Finding Text
Criteria: The Company should establish and maintain effective internal control over federal awards to provide reasonable assurance that the award is managed in compliance with federal statutes, regulations, and the terms and conditions of the award. Adequate documentation must be maintained to support internal control activities and compliance with federal requirements. Statement of Condition: During our walkthroughs and substantive testing, supporting documentation was not available to allow us to evaluate whether required internal controls were performed. The documents were unavailable due to the expiration of the entity’s document retention period and employee turnover, which resulted in the loss of institutional knowledge about the controls performed during the award period. Because the requested documentation could not be provided, we were unable to verify the performance or effectiveness of internal controls related to the compliance requirement tested. Cause of Condition: The entity did not maintain documentation of internal control activities beyond the minimum required retention period and did not have processes in place to preserve institutional knowledge during employee turnover. As a result, supporting records necessary for testing internal controls over federal awards were no longer available. Effect of Condition: Due to the absence of supporting documentation, we were unable to determine whether internal controls over the compliance requirement were properly designed and operating effectively. This results in the inability to test internal controls and assess control risk at a “low” level. Recommendation: We recommend that management (1) strengthen record retention practices to ensure that documentation of internal control activities is preserved in accordance with 2 CFR 200.334 and is available for future audits, (2) implement procedures to maintain institutional knowledge, particularly during periods of employee turnover (e.g., documented policies, crosstraining, centralized recordkeeping), and (3) consider extending retention periods for documents supporting high-risk federal programs or key internal control activities. Management should ensure documentation is sufficient to demonstrate compliance and support internal control operations. Identification of Repeat Finding: This finding is a repeat of the finding noted in the audit for December 31, 2019 as finding 2019-003. Views of Responsible Officials: Management understands and accepts the recommendation as outlined in the Corrective Action Plan.