Finding Text
#2024-002: Grant Program: Department of Health and Human Services – National Institutes for Health Research and Development Cluster – Cancer Control – Assistance Listing #93.599 – Lack Inadequate Documentation and Lack of Independent Review of Expenditures Condition: During the audit for the fiscal year ended May 31, 2024, transactions lacked sufficient supporting documentation or evidence of review and approval by the director. Additionally, some of the expenditures were incurred by the director and were self-reviewed without any independent oversight or secondary approval. Criteria: Per 2 CFR § 200.303, nonfederal entities must establish and maintain effective internal control over federal awards that provide reasonable assurance that the organization is managing the awards in compliance with federal statutes, regulations, and the terms and conditions of the award. Effective internal controls include proper documentation and independent review of expenditures to ensure allowability, reasonableness, and compliance. Context: Out of 61 expenditures tested, 28 lacked sufficient supporting documentation or evidence of review. 21 of the 28 were expenditures incurred by the director and self-reviewed. Cause: The Consortium has not implemented adequate internal control procedures to ensure that all expenditures are properly documented and independently reviewed. The lack of segregation of duties, particularly in the review of expenditures made by the director, contributed to the deficiency. Effect: The absence of sufficient documentation and independent review increases the risk of unauthorized, unsupported, or unallowable expenditures. Recommendation: We recommend that the Consortium strengthen its internal control procedures by: • Requiring complete supporting documentation for all expenditures; • Implementing a formal review and approval process for all transactions, including those made by executive leadership; and • Ensuring that expenditures made by the director are reviewed and approved by an independent party, such as a board member or designated individual. Management Response: See Corrective Action Plan.