Finding 1222790 (2025-002)

Subrecipient Monitoring Federal Department – U.S. Department of Treasury Federal Award Identification Number and Year: SLFRP0143 and 2021 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds, Federal Assistance Listing #21.027 County Department(s) – Various Finding 2025 – 002 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Section 200.332. Requirements for pass-through entities, requires that “A pass-through entity must: (b) ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the information provided below. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes: (1) Federal award identification. (i) Subrecipient's name (must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN)…(c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency)... (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. The Cook County, Illinois ARPA: Subrecipient Risk Assessment and Risk Reassessment Process Manual (dated May 16, 2024), states "If a subrecipient does not complete the risk reassessment by the assigned due date, their risk level will remain the same and they will be eligible for reimbursements only. Advancement requests will not be considered until the subrecipient completes the risk reassessment." Also, the level of monitoring to which the subrecipient must adhere to will vary by risk level assigned. The monitoring expectations associated with each risk level will be communicated to the subrecipient in the form of the risk reassessment and financial monitoring letter”. The monitoring parameters associated with each risk level are outlined below: • High Risk – minimum of monthly check-ins with County to share program progress, updates, and share programmatic questions/concerns • Medium Risk – minimum of monthly to quarterly check-ins with County to share program progress, updates, and share programmatic questions/concerns • Low Risk - minimum of quarterly check-ins with County to share program progress, updates, and share programmatic questions/concerns The Cook County ARPA Grants Compliance Guide, under External Risk Management, states "Federal grant regulations in Uniform Guidance require that all SLFRF-funded programs be conducted in a risk-informed manner, particularly the selection and monitoring of subrecipients that implement programming on behalf of Cook County. In order to assess the risk potential of external subrecipient partners, each subrecipient organization is assessed for risk as the beginning of their partnership with the County and assigned a risk rating of High, Medium, or Low. This rating informs the monitoring and documentation requirements for that subrecipient. Subrecipients are reassessed for risk annually to reflect any changes or improvements in their risk potential”. The Cook County ARPA SLFRG Grant Subaward Financial Management Manual (revised March 3, 2025), under Subaward Financial Management Roles and Responsibilities states that “as outlined in the risk assessment form, the level of monitoring will be based on subrecipient’s risk designation. The subrecipient will receive a risk assessment and financial management letter apprising it of the expectations associated with its assigned risk level”. In addition, under Section A. Advancement of Funds Process, Item VI. Shifting to Reimbursement Model, states “nine months prior to the program’s conclusion, no further advancements can be provided to a subrecipient. Unspent advance balances will be applied against subsequent expenses incurred and reported to the County. Some subrecipients may need working capital to maintain operations, and it will be the responsibility of the Department to create a drawdown schedule to ensure to the best of its ability that all advanced funds are expended and/or recouped by program-end”. CONDITION During the current audit period, the County performed inadequate monitoring of its subrecipients as required by its internal policies. CAUSE Based on discussions with management, the County instituted new internal guidelines for program and financial management of its State and Local Fiscal Recovery Funds (SLFRF) award. These guidelines included more strict monitoring controls than federal regulations require. Additionally, the County deployed a new grants management system specifically to assist in collection and reporting on program metrics and subrecipient financials. The grants management system went live in spring of 2024. The County continues to invest in compliance oversight and technical assistance to ensure its new guidelines are effectively implemented, particularly in relation to utilization of its grants management system. EFFECT Failure to adequately perform and document the risk assessments on its subrecipient(s) could result in inadequate monitoring of the activities and performance of a subrecipient. Also, this could result in Federal awards being used by the subrecipient for unauthorized purposes. QUESTIONED COSTS None. CONTEXT During our review of 40 subrecipients (of a population of 250 subrecipients), we noted the following:  For 1 subrecipient file, we noted one (1) monitoring log was completed. However, based on risk rating(s) assigned, a total of four (4) monitoring logs were required.  For 11 subrecipients, we noted the risk reassessments were expired, ranging from 167 to 920 days over the assigned due date. Of the 11 subrecipients, 6 had risk reassessments currently outstanding and 3 had advancement requests approved without a risk reassessment, both of which were contrary to County’s internal policies. The total amount advanced to the 3 subrecipients was $772,214.  We noted one subrecipient submitted advancement requests totaling $852,757 during the County’s fiscal year. Based on review of the supporting documentation, it appears these funds are actual reimbursement of costs previously incurred by the subrecipient and should have been submitted via a payment request(s) as opposed to an advancement request(s). Consequently, the SEFA reported total expenditures incurred of $594,815, instead of the total $852,757, resulting in a net understatement of $257,942. However, the subrecipient was compensated for all work that was performed.  We noted the County executed a subrecipient agreement (signed December 20, 2024) prior to verifying the subrecipient had an active Unique Entity Identifier (UEI) number (active date January 20, 2025) which is required by Federal regulation. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend County implement procedures to ensure adequate documentation (monitoring log) is maintained and timely completion of risk reassessment is conducted to support the evaluation of each subrecipient’s risk of noncompliance as required by Federal regulations and its internal policies. Also, the County should adhere to its written internal policies which require that advancement requests not be considered until the subrecipient completes the risk reassessment. In addition, the agreement with a subrecipient should not be executed without an active UEI, unless exceptions to these policies are clearly documented. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 44-45.