the same time every year to remain current with the FPG. WAC 110-15-0075 ? Determining income eligibility and copayment amounts, states (effective beginning October 1, 2021): (1) DCYF takes the following steps to determine consumers? eligibility and copayments, when care is provided under a WCCC voucher or contract: (a) Determine their family size as described in WAC 110-15-0015; and (b) Determine their countable income as described in WAC 110-15-0065. (2) DCYF calculates consumers? copayments as follows: If the household?s income is: Then the household?s maximum monthly copayment is: At or below 20 percent of the SMI Waived Above 20 percent and at or below 36 percent of the SMI $65 Above 36 percent and at or below 50 percent of the SMI $90 Above 50 percent and at or below 60 percent of the SMI $115 At reapplication, above 60 percent and at or below 65 percent of the SMI $215 (3) DCYF does not prorate copayments when consumers use care for only part of a month. (4) For parents age 21 years or younger who attend high school or are working towards completing a high school equivalency certificate, copayments are not required.

2022-040 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to issue management decisions for audit findings to subrecipients of the Low-Income Home Energy Assistance Program. Assistance Listing Number and Title: 93.568, Low-Income Home Energy Assistance Program 93.568, COVID-19 Low-Income Home Energy Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2201WALIEA; 2101WALIEA; 2201WALIEI; 2101WALWC5; 2101WEA5C6; 2102WALWC6 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Department of Commerce (Department) administers the Low-Income Home Energy Assistance Program, which provides financial assistance to low-income households to meet their home energy needs. The Department makes subawards to community-based organizations to provide this assistance. In fiscal year 2022, the Department spent more than $102 million in federal program funds, approximately $98 million of which it paid to subrecipients. Federal regulations require the Department to monitor its subrecipients? activities. This includes verifying that subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single audit. The audit must be completed and submitted to the Federal Audit Clearinghouse within 30 days after receiving the auditor?s report or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes on to subrecipients, the Department must follow up and ensure its subrecipients take timely and appropriate corrective action on all deficiencies identified through audits, onsite reviews and other means. When a subrecipient receives an audit finding for a Department-funded program, federal law requires the Department to issue a management decision to the subrecipient within six months of acceptance of the audit report by Federal Audit Clearinghouse. The management decision must clearly state whether the audit finding is sustained, the reasons for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to issue management decisions for audit findings to the program?s subrecipients. The Department had a process in place to monitor that program subrecipients received single audits. However, for the first half of the audit period, it did not have a process in place to issue, communicate and follow up on management decisions to its subrecipients when program findings were issued. During the audit period, the Department had 26 subrecipients that were required to submit a single audit. One subrecipient received a finding for which the Department was required to issue a management decision. We found the Department did not issue a management decision for this subrecipient. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Management did not establish sufficient internal controls or monitoring procedures to ensure the Department issued the required management decisions. The Department also lacks written policies over issuing management decisions to its federal program subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot ensure it is following up on subrecipient single audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitor them for effectiveness, the Department cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the Department: ? Establish effective internal controls to ensure it issues management decisions by the due date and follows up on all subrecipient audit findings related to the program ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations Department?s Response The Department of Commerce concurs with the finding. The Department hired an Internal Control Officer in November 2021 assigned to complete the required verification of Federal Audit Clearinghouse (FAC) submissions. This process was completed for all recipients who expended $750,000 or more in federal funds passed through the Department. One subrecipients submission selected for testing was verified, however, a formal management decision was not issued. The audit report submitted to the FAC included various errors which included no identification of the pass through entity (the Department of Commerce) as part of the finding and the Schedule of Expenditure of Federal Awards (SEFA) reported the wrong state agency?s acronym. The Department of Corrections was listed, not Commerce as required. The accurate reporting of the pass through entity in the audit report is imperative for Commerce to identify who they are required to issue a management decision for. A comprehensive spreadsheet of the Department?s management decision was maintained, however, the subrecipient selected for testing was omitted. The Department currently has a robust and comprehensive process to identify required reporters, verify their submission to the FAC, document late or non-reporters, and document communication requests for information related to submissions. The Department has also created a method to formally communicate the management decision to our subrecipients who have received Commerce funded audit findings. Our prior process included verbally discussing the finding, corrective action plans and Commerce requests with the subrecipient. Internal controls for the monitoring of federal reporting and issuing of management decisions have been in place since March 2022. Commerce management will continue to monitor the process and implement efficiencies to ensure continued compliance with all respects of the code of federal regulations. We appreciate the State Auditor?s Office thorough review of this process and recommendations. We anticipate all future audits will find the Department has employed strong internal controls supporting compliance with all requirements. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity's fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity's fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c).