Finding 1157905 (2024-001)

Criteria – Federally funded entities must establish and maintain effective internal control procedures to ensure compliance Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance). These requirements mandate that direct charges to federal awards be for allowable costs and activities be supported by appropriate documentation, even when such transactions are maintained and processed under a contract with a third party administrator (TPA). Condition and context – The Tribe contracted with a TPA to manage and disburse assistance payments to tribal members. During the audit period, the Tribe implemented a new program funded by the Tribal Broadband Connectivity Program, designed to reimburse tribal members for internet service expenses. The Tribe conducted a survey of members to identify those interested in receiving reimbursement. After reviewing the survey responses, the Tribe provided the TPA with a list of eligible members. Tribal members then accessed the TPA’s system to attest to their need for reimbursement, after which the TPA processed the payments. The Tribe reconciled monthly invoices, monthly reports, and project close out reports provided by the TPA to the Tribe’s records. Through this reconciliation the Tribe identified irregularities in payment records and reports submitted by the TPA, raising concerns of potential vendor irregularities. These concerns were reported to the funding agency. Although the Tribe has initiated an investigation to assess the extent of the suspected vendor irregularities and has since assumed responsibility for processing all payment previously handled by the TPA, the TPA did not provide complete documentation supporting compliance with program requirements in a timely manner. Additionally, the TPA did not provide the Tribe a report on internal controls (SOC 1 Type 2 Report) in the current audit year. This limited the auditor’s ability to test controls or verify expenditures and compliance, resulting in a scope limitation. Cause – The Tribe may have had difficulties in determining the nature and extent of the irregularities because the reports provided by the TPA may have contained incomplete or inaccurate information. Questioned costs – Due to the scope limitation, the auditor was unable to determine whether the $411,596 in broadband reimbursement assistance and related processing expenses, were allowable, reasonable, and properly allocated to the federal program. Consequently, these costs are unknown. Effect – The scope limitation impeded the auditor’s ability to obtain sufficient appropriate evidence to confirm that funds disbursed by the TPA were used in accordance with federal program requirements. This raises the risk of unallowable expenditures and noncompliance with federal regulation. Repeat finding – This is not a repeat finding. Recommendation – The Tribe should continue to report to the funding agency the progress of their investigation. Additionally, the Tribe should enhance its oversight and monitoring of all TPAs based on comprehensive risk assessments. For TPAs that do not provide a current internal controls report (e.g., SOC-1 Type 2 or equivalent), the Tribe should implement heightened oversight measures, such as more frequent reviews, audits, or requiring additional documentation, to ensure compliance an mitigate risk. Views of Responsible Officials – This matter remains subject to Tribal and Federal law enforcement investigations through the Federal Bureaus of Investigations (FBI), the Cowlitz Police Department (CPD) and internal as well as external auditors. While this matter remains the subject of active criminal investigations, further comment is inappropriate.