Finding 1227793 (2025-004)

FINDING 2025-004 – Material Weakness in Internal Controls over Compliance Federal Agency: U.S. Department of Health and Human Services Federal Program: Maternal Infant and Early Childhood Home Visiting (MIECHV) Assistance Listing Number: 93.870 Compliance Requirements: Activities Allowed or Unallowed / Allowable Costs / Procurement and Suspension and Debarment / Reporting Type of Finding: Material Weakness in Internal Control Over Compliance Criteria The Uniform Guidance requires non-federal entities receiving federal awards to establish and maintain effective internal control over federal awards that provides reasonable assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Under 2 CFR § 200.303, the auditee is required to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the auditee is managing the award in compliance with applicable requirements. In addition, 2 CFR § 200.516 requires the auditor to report significant deficiencies and/or material weaknesses in internal control over major programs as audit findings in the schedule of findings and questioned costs. Condition During our audit of the federal program identified above, we noted that internal controls over compliance were not designed and/or operating effectively to allow the auditor to rely on those controls for purposes of performing the Single Audit. Specifically, management was unable to provide sufficient evidence that key controls over activities allowed or unallowed, allowable costs, procurement and suspension and debarment, and reporting existed or were consistently performed, reviewed, and documented. Examples noted included the following: • Approval and review controls were not consistently documented. • Supporting documentation was not consistently retained to demonstrate compliance with program requirements. • Control activities were performed informally and were not supported by evidence of review. • Duties related to preparation, approval, and review of compliance information were not adequately segregated. • Management’s monitoring of compliance activities was not sufficiently documented. As a result, we were unable to rely on internal controls over compliance and performed additional substantive procedures to obtain sufficient appropriate audit evidence regarding the entity’s compliance with the applicable federal program requirements. Cause The condition appears to have resulted from insufficient formalization and documentation of internal control procedures over federal program compliance. While certain review or approval procedures may have been performed, the entity did not maintain adequate documentation to demonstrate that those controls were performed timely, consistently, and by appropriate personnel. In addition, the entity experienced significant turn over in external bookkeeping firms and management during the fiscal year. Additionally, they undertook an accounting software transition that resulted in significant delays in timely recording of accounting transactions and monitoring of controls. Effect or Potential Effect When internal controls over compliance are not adequately designed, implemented, or documented, there is an increased risk that noncompliance with federal statutes, regulations, or award terms and conditions could occur and not be prevented, detected, or corrected in a timely manner. Although our substantive audit procedures did not identify material noncompliance with the applicable compliance requirements, the lack of effective and documented internal controls limited the auditor’s ability to rely on those controls and increased the risk of errors or noncompliance related to the federal program. Questioned Costs None noted Context The federal program identified above was audited as a major program for the year ended June 30, 2025. During our audit procedures, we selected samples related to payroll disbursements, direct grant expenditures, and reporting for grant reimbursements and evaluated whether internal controls over compliance were designed and operating effectively. Based on the procedures performed, we determined that the entity did not maintain sufficient evidence of control performance to support reliance on internal controls over compliance for the applicable compliance requirement. Repeat Finding This is not a repeat finding. Sampling Method Not applicable Recommendation We recommend that management strengthen its internal controls over federal program compliance by implementing formal written procedures that identify the specific controls to be performed, the personnel responsible for performing and reviewing those controls, and the documentation required to evidence control performance. At a minimum, management should: • Develop written policies and procedures for each applicable compliance requirement. • Identify key controls over compliance and assign responsibility for performance and review. • Maintain documentation evidencing review, approval, and monitoring activities. • Provide training to program and finance personnel regarding federal compliance requirements and Single Audit documentation expectations. • Periodically monitor compliance activities to ensure controls are operating as designed. • Design controls that limit the risk of management override.