Finding Text
Criteria: Per 2 CFR 200.303, non-Federal entities must establish and maintain effective internal control over Federal awards that provides reasonable assurance of compliance with Federal statutes, regulations, and the terms and conditions of the award. Controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” (Green Book) and the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During the audit, we noted that the Organization lacked documented internal controls over compliance in several key areas, including disbursements/expenditures, payroll, and progress reporting. Specifically, there was insufficient evidence of review and approval processes during the period from the beginning of the fiscal year through March 2024. In April 2024, the Organization implemented written policies and formalized internal controls; however, these were not retroactively applied to transactions prior to that date. Cause: The Organization had not previously developed or implemented formal written policies and procedures to document control activities, such as review and approval of expenditures and programmatic reporting, due in part to limited staffing and evolving compliance infrastructure. Effect: The absence of documented internal controls increased the risk of noncompliance with Federal program requirements related to allowable costs, payroll documentation, and performance reporting. Questioned Cost: None identified. Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the Organization continue to enforce and refine the internal controls implemented in April 2024 to ensure consistent documentation of review and approval for expenditures, payroll, and reporting. Furthermore, we encourage management to conduct periodic internal reviews to confirm that controls are functioning as intended across all departments handling Federal awards. Views of Responsible Officials and Planned Corrective Action (unaudited): See Corrective Action Plan.