FINDING 2024-004 Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Summer Food Service Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.559 Federal Award Numbers and Years (or Other Identifying Numbers): FY 22-23, FY 23-24 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Reporting, Special Tests and Provisions - Non-Profit School Food Service Accounts Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report for control activities - allowable costs/cost principles. The prior audit finding number was 2022-003. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of the entity will be achieved. For federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards to provide reasonable assurance that the entity will comply with applicable federal statutes, regulations, and the terms and conditions of its awards. Internal control is not one event or circumstance, but a dynamic and continual process. The process is based on fundamental principles that operate as whole. The fundamental principles are related to five components of internal controls that are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in all five of the components. Control Environment - Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Reporting, Special Tests and Provisions - Non-Profit School Food Service Accounts The School Corporation had not established a strong foundation for an effective internal control system. There was no demonstrated emphasis on the importance of internal controls or on compliance with federal program requirements. INDIANA STATE BOARD OF ACCOUNTS 32 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Risk Assessment - Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Reporting, Special Tests and Provisions - Non-Profit School Food Service Accounts The School Corporation had not defined objectives necessary to identify risks or determine risk tolerances. Management did not identify, analyze, or respond to risks that could affect the achievement of objectives, including risks arising from significant changes to operations or the potential for fraud. Control Activities - Allowable Costs/Cost Principles The School Corporation was a member of the Food2School Cooperative that procured food and supply items on behalf of the member schools. The School Corporation did not have internal controls in place to ensure that the amount charged per item agreed to the approved price lists. Control Activities - Eligibility Any child enrolled in a participating school who meets the applicable program's definition of "child" may receive meals under the applicable programs. A child belonging to households meeting nationwide income eligibility requirements may receive meals at no charge or at a reduced price. Children that have been determined ineligible for free or reduced-price meals pay the full price for their meals. A child's eligibility for free and reduced-priced meals under a Child Nutrition Cluster program may be established by the submission of an annual application or statement which furnishes such information as family income and family size. The School Corporation determines eligibility by comparing the data reported by the child's household to published income eligibility guidelines. Annual eligibility determinations may also be based on the child's household receiving benefits under SNAP, FDPIR, the Head Start Program, or, under most circumstances, the TANF program. A household may furnish documentation if its participation in one of those programs, or the School Corporation may obtain the information directly from the state or local agency that administers those programs. Certain foster, runaway, homeless, and migrant children are categorically eligible for free school lunches and breakfasts. Direct certified households do not need to complete an application. Paper applications and online applications are processed in the School Corporation's software system to determine if students are eligible for free or reduced meals. Paper applications are input by the Food Service Director and online applications are directly submitted by parents. The software's determination of eligibility was recalculated by the Food Service Director without an oversight or review process in place to ensure accuracy. Additionally, the Food Service Director downloaded the Direct Certifications file monthly from the CNC Web Portal and uploaded the file into the School Corporation's software without a documented oversight or review process in place to ensure directly certified students were properly processed. Information and Communication - Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Reporting, Special Tests and Provisions - Non-Profit School Food Service Accounts The School Corporation had not established adequate communication methods or practices to ensure that reliable information was identified, captured, and communicated to the appropriate internal and external parties. INDIANA STATE BOARD OF ACCOUNTS 33 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring - Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Reporting, Special Tests and Provisions - Non-Profit School Food Service Accounts The School Corporation did not perform ongoing or periodic evaluations to determine whether internal controls were operating effectively or to identify needed improvement. In addition, the School Corporation did not have a process in place to track or to follow-up on corrective actions written in response to audit findings. The lack of internal controls was systemic throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause The School Corporation had not implemented an effective system of internal controls. Changes in key financial personnel, along with insufficient employee training, contributed to processes and procedures not being properly developed or consistently followed. Furthermore, documentation was not maintained to show that invoiced amounts were verified against approved price lists. Finally, only one individual performed the direct certification process, and no secondary review was conducted to ensure the accuracy of data entered into the School Corporation's school lunch software system or the correctness of determinations made. Effect Because the five components of internal control were not properly designed or implemented, the School Corporation's internal control system could not be effective. As a result, general and fraud-related risks, as well as risks arising from significant operational changes, could negatively impact the School Corporation. Existing internal control deficiencies may continue undetected, and additional weaknesses may exist without being identified. Without verifying that invoiced amounts agreed to approved price lists, the School Corporation is at risk of paying more than the bid-approved prices. Errors or incorrect entries in the school lunch software and inaccurate eligibility determinations could result in students receiving free or reduced-price meals in error. Without a properly implemented internal control system, the School Corporation cannot effectively prevent, or detect and correct, material noncompliance. INDIANA STATE BOARD OF ACCOUNTS 34 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs There were no questioned costs identified. Recommendation We recommended the School Corporation design and implement a system of internal controls, which would include policies and procedures related to the five components of internal control. Management should define clear objectives, identify and assess risks, and develop policies and procedures to address those risks. We further recommended that review processes be established to verify that invoiced amounts agree with approved price lists. Finally, we recommended a secondary review be implemented for the direct certification process to ensure the accuracy of information entered into the school lunch software and the correctness of eligibility determinations. Regular monitoring should be conducted to ensure internal controls are operating effectively and deficiencies are addressed promptly. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.