Finding Text
2025-001 Internal Controls over Approval of Expenditures Charged to Federal Award for U.S. DHHS 93.432 ACL Centers for Independent Living #2401MEICL-00 (Significant Deficiency in Internal Controls over Compliance) Criteria: Management is responsible for implementing controls to ensure that disbursements are properly authorized before payment. Condition and Context: Through audit procedures testing internal controls over cash disbursements charged to major federal award programs, three invoices were paid before receiving documented approval. Management indicated that, in practice, this typically occurs when invoices are processed automatically through a portal or when verbal approval is given prior to the email confirmation. Cause: The Organization’s prior approval process relied on email chains and verbal communications, which could allow invoices to be paid before formal documentation of approval. Effect: Payments made prior to documented approval increase the risk of errors or unauthorized disbursements occurring, representing a significant deficiency in internal control. Recommendation: We recommend continuing to enforce the use of QuickBooks Online and Bill.com for invoice approval to ensure that all payments are reviewed and approved prior to disbursement. Views of Responsible Officials and Planned Corrective Actions: Management agrees with this finding. Upon identification of the issue, we initiated immediate corrective actions to reinforce our internal control environment and ensure full compliance with our cash disbursement approval policy. We have completed re-training for all accounting staff to reaffirm the requirements of our payment approval policy and to emphasize the importance of verifying documented approval prior to processing any invoice, regardless of the payment method (check, automated withdrawals, or portals). Additionally, management has implemented a system upgrade, transitioning from a manual approval workflow to an automated approval process. This upgraded system is designed to require approval before an invoice can proceed to payment, thereby preventing invoices from being disbursed without documented written authorization. We expect this automated control to significantly reduce the risk of future exceptions and strengthen overall compliance. Management will continue to monitor disbursement activity to ensure ongoing adherence to policy and the effectiveness of the new control measures.