FINDING 2024-005 Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Summer Food Service Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.559 Federal Award Numbers and Years (or Other Identifying Numbers): FY 22-23, FY 23-24 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of the entity will be achieved. For federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards to provide reasonable assurance that the entity will comply with applicable federal statutes, regulations, and the terms and conditions of its awards. Internal control is not one event or circumstance, but a dynamic and continual process. The process is based on fundamental principles that operate as whole. The fundamental principles are related to five components of internal controls which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in all five of the components. INDIANA STATE BOARD OF ACCOUNTS 35 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Control Environment The School Corporation had not established a strong foundation for an effective internal control system. There was no demonstrated emphasis on the importance of internal controls or on compliance with federal program requirements. Risk Assessment The School Corporation had not defined objectives necessary to identify risks or determine risk tolerances. Management did not identify, analyze, or respond to risks that could affect the achievement of objectives, including risks arising from significant changes to operations or the potential for fraud. Control Activities - Procurement Federal regulations allow for informal procurement methods when the value of the procurement for property or services does not exceed the simplified acquisition threshold, which is set at $250,000. However, Indiana Code 5-22-8 has a more restrictive threshold of $150,000 or less for when small purchase procedures may be used. This informal process allows for methods other than the formal bid process. The informal process is divided between two methods based on thresholds: micro-purchases, typically for those purchases $10,000 or under, and small purchase procedures for those purchases above the micro-purchase threshold but below the simplified acquisition threshold. Micro-purchases may be awarded without soliciting competitive price rate quotations. If small purchase procedures are used, then price or rate quotations must be obtained from an adequate number of qualified sources. The School Corporation did not have internal controls in place to ensure the purchasing method used complied with federal and state requirements. We identified three vendors in fiscal year 2022-2023 and three vendors in 2023-2024 that fell within the small purchase threshold. All vendors were selected for testing. The School Corporation did not obtain price or rate quotes for any of the vendors tested that were less than the simplified acquisition threshold of $150,000 but exceeded the $10,000 micro-purchase threshold. Additionally, the School Corporation did not enter into a contract for two of the six vendors as required by Indiana Code for purchases between $50,000 and $150,000. Finally, documentation detailing the history of the procurement, which must include the reason for the procurement method used, was not available for audit. We identified 125 micro-purchases for the audit period. Of the 125 micro-purchases, 25 were selected for testing. Documentation detailing the history of the procurement, which must include the reason for the procurement method used, was not available for audit for all 25 micro-purchases tested. Control Activities - Suspension and Debarment Prior to entering into subawards and covered transactions with federal award funds, recipients are required to verify that such contractors and subrecipients are not suspended, debarred, or otherwise excluded. "Covered transactions" include, but are not limited to, contracts for goods and services awarded under a nonprocurement transaction (i.e., grant agreement) that are expected to equal or exceed $25,000. The verification is to be done by checking the SAMs exclusions, collecting a certification from that vendor, or adding a clause or condition to the covered transaction with that vendor. INDIANA STATE BOARD OF ACCOUNTS 36 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Upon inquiry of the School Corporation in order to review the procedures in place for verifying that a vendor with which it plans to enter into a covered transaction is not suspended, debarred, or otherwise excluded, the School Corporation disclosed procedures had not been performed to ensure vendors were not suspended or debarred prior to entering into covered transaction. We identified two vendors in 2022-2023 and two vendors in 2023-2024 for which suspension and debarment procedures should have been performed. All vendors were selected for testing. For all vendors, the School Corporation did not perform procedures to ensure the vendors paid with federal grant funds were not suspended or debarred prior to entering into the covered transaction. Information and Communication The School Corporation had not established adequate communication methods or practices to ensure that reliable information was identified, captured, and communicated to the appropriate internal and external parties. Monitoring The School Corporation did not perform ongoing or periodic evaluations to determine whether internal controls were operating effectively or to identify needed improvement. In addition, the School Corporation did not have a process in place to track or to follow-up on corrective actions written in response to audit findings. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.318 states in part: "(a) The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or services required under a Federal award or subaward. The non- Federal entity's documented procurement procedures must conform to the procurement standards identified in §§ 200.317 through 200.327. . . . INDIANA STATE BOARD OF ACCOUNTS 37 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (i) The non-Federal entity must maintain records sufficient to detail the history of procurement. These records will include, but are not necessarily limited to, the following: Rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. . . ." 2 CFR 200.320 states in part: "The non-Federal Entity must have and use documented procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement . . . (1) Micro-purchases– . . . (ii) Micro-purchase awards. Micro-purchases may be awarded without soliciting competitive price or rate quotations if the non-Federal entity considers the price to be reasonable based on research, experience, purchase history or other information and documents it files accordingly. . . . (2) Small purchases– (i) Small Purchase procedures. The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained form an adequate number of qualified sources as determined appropriate by the non-Federal entity. . . ." Indiana Code 5-22-8-3(d) states in part: ". . . the purchasing agent shall award a contract to the lowest responsible and responsive offeror . . ." 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person." Cause The School Corporation had not implemented an effective system of internal controls. Changes in key financial personnel, along with insufficient employee training, contributed to processes and procedures not being properly developed or consistently followed. Policies and procedures were not properly implemented to ensure that appropriate procurement methods were used, histories of procurements were documented, and price or rate quotes for small purchases were obtained. Additionally, vendors' suspension and debarment statuses were not being verified. INDIANA STATE BOARD OF ACCOUNTS 38 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Because the five components of internal control were not properly designed or implemented, the School Corporation's internal control system could not be effective. As a result, general and fraud-related risks, as well as risks arising from significant operational changes, could negatively impact the School Corporation. Existing internal control deficiencies may continue undetected, and additional weaknesses may exist without being identified. Furthermore, by not properly completing the procurement process the School Corporation could have overpaid for goods or services. Additionally, the School Corporation could have made payments to a vendor that was suspended or debarred. Payments to a suspended or debarred vendor are unallowable. Questioned Costs There were no questioned costs identified. Recommendation We recommended the School Corporation design and implement a system of internal controls, which would include policies and procedures related to the five components of internal control. Management should define clear objectives, identify and assess risks, and develop policies and procedures to address those risks. Regular monitoring should be conducted to ensure internal controls are operating effectively and deficiencies are addressed promptly. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards use the appropriate procurement method. Finally, we recommended that the School Corporation's management verify applicable vendors are not suspended or debarred prior to making payment. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.