Finding Text
Finding 2025-001 Subrecipients Federal Agency: United States Department of Justice Federal Program: Edward Bryne Memorial Justice Assistance Grant Program Assistance Listing Number: 16.738 Award Identification Number: 2019-YA-BX-K002 Criteria or Specific Requirement: CFR § 200.332, "Requirements for pass-through entities", requires pass-through entities to evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Condition: During our audit, we noted that the pre-award risk assessment was not performed until November 2024, subsequent to the subaward being signed with the subawardee. Based on our discussions with management, the process for performing pre-award risk assessment for subrecipients and determining and documenting the appropriate level of ongoing monitoring for subrecipients was implemented in November 2024. We also noted that the Association did not perform the FFATA (Federal Funding Accountability and Transparency Act) reporting requirements. Cause: During 2025, the Association's finance department turned over significantly, resulting in oversight of the compliance requirement. Effect or Potential Effect: The Association could inadvertently engage in relationships with subrecipients of higher risk without the appropriate level of oversight (i.e. monitoring) to ensure subrecipients are expending funds in accordance with the provisions and terms of the subaward. Questioned Costs: None noted. Context: Our audit procedures in this area consisted of substantive testwork over a sample of subrecipient expenditures that were selected based on a defined threshold. We consider our sample to be representative of the populations, and thus, is a statistically valid sample. The issue is deemed to be systemic. Identification as a Repeat Finding, if Applicable: 2024-001 Recommendation: We recommend that the Association strictly adhere to its current subaward policy and ensure the risk assessment procedures over all of its subrecipients are performed and documented prior to engagement. Based on these risk assessments, the Association should assign a risk level to each, and then determine the monitoring tools to apply based on these risk levels.