Finding Text
Finding number: 2023-005 Significant Deficiency in Internal Control Over Compliance:
Allowable Costs and Activities
Federal Program #1 HIV Emergency Relief Project Grants: CFDA Number 93.914
Federal Program #2 HIV Care Formula Grants: CFDA Number 93.917
Federal Program #3 HIV Prevention Activities: CFDA Number: 93.941
Name of federal
agency:
U.S. Department of Health and Human Services (HHS)
Name of pass-through
entity:
Multiple
Repeat finding: No
AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary
Schedule of Findings and Questioned Costs
For the Year Ended December 31, 2023
SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued)
Criteria: Under 2 CFR §200.303, recipients of federal funds must establish and maintain
effective internal controls to ensure compliance with federal statutes,
regulations, and the terms of grant agreements. 2 CFR §200.403 specifies that
costs charged to federal programs must be allowable, necessary, reasonable, and
allocable to the respective award. Additionally, 2 CFR §200.302 requires
financial management systems to provide effective control and accountability
over federal funds, including documented approval of expenditures.
A best practice for grant compliance is to implement a documented approval
process for expenditures charged to federal programs, ensuring that all costs are
reviewed and supported by adequate documentation before reimbursement
requests are submitted.
Condition: The Organization did not have readily-available documented evidence of review
and approval for expenditures charged to federal grants during the fiscal year.
Specifically:
The financial system did not capture or document approval of expenditures
before they were charged to federal programs.
No formalized system existed to retain evidence of grant-related expenditure
reviews.
While the prior Chief Financial Officer (CFO) manually reviewed each
invoice, there was no indication of approval on the supporting
documentation, making it impossible to verify that an appropriate review
occurred before costs were charged to the grants.
Cause: The issue arose due to the Organization's reliance on a manual review process
conducted by the previous CFO, without requiring a formal approval signature or
electronic system control to document review. This lack of a structured approval
process resulted in insufficient evidence to support compliance with federal
allowable cost requirements.
AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary
Schedule of Findings and Questioned Costs
For the Year Ended December 31, 2023
SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued)
Possible effect: Without a documented approval process, the Organization cannot demonstrate
that expenditures charged to the grants were properly reviewed for allowability,
reasonableness, and allocability in accordance with federal regulations. This
increases the risk that:
Unallowable or misclassified expenditures could be charged to the grants
without detection.
Noncompliance with federal grant requirements could result in questioned
costs or additional oversight from funding agencies.
Financial statement and grant reporting inaccuracies may occur if
expenditures are not properly reviewed and approved.
Although no specific unallowable costs were identified during the audit, the lack
of documented review represents a significant deficiency in internal control over
compliance.
Questioned cost: None identified at this time.
Recommendation: We recommend that the Organization strengthen its internal controls over grant
expenditures by implementing the following measures:
1. Implement a Formal Expenditure Review and Approval Policy – Establish a
policy requiring that all expenditures charged to grants be reviewed and
approved by an appropriate individual before being recorded in the system.
2. Require Documentation of Review and Approval – Ensure that invoices,
payroll allocations, and other cost support documents include a signature,
initials, or system-generated approval to confirm review.
3. Utilize System-Based Controls – If possible, configure the financial system
to require electronic approval for all grant-related expenditures before costs
are recorded.
AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary
Schedule of Findings and Questioned Costs
For the Year Ended December 31, 2023
SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued)
Views of responsible
officials:
Management partially agrees with the finding. While we acknowledge that
documentation of expenditure approval was not always retrievable, we believe
the expenditures reviewed were all appropriate. Finding 2023-005 refers to the
auditors' assessment of expenditure review and approval processes that occurred
in Calendar Year 2023. During Calendar Year 2023, Prism relied on email
routing of expenditures for review and approval. As of this writing, Prism
Health North Texas' expenditure review and approval processes already meet or
exceed the recommendations above.
Action Taken:
Expenditure Review – All expenditures charged to grants are reviewed and
approved by two qualified individuals.
Documentation of Review and Approval –
Such review and approval for non-payroll expenditures occur in and are
documented in the SAP Concur software before the costs are recorded in
the accounting system (Abila).
Such review and approval for payroll-related expenditures occur via and
are documented via a combination of methods, also before they are
recorded in Abila.
Employees report their time, including how much time was
devoted to grant activities, in the ExponentHR payroll system,
and their supervisors approve both the time and the allocation in
that system.
Programmatic measures that also support grant billing ("units")
are calculated from activity documented in the athenaOne
electronic health record (EHR).
Payroll allocation is calculated by one person, based on the
ExponentHR documentation and the units, then reviewed and
imported into Abila by a second person. The unposted
transactions are reviewed again before posting.
Utilize System-Based Controls – In place as above.
_________________________________________________________