Finding 1236168 (2025-014)

Federal Agency: Department of Homeland Security - Federal Emergency Management Agency (FEMA) Federal Program: 97.036 Disaster Grants - Public Assistance (Presidentially Declared Disasters) 2017 - FEMA - 4317 DR-MO 2019 - FEMA - 4435 DR-MO and FEMA - 4451 DR-MO 2020 - FEMA - 4490 DR-MO and FEMA - 4552 DR-MO 2021 - FEMA - 4612 DR-MO and FEMA - 4636 DR-MO 2022 - FEMA - 4665 DR-MO 2023 - FEMA - 4741 DR-MO 2024 - FEMA - 4803 DR-MO 2025 - FEMA - 4855 DR-MO State Agency: Department of Public Safety - State Emergency Management Agency (SEMA) Type of Finding: Internal Control (Material Weakness) and Material Noncompliance Compliance Requirement: Subrecipient Monitoring As similarly noted in our previous audit, during state fiscal year 2025, the SEMA did not fully comply with subrecipient monitoring requirements for the Disaster Grants - Public Assistance (Presidentially Declared Disasters) (DGPA) program. The SEMA did not communicate all required federal award information to subrecipients, completed only 25% of the required number of subrecipient monitoring reviews, and did not perform supervisory reviews of some monitoring reviews. The SEMA disbursed approximately $197 million to 312 DGPA program subrecipients during the year ended June 30, 2025. Regulation 2 CFR Section 200.332(b) requires pass-through entities to ensure every subaward is clearly identified to the subrecipient as a subaward and lists specific information to be communicated to the subrecipient. