Finding Text
Finding 2024-001 – A. Activities Allowed or Unallowed, B. Allowable Costs/Cost Principles, H. Period of Performance Identification of the federal program: Federal Agency: U.S. Department of Homeland Security Assistance Listing No: 97.036 COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Award Period: January 1, 2024 through December 31, 2024 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Norton Healthcare, Inc. and Affiliates (the Corporation) did not retain supporting documentation over its internal review and approval of expenses reported under Assistance Listing No. 97.036 COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19 Disaster Grants), which is administered by the U.S. Department of Homeland Security. Furthermore, internal controls over management’s accumulation and review of such expenses for allowability were not suitably designed as it pertained to final approval of project submissions or certain labor costs incurred. Cause: While management designed and implemented internal controls that required expenditures to be reviewed by members of the respective departments in which they originated (e.g. payroll and accounts payable) as expenditures were incurred, internal controls were not designed or implemented around the accumulation of expenditures and review of such expenditures for allowability under the projects for which Norton was approved under the COVID-19 Disaster Grants. Furthermore, the Corporation does not have formalized policies or documentation around internal contract agency travel allowances, and the payroll department did not retain documentation to evidence the review of unapproved timesheets. Effect or potential effect: Lack of formalized policies and procedures and retention of documentation to support the review of expenditures reported under the COVID-19 Disaster Grants program could have resulted in unallowable expenses being charged to and reimbursed by the U.S. Department of Homeland Security. Questioned costs: None. Context: We reconciled the underlying expense detail to approved COVID-19 Disaster Grants project worksheets. Through discussion with management, it was determined that the expense populations were primarily derived from certain departments and transaction codes created specifically for COVID-19 expenses. Upon inspection of related documentation, it was determined that transactions coded to these departments and transaction codes were approved upon occurrence. However, there was no formal documentation retained around management’s subsequent accumulation of expenditures and review and approval or the allowability of such expenses under the COVID-19 Disaster Grants program. Furthermore, the payroll department did not retain documentation to evidence the review of unapproved timesheets, and the Corporation does not have formalized policies or documentation around contract agency travel allowances to support amounts were appropriate. We selected 40 transactions (totaling $865,532 in expenditures) for allowability testing with no compliance exceptions identified. Identification as a repeat finding, if applicable: Not applicable. Recommendation: Management should reassess the internal controls over the accumulation and approval of the allowability of expenditures submitted for reimbursement under the COVID-19 Disaster Grants program. Furthermore, documentation to substantiate the extent and execution of internal controls should be retained. The Corporation’s payroll department should implement an internal control to formalize the review of timecards that are not approved by direct supervisors. This internal control should be formalized with specific steps and evidence of execution retained. Additionally, policies should be formalized related to internal contract agency travel allowances. Views of responsible officials: Management agrees with this finding and will update policies and procedures to ensure that a comprehensive review, approval, and document retention process is applied consistently in the preparation of future projects approved under the COVID-19 Disaster Grant program. Additionally, the Corporation will challenge policies and procedures to formalize payroll department review of unapproved timesheets and internal contract agency travel allowances.