FINDING NO. 2024-004 GRANT AWARDS DISBURSEMENTS Federal Agency: U.S. Department of Housing and Urban Development Federal Program: Federal Financial Assistance Listing 14.228 Community Development Block Grants/State’s Program and Non- Entitlement Grants in Hawaii Federal Award No: B-18-DP-72-0001 Compliance Requirement: Activities Allowed or Unallowed Allowable Costs / Cost Principles Questioned Costs: None Repeated Finding: Yes Criteria: The subrecipient agreement between the Bank and the Puerto Rico Department of Housing (PRDOH), establishes in the Terms and Conditions the following: Part III. Scope of Work, Section A. Subrecipient Management Responsibilities, Number 2, that all services shall be made in accordance with PRDOH guidelines, HUD guidelines and regulations, and other applicable state and federal laws and regulations. Part X. Compliance with Federal Statutes, Regulations and the Terms and Conditions of the Federal Award and Additional PRDOH Requirements: Section A. General Compliance - that the Bank as Subrecipient shall also comply with applicable PRDOH’s policies and guidelines as established in Program Guidelines and their amendments, if any, which made an integral part of the subrecipient agreement. Section H. Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards - that the Bank as Subrecipient, shall comply with the applicable provisions in 2 C.F.R. part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards 2 C.F.R. part 200. 2 C.F.R. part 200.303 establishes that a non-Federal entity must: 2 C.F.R. 200.303 (a) - Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 C.F.R. 200.303 (d) - Take prompt action when instances of noncompliance are identified in audit findings. Conditions and Context: During our examination, we performed different audit testing to validate compliance with criteria described above. From a total of 974 Small Business Financing (SBF) Program Recovery Grants (the grants) awarded to business applicants during the year ended June 30, 2024, in the amount of $66,108,871, we performed a grant award test to validate various compliance requirements for the grant. We selected a sample of sixty-one (61) grants awarded as follows: sixteen (16) awarded for working capital purposes, fourteen (14) awarded for working capital and equipment and thirty-one (31) grants awarded for the purchase of equipment, in the total amount of $3,630,774. In addition, we performed a closeout test to validate procedures surrounding closeout of the grant. We selected a sample of sixty-one (61) cases, in the total amount of $3,598,259 from a total of 1,911 grants awarded amounting to $99,766,799 for which closeout procedures were completed during the year ended June 30, 2024. Also, we performed a recapture of funds test to validate procedures surrounding recapture of grant funds. We selected a sample of twenty-five (25) cases, in the total amount of $906,561 from a total of 318 grants awarded amounting to $11,492,282 for which recapture of funds were completed during the year ended June 30, 2024. Amount Awarded Computed Incorrectly Based on the results of our grant award testing, we recomputed the amount of the grant awarded, and noted that in one (1) case, representing approximately 2% of the total sample, the amount of the award was computed incorrectly. The average quotation cost used for the acquisition of equipment, was computed in the amount of $12,163, instead of $11,622. Missing Documents in Grant Management System of Record for the Grants Based on the results of our examination, we noted certain exceptions where documents were missing in the Grant Management System of Record for the Grants (Canopy) or the document had missing information. The situations noted were as follows, classified by the test performed. Grant Award Procedures Testing: For the grants awarded for equipment, we reviewed the supporting documentation for required quotes and noted that in thirteen (13) cases, or approximately 29%, the quotes provided by the Business Applicants did not have the document date. For one (1) case, representing approximately 2% of total sample, we reviewed the support documentation required for eligible equipment and noted that for one item requested the eligible cost surpassed the $10,000 threshold for the requirement of (3) three vendors quotations. However, just one quote was obtained. For fifty-seven (57) cases, representing approximately 93% of total sample, we noted that the SBF Acknowledgement of Receipt and Certification Guidance (Task 4 for the closeout phase) was not found in Canopy. Closeout Procedures Testing: For three (3) cases, representing approximately 5% of total sample, the applicant’s duplication of benefits certification used in the Expenditure Review & Closeout Process, was not found. Instead, we found the following: the review of the bank statements (one case), a note (one case) and in other case we noted that the certification was uploaded in May 2025. For one (1) case, representing approximately 2% of total sample, no sufficient evidence was provided to validate utilities expense. Applicant submitted a letter from the landlord as a receipt without the invoice for the utilities. Expense amounted to $1,768. For two (2) cases, representing approximately 3% of total sample, the grant award agreement was not located on file. The document was found in the grant award extension file. Incorrect Data in Grant Management System of Record for the Grants As a result of our audit procedures, we noted several instances where the