Finding 1079867 (2024-001)

Finding No. 2024-001: Financial Reporting (Material Weakness) Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Supportive Housing for Persons with Disabilities (Section 811) Federal Assistance Listing Number: 14.181 Compliance Requirement: Reporting Statement of condition The lack of appropriate policies, procedures, and internal processes led to inaccurate recording of depreciation, interest, and security deposits, and late filing of required reporting. Certain information technology controls and procedures were not documented, properly designed, or followed appropriately, including, but not limited to: segregation of administrative user roles from the accounting function, user access review, removal of terminated users, complementary user entity controls assessment, backup restoration testing, penetration testing, and cybersecurity awareness training. Criteria The Organization is required to have internal controls and procedures in place in order to timely and accurately report the results of its operations, close its books, and timely file its reports with the applicable federal agencies. These procedures include documenting of levels of review, reconciling accounting records at month-end and year-end close, and maintaining a well-documented, designed, and applied information technology environment. Cause Management did not have sufficient internal controls in place to accurately and timely report the results of the Organization's operations and maintenance and maintain the information technology environment. Effect Insufficient controls, late closing and reconciliation of accounting records, and insufficiently maintained information technology environment could result in accounting errors and theft. A lack of controls over financial reporting can result in untimely filing of required reports or incomplete filings with the regulatory and oversight entities. Recommendation We recommend that management re-evaluate its policies and procedures to ensure an appropriate member of management is in place to review the year-end and month-end close processes, as well as journal entries, reconciliations, and other accounting records. Management should appoint an individual to be responsible for the Organization's financial statements and reporting obligations. Management should evaluate its controls and procedures over the information technology environment to ensure they are properly documented, designed, and followed, including but not limited to: ensuring segregation of administrative user roles from the accounting function, performing a regular review of user access, ensuring terminated users are removed from all systems and software, performing an assessment of complementary user entity controls for relevant software vendors, performing backup restoration tests and penetration tests, and providing cybersecurity awareness training. Identification of repeat finding The finding is a repeat of Finding No. 2023-002. Auditor non-compliance code S - Internal control deficiencies Questioned costs None Finding resolution status In process