Finding Text
Significant Deficiency – Lack of risk assessment over subrecipient Agency: Department of Health and Human Services ALN# 93.592 - Family Violence Prevention and Services/Discretionary Grants Grant Year: 2025 Grant Numbers: 90EV054301C6; 90EV052301C6; 90EV056003; 90EV0459-04 Criteria: Per 2 CFR §200.332(b), pass-through entities are required to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward. This evaluation is necessary to determine the appropriate level of monitoring. Risk factors may include prior experience, results of previous audits, personnel or system changes, and results of federal monitoring. Condition: The Organization passed-through funding to two subrecipients without documenting a risk assessment over the entities’ possible noncompliance. Cause: Management has not established or implemented formal policies and procedures to ensure subrecipient risk assessments are performed in accordance with Uniform Guidance requirements. Additionally, there is a lack of oversight controls to verify completion and documentation of the risk assessment process. Possible Effect: Without performing and documenting subrecipient risk assessments, the Organization runs the risk that monitoring procedures are not appropriately tailored to the level of risk. This increases the likelihood that noncompliance with Federal requirements may occur and remain undetected. Questioned Costs: None. Perspective: Statistical sampling was not used, however, sampling methodology followed AICPA guidelines. Repeat Finding: This is not a repeat finding. Recommendation: We recommend the Organization develop and implement formal policies and procedures to ensure that risk assessments are performed for all subrecipients at the time of subaward and updated as necessary. The process should include documented consideration of required risk factors in accordance with 2 CFR §200.332(b) and should be used to determine the appropriate level and frequency of monitoring activities. Management’s Response (unaudited): See Corrective Action Plan.