information in the Grant Management System of Record was inaccurate. The situations noted were as follows, classified by the test performed. Closeout Procedures Testing: For two (2) cases, representing approximately 3% of total sample, we could not validate the eligibility review start date. The data disclosed in this field on the first application was the date of the grant award extension. For two (2) cases, representing approximately 3% of total sample, the applicant did not comply with the period of reporting for the Third Low and Moderate Income (LMI) as established in the Program's Guidelines. Subsequently, we noted that the original date, that should not be changed, was changed in the Canopy file. For one (1) case, representing approximately 2% of total sample, closeout procedures were completed, but the status in Canopy appeared as "Pending Closeout Confirmation". During our evaluation of the report provided for closeout procedures, we noted that twenty-three (23) cases appeared with a Notice of Compliance Letter sent date during the period under audit (July 1, 2023 to June 30, 2024), but the disbursement date was made from June 2024 through November 2024. Notice of compliance letter should be dated after the date of disbursement. In addition, the Closeout Status was "Closing Team Case Manager (CM) Review in Progress". Recapture of Funds Testing: During our evaluation of the recapture of funds report, we noted that for one (1) case the grant amount as per the grant award agreement does not agree with the amount as included in the recapture of funds report provided for audit purpose. The difference amounted to $42,195. Inadequate Documentation and Implementation of Procedures As a result of our audit procedures, we noted several instances where the procedures were not completed or properly documented in Canopy. The situations noted were as follows, classified by the test performed. Closeout Procedures Testing: For five (5) cases, representing approximately 8% of total sample, the First LMI Form was not provided by the Applicant in the period established. The period of reporting must be during the Eligibility Review phase. For one (1) case, representing approximately 2% of total sample, the Second LMI Form was not provided by the Applicant in the period established. Period of reporting must be during the Award Coordination phase. For nine (9) cases, representing approximately 15% of total sample, the third LMI Form was not provided by the Applicant in the period established. Period of reporting must be completed during the Expenditure and Closeout phase. The Case Manager is required to comply with the following notifications to the Applicant: a) First Receipts Review Reminder; b) Subsequent Receipt Review Reminder to applicants after 30 days following disbursement date. - For forty-four (44) cases, representing approximately 72% of total sample, there was no evidence of reminder sent to the Applicant. - For thirteen (13) cases, representing approximately 21% of total sample, the reminder was sent to Applicant, but not in the first 30 days after disbursement. Recapture of Funds Testing: For four (4) cases, representing approximately 16% of total sample in which, the applicant did not return the funds within the 30-day period, did not provide adequate documentation nor request a program administrative reconsideration. The cases were not referred to PRDOH Legal Division as established in the guidelines. For one (1) case, representing approximately 4% of total sample in which, the applicant did not return the funds within the 30-day period or provided adequate documentation. Also, the program reconsideration was denied. The case was not referred to PRDOH Legal Division as established in the guidelines. Cause: Management has not consistently applied procedures as described in the Bank’s policies for underwriting, duplication of benefits, expenditure review and closeout, and recapture of funds to ensure compliance with requirements. In addition, for applications with grant award extension, the Bank requested the program administrator to duplicate files to avoid entering basic information for the same application. This matter caused the information between both applications to be mixed between first application and grant award extension. Effect: The Bank did not consistently comply with procedures of work performed as detailed in the policies and procedures to ensure amounts awarded incorrectly and missing documents in Grant Management System of Record are promptly identified and corrected. This resulted in a significant deficiency in internal controls of grant award process. In addition, the Bank needs to ensure as part of the closeout procedures that information included in the file belongs to the case being evaluated and any change in the information that does not agree with the application is properly investigated and corrected with the appropriate supporting documentation. Any change for the application needs to be properly documented in the notes for the case to ensure proper audit trail for any subsequent review. Recommendation: Management must establish internal controls that permit the proper detection of any instance of non- compliance with policies and procedures established for the underwriting, duplication of benefits, expenditure review and closeout, and recapture of funds of the grant. By doing so, the Bank will avoid falling in noncompliance with federal requirements and the terms and conditions as established in the subrecipient agreement.