Finding Text
Finding 2025-007: Pre-Award Risk Assessment for Sub-Recipient (Significant Deficiency) Federal Agency: National Institute of Health Federal Program: All of Us Research Program Assistance Listing Number: 93.368 Criteria: As stated in 2 CFR 200.331 part (b), all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures to prescribe to each individual subrecipient. Condition: During our testing performed over subrecipient expenditures, we were unable to obtain evidence that pre-award risk assessment procedures were performed over subrecipients, consistent with 2 CFR §200.332(b). As such, the Foundation did not adequately determine appropriate monitoring procedures over the sub-recipients. Cause: The Foundation does not have established internal controls or policies regarding subrecipients. Effect or Potential Effect: The Organization could inadvertently be engaged in relationships with subrecipients of higher risk without the appropriate level of oversight to ensure subrecipients are expending funds in accordance with the provisions and terms of the subaward. Questioned Costs: None noted as this compliance requirement is a administrative reporting requirement that does not impact cost eligibility. Context: Our audit procedures consisted of substantive testwork over a sample of subrecipients. We consider our sample to be representative of the population. The samples were made using statistical sampling and we believe the condition appeared to be systematic in nature. Identification as a Repeat Finding: Not a repeat finding. Recommendation: We recommend the Foundation formalize internal control procedures and policies with respect to sub-recipient pre-award risk assessment. The risk assessments should be conducted in order to establish appropriate monitoring procedures.