Finding Text
2024-003 – Subrecipient Monitoring Program: ALN# 47.070 = Computer and Information Science and Engineering Grant #: 2216614, 2122756, Grant Period: Year Ended December 31, 2024 Government Agency: National Science Foundation Criteria: Per 2 CFR 200.331–200.332, pass-through entities must: • Evaluate each subrecipient’s risk of noncompliance to determine appropriate monitoring. • Monitor subrecipient activities to ensure compliance with Federal statutes, regulations, and program requirements, including reviewing financial and performance reports. • Verify subrecipients have audits as required under Subpart F. • Issue management decisions on subrecipient audit findings. • Maintain documentation of monitoring activities. Condition: During our testing of subrecipient monitoring, we noted that the Organization did not document required monitoring procedures for the subrecipients selected for testing. Specifically: • No documented risk assessments were performed prior to awarding funds. • The Organization did not obtain or review subrecipient Single Audit reports or written assurances of audit compliance. • Subrecipient agreements did not consistently include all required elements under 2 CFR 200.332(a). Informal monitoring was performed, but not to the level required by the Uniform Guidance. Cause: The Organization does not have adequate internal controls or documented procedures to ensure all required subrecipient monitoring tasks are consistently completed and retained. Personnel indicated that monitoring controls are informal and not centralized. Effect: Failure to perform required subrecipient monitoring increases the risk that Federal funds may be misused, unallowable, or spent in violation of program requirements without detection. Questioned Costs: No questioned costs identified. Context: This sample was not intended to be, and was not, a statistically valid sample. Repeat Finding: Yes Recommendation: We recommend that the Organization: • Develop and implement formalized subrecipient monitoring policies and procedures aligned with 2 CFR 200.332. • Perform and document risk assessments for all subrecipients. • Obtain and review Single Audit reports, as applicable, and issue written management decisions. • Conduct and document ongoing monitoring activities (e.g., financial/performance report reviews, site visits). • Maintain complete monitoring documentation in a centralized and accessible location. Views of Responsible Officials: See management corrective action plan attached.