Finding Text
Subrecipient Monitoring – Risk Assessment (Noncompliance) and significant deficiency in Internal Control Finding 2025-002 Identification of the Federal Program: 93.600 – Head Start Cluster, 93.387 – National and State Tobacco Control Program, and 93.872 – Tribal Maternal, Infant, and Early Childhood Home Visit Criteria: According to 2 CFR § 200.332, a pass-through entity must evaluate each subrecipient's fraud risk and risk of noncompliance as a form of subrecipient monitoring. In doing so, a pass-through entity must review financial reports, including their financial audits, ensure that the subrecipient takes corrective action on all significant developments affecting the subaward, issue a management decision on any audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through and resolve audit findings specifically related to the subaward. If a finding rises to a certain level, the pass-through should consider taking action against noncompliant subrecipients. Condition: The organization does not have a formal risk assessment process in place. As of the date of fieldwork, audit reports of member tribes receiving subrecipient payments were not all received and therefore, were not reviewed to perform a proper risk assessment. We additionally noted that a quarterly report was not submitted as required per the agreement and funds were still distributed. Cause: Management's unfamiliarity with 2 CFR § 200.332 requirements and overall relationship with the Tribes. Effect: Risk assessment is significant to performing sufficient subrecipient monitoring. The structure of the organization being governed by the chairs of each Tribe and created to obtain grants to further support the Tribes creates a level of trust amongst the Tribes and the Organization; however, this does not eliminate the need to perform a risk assessment and ensure that the individual Tribes are in compliance at a Federal level. Questioned Costs: $0 Repeat Finding: No Recommendation: We recommend that management and program managers familiarize themselves with the requirements of 2 CFR § 200.332 and create a formal risk assessment process. We also recommend that Tribes are held accountable for not submitting a timely audit (i.e. withholding funds until provided). Management Response: Management agrees with the finding. The Council will work on implementing an efficient, yet effective risk assessment process for all subrecipients.