Finding Text
Finding 2023-001: Subrecipient Pre-award Risk Assessment
Information on the Federal Programs: All Programs
Criteria or Specific Requirement: CFR § 200.332, "Requirements for pass-through entities", requires pass-through entities to evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring.
Condition: During our testing of subawards, we were unable to verify that pre-award risk assessment procedures were performed. We additionally noted that these requirements were not incorporated into the Organizations' current policies and procedures.
Cause: The Organizations do not have a formal internal policy with respect to performing subaward risk assessments as required by Federal regulation at the execution of the subaward agreements or on a regular basis.
Effect or Potential Effect: The Organizations may have inadvertently failed to perform monitoring procedures appropriate for a subrecipient’s assessed level of risk.
Questioned Costs: N/A
Context: The Organizations execute subaward agreements under US Federal grants. Therefore, the Organizations are subject to CFR § 200.332 "Requirements for pass-through entities". Our audit procedures consisted of testwork completed on subawards and individual expenditures charged to the Federal awards. The report in which samples were selected was generated directly from the Organizations' general ledger (accounting system). We consider our sample to be representative of the population.
Identification as a Repeat Finding: N/A
Recommendation: We recommend the Organizations develop a subaward policy to ensure the risk assessment procedures over its subrecipients are performed and documented prior to engagement. Based on these risk assessments, the Organizations should assign a risk level to each, and then determine the monitoring tools to apply based on these risk levels. We also recommend the Organizations require its subrecipients to submit financial reports demonstrating use of each advance before advancing more funds, to ensure subrecipients are expending funds appropriately. Recommended factors to consider when developing a policy are as follows:
Refer to 2 CFR 200.331 part (a) for complete listing of data elements that are required to be included in every subaward, and incorporate this listing into the updated policies and procedures.
Establish criteria to be used in the evaluation of the risk of noncompliance associated with the intended subrecipient for the purpose of determining the expected level of oversight during the period of performance. This evaluation should include a scaling system, such as high, medium or low risk (for example), and the monitoring tools and procedures to be performed at each of these levels (additional training, on-site reviews, types of and frequency of reporting, etc.).