Finding 1156835 (2024-007)

Federal Agency: Department of the Treasury (Treasury) Federal Program: 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds SLFRP4542 State Agency: Office of Administration (OA) Type of Finding: A - Internal Control (Material Weakness) and Material Noncompliance B - Internal Control (Material Weakness) and Material Noncompliance Compliance Requirement: Subrecipient Monitoring As noted in our previous audit, the OA has not established policies and procedures regarding monitoring subrecipients of the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) program. As a result, the OA did not comply with the Uniform Guidance (UG) requirements regarding identifying and monitoring subrecipients of the SLFRF program. The OA is the lead agency responsible for administering the SLFRF program. The purpose of the SLFRF program is to provide funding to respond to the COVID-19 public health emergency (PHE) or its negative impacts; respond to workers performing essential work during the PHE; provide government services, to the extent of the reduction in revenue due to the PHE (revenue replacement); make necessary investments in water, sewer, or broadband infrastructure; provide emergency relief from natural disasters or the negative economic impacts of natural disasters; and finance certain surface transportation and housing projects. The OA and various state agencies designed projects within the various allowable SLFRF program categories, and are responsible for administering the projects. The OA developed the American Rescue Plan Act Grant Management Portal (portal) to serve as the official repository of information and documentation supporting each SLFRF program project. The state agencies upload supporting documentation to the portal, including contracts, payment requests, and other supporting documentation. Most payments are made on a reimbursement basis. The OA reviews each payment request and processes the payments. Some SLFRF program projects are administered through subawards. The OA establishes contracts with each subrecipient that outline various SLFRF program requirements, terms, and conditions. In the Schedule of Expenditures of Federal Awards (SEFA), the OA reported approximately $186 million was passed through to subrecipients of the SLFRF program during the year ended June 30, 2024. This amount represents approximately 30 percent of the SLFRF program expenditures. These awards were administered through the OA and 7 other state agencies. However, as noted in finding point A., the amounts are not accurate due to subrecipient determination errors. In response to our prior audit finding, the OA held a training for state agency personnel in August 2024 and sent a letter to state agencies in January 2025 (after the current audit period), covering agency responsibilities related to certain SLFRF program subrecipient monitoring requirements, such as subrecipient determinations and single audits. Of the 7 state agencies that administered subawards reported in the SEFA during the year ended June 30, 2024, 4 administered the majority of the subawards, with payments totaling approximately $181 million, or 97 percent of the total subrecipient payments reported in the SEFA. These 4 state agencies were the Department of Mental Health (DMH), Department of Higher Education and Workforce Development (DHEWD), Department of Natural Resources (DNR), and the Department of Economic Development (DED). Our review and testing of subrecipient monitoring procedures focused on the OA and the 4 state agencies. For the 4 state agencies, a total of 212 recipients were identified as subrecipients in the SEFA. However, as noted in finding point A., this count is not accurate due to subrecipient determination errors. To understand the OA and state agency procedures, and to test compliance with subrecipient monitoring requirements, we randomly selected a sample of payments to 21 subrecipients for the 4 state agencies. In addition, we judgmentally selected an additional subrecipient at one of the agencies because we had received citizen concerns regarding the administration of the subrecipient project. The 22 subrecipients were awarded a total of approximately $230 million in SLFRF program funding and were paid a total of approximately $77.9 million during the year ended June 30, 2024. We reviewed records in the portal supporting the subawards and 1 payment for each of the 22 subrecipients. We reviewed payments totaling approximately $5.9 million. For the judgmentally-selected subrecipient, we reviewed documentation of the state agency's monitoring of the subrecipient, including documentation of decisions to terminate (June 2024), not reinstate (December 2024), and reinstate (June 2025) the project. No significant issues were identified in this review. A. Subrecipient Determination The OA has not established policies and procedures to determine whether recipients of the SLFRF program funds are subrecipients or contractors. As a result, some recipients were incorrectly classified, and the OA lacks a complete and accurate listing of subrecipients. Subrecipient monitoring requirements are outlined in the UG. Regulation 2 CFR Section 200.331 states a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. The classification of a subrecipient is dependent on whether the entity is responsible for making eligibility determinations for assistance, has its performance measured in relation to whether the objectives of the federal program were met, has responsibility for programmatic decision-making, is responsible for adherence to federal program requirements, and uses the federal funds to carry out a program for its public purpose. The OA did not evaluate each SLFRF program recipient for the UG criteria, and did not make a determination of whether the entity was a subrecipient or contractor. OA officials assigned responsibility for making these determinations and identifying subrecipients to the applicable state agencies, but did not provide clear guidance to the state agencies or ensure the state agencies properly performed and documented the determinations. One of the 4 state agencies had not