Finding Text
FINDING 2024-006
Subject: COVID-19 - Education Stabilization Fund - Internal Controls
Federal Agency: Department of Education
Federal Program: COVID-19 - Education Stabilization Fund
Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W
Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013,
S425U210013, S425W210015
Pass-Through Entity: Indiana Department of Education
Compliance Requirement: Activities Allowed or Unallowed
Audit Finding: Material Weakness
Condition and Context
Internal control is generally defined as a process affected by an entity's oversight body, management,
and other personnel that provides reasonable assurance that the objectives of an entity will be
achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required
to establish and maintain internal controls over federal awards that provides reasonable assurance that the
nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms
and conditions of the federal awards.
Internal control is not one event or circumstance, but a dynamic and iterative process. The internal
control process is based on fundamental principles that operate as a whole but are best understood when
analyzed individually. The fundamental principles are related to five components of internal control which
are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication,
and Monitoring. If a component is not effective, or the components are not operating together in an
integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were
identified in the risk assessment, monitoring, and control activities components.
Risk Assessment
The School Corporation has not established a formal risk assessment process. There is no
documented risk assessment policy, nor is there evidence of periodic risk identification,
analysis, or evaluation.
Monitoring
The School Corporation did not conduct ongoing or periodic reviews to ensure that internal
controls were operating as intended and to identify areas for improvement. Furthermore, the
School Corporation did not have a process to follow up on corrective actions written as a
response to audit findings.
The lack of controls was a systemic issue throughout the audit period.
Criteria
2 CFR 200.303 states in part:
"The non-Federal entity must:
INDIANA STATE BOARD OF ACCOUNTS
29
CANNELTON CITY SCHOOL CORPORATION
SCHEDULE OF FINDINGS AND QUESTIONED COSTS
(Continued)
(a) Establish and maintain effective internal control over the Federal award that provides
reasonable assurance that the non-Federal entity is managing the Federal award in
compliance with Federal statutes, regulations, and the terms and conditions of the Federal
award. These internal controls should be in compliance with guidance in 'Standards for
Internal Control in the Federal Government' issued by the Comptroller General of the
United States or the 'Internal Control Integrated Framework', issued by the Committee of
Sponsoring Organizations of the Treadway Commission (COSO). . . ."
Cause
Management of the School Corporation had not taken steps to design and implement policies and
procedures to assess risks facing the School Corporation or to establish and operate monitoring activities
that monitor the internal control system.
Effect
As a result of the five components of internal control not being adequately designed and
implemented, the internal control system cannot be effective. Thus, general risks or specific risks from
fraud and significant changes could negatively impact the School Corporation, identified internal control
deficiencies could continue, and unidentified flaws within the internal control system could exist.
Questioned Costs
There were no questioned costs identified.
Recommendation
We recommended that the School Corporation's management establish a proper system of internal
controls, which would include policies and procedures related to risk assessment and monitoring.
Views of Responsible Officials
For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.