documented their determinations for any of their sampled subrecipients and another state agency had not documented its determinations for 2 of 4 sampled subrecipients. Our analysis and review of the population of 212 subrecipients identified in the SEFA for the 4 state agencies revealed 1 state agency incorrectly recorded 2 contractors (office supply and electrical supply companies), with payments totaling $6,509, as subrecipients. The OA is the lead agency responsible for administering the SLFRF program. Without adequate procedures over subrecipient or contractor determinations, the OA lacks assurance that its subrecipients have been identified for subrecipient monitoring purposes. The OA Corrective Action Plan and Summary Schedule of Prior Audit Findings for prior audit finding number 2023-010 state the OA disagrees that it needs to develop policies and procedures regarding subrecipient determinations since the requirements are already stated in the Uniform Guidance and SLFRF program regulations. However, documented policies and procedures are necessary to clearly communicate responsibilities to the state agencies, prevent misunderstandings, and demonstrate adequate internal controls over compliance with subrecipient monitoring requirements. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission." Paragraph 3.10 of the Standards for Internal Control in the Federal Government, also known as the Green Book, states, "[e]ffective documentation assists in management's design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel. Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel, as well as a means to communicate that knowledge as needed to external parties, such as external auditors." Paragraph 12.01 states, "[m]anagement should implement control activities through policies." B. Subrecipient Monitoring The OA did not implement an effective subrecipient monitoring program to monitor the SLFRF subrecipients. As a result, some subrecipient monitoring procedures were not performed as required by the UG. Regulation 2 CFR Section 200.332(b) states that pass-through entities must evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Risk assessments may consider factors such as the subrecipient's prior experience with the same or similar subawards, the results of previous audits, whether the subrecipient has new personnel or new or substantially-changed systems, and the extent and results of federal awarding agency monitoring. Regulation 2 CFR Section 200.332(d) requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure the subrecipient is in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity; (2) following up and ensuring the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address single audit findings related to the particular subaward; and (3) issuing a management decision for applicable findings pertaining only to the federal award provided to the subrecipient from the pass-through entity. Regulation 2 CFR Section 200.332(f) requires pass-through entities to verify that every subrecipient had a single audit when it is expected that the subrecipient spent $750,000 or more during the subrecipient's fiscal year. To monitor subrecipients of the SLFRF program, the OA relies on its pre-payment monitoring process. The OA does not perform any post-payment monitoring procedures, and relies on the state agencies to perform these procedures. The OA did not establish policies and procedures over the pre-payment review process and these reviews were not always clearly documented. In addition, the OA did not sufficiently communicate with the state agencies regarding subrecipient monitoring responsibilities or ensure the state agencies performed monitoring reviews. The information communicated to the state agencies in memos, emails, and periodic meetings and trainings with state agency personnel were not formalized in a policy and did not cover all relevant compliance requirements. In addition, the OA did not ensure risk assessments were performed or that subrecipients received single audits as required by the UG. Risk assessments The OA did not ensure required risk assessments for subrecipients of the SLFRF program were performed to determine the nature, timing, and extent of monitoring procedures necessary. Two of the 4 state agencies did not perform any risk assessments for the sampled subrecipients. OA officials indicated risk assessment procedures are the responsibility of the state agencies; however, the OA did not provide clear guidance to the state agencies or ensure the state agencies performed and used risk assessments as required. In addition to complying with federal requirements, risk assessments are necessary to ensure monitoring reviews are conducted with adequate frequency to help ensure subrecipient compliance with program requirements. OA pre-payment monitoring procedures The OA has not developed policies and procedures outlining its pre-payment monitoring procedures and did not always clearly document monitoring performed prior to making payments. In their review and approval of each SLFRF subrecipient payment request, OA officials stated they thoroughly review supporting documentation uploaded to the portal by the state agencies, including contracts, bid documentation, invoices, and other supporting documentation. OA officials further stated they review for compliance with certain types of SLFRF program compliance requirements, including allowable activities and allowable costs, procurement, and period of performance. However, the OA does not clearly document review procedures performed. For each of the 22 subrecipients sampled, the portal included documentation pertaining to some, but not all of the applicable compliance requirements. For example, for 5 subrecipient payments reviewed (for 2 state agencies), the portal included summary invoices, but did not include sufficiently detailed documentation showing compliance with the allowable activities and allowable costs and period of performance compliance requirements. Without documented policies and procedures and documentation of prepayment monitoring procedures performed, the OA cannot demonstrate subrecipient monitoring procedures were performed. Additional monitoring procedures The OA does not monitor subrecipients beyond the pre-payment monitoring process previously described. OA officials stated post-payment monitoring procedures are the responsibility of the state agencies; however, the OA did not sufficiently communicate with the agencies regarding subrecipient monitoring responsibilities or ensure the agencies performed monitoring reviews. Our review of subrecipient monitoring procedures at the 4 state agencies noted 3 agencies had developed written policies or procedures regarding subrecipient monitoring. We also noted state agency review procedures varied significantly, did not cover all significant compliance requirements, and were not always documented. While officials of some state agencies indicated they perform detailed pre-payment reviews for compliance with allowable activities and allowable costs, period of performance, and/or local match requirements, officials of some agencies explained they and the OA sometimes review only summary invoices of expenditures from the subrecipients prior to payment. Additionally, officials of all state agencies described various post-payment review procedures such as reviews for compliance with certain requirements, reviews of documentation supporting expenditures of funds advanced to the subrecipient, billing reviews of documentation supporting summary invoices, and/or reviews of the final work product; however, none of the agencies performed all of these procedures. In addition, the agencies could not always provide documentation such reviews had been performed for the sampled items. In addition to noncompliance with subrecipient monitoring requirements, the failure to ensure sufficient monitoring procedures were performed and documented increases the risk that subrecipient noncompliance will not be prevented or detected timely. Subrecipient audits The OA did not ensure the required reviews of single audit reports for applicable SLFRF program subrecipients were conducted. OA officials indicated the state agencies are responsible for ensuring subrecipients had a single audit, and reviewing and following up on the audit reports; however, the OA did not ensure the state agencies performed these procedures. All 4 agencies described procedures to monitor and follow up on single audit reports. Each subrecipient that spent in excess of $750,000 in federal awards during its fiscal year must obtain a single audit in accordance with the UG within 9 months after the end of the fiscal year. In addition to noncompliance with subrecipient monitoring requirements, the failure to ensure subrecipients received required audits and to review and follow up on the related audit reports, increases the risk that subrecipient noncompliance will not be identified and addressed. Conclusions The following table summarizes the results of our sampling at the 4 state agencies, presented in finding points A. and B. Instances in which a criterion was partially met are shown as the applicable number of items sampled. The OA is the lead agency responsible for administering the SLFRF program. OA officials indicated the state agencies were responsible for some of the subrecipient monitoring requirements. However, without clear communication and monitoring of these responsibilities, the OA lacks assurance of compliance with all subrecipient monitoring requirements. Without an established subrecipient monitoring program, the OA cannot provide assurance subrecipients are complying with SLFRF program requirements and there is increased risk that noncompliance with program requirements or subaward terms and conditions will go undetected, or that subaward performance goals will not be achieved. In addition, a subrecipient monitoring program is necessary to demonstrate adequate internal controls over compliance with subrecipient monitoring requirements. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing that Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission." Paragraph 3.10 of the Standards for Internal Control in the Federal Government, also known as the Green Book, states, "[e]ffective documentation assists in management's design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel. Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel, as well as a means to communicate that knowledge as needed to external parties, such as external auditors." Paragraph 12.01 states, "[m]anagement should implement control activities through policies." Recommendations The OA: A. Develop policies and procedures to determine whether recipients of SLFRF program funds are subrecipients or contractors. Continue to work with the state agencies to ensure accurate and documented determinations are prepared for all recipients, and modify subrecipient records as needed. B. Develop a subrecipient monitoring program in accordance with the Uniform Guidance that includes performing risk assessments for each subrecipient for the purposes of determining the appropriate subrecipient monitoring procedures; monitoring for compliance with federal requirements and subaward terms and conditions, and ensuring subaward performance goals are achieved; and reviewing subrecipient single audit reports. Ensure tasks delegated to state agencies are adequately communicated and establish procedures to ensure those tasks are appropriately completed. Auditee's Response A. We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding. B. We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding. Auditor's Comment The OA Corrective Action Plan states the OA partially agrees with Finding point A. because the OA completed training for all agencies regarding agency subrecipient monitoring responsibilities and distributed a memo instructing the agencies to develop subrecipient monitoring policies and procedures. However, as noted in the audit finding, the training was held and letter was sent to state agencies after the current audit period. Because the OA took no corrective action prior to or during the audit period, the internal control weaknesses and noncompliance occurred again in the current audit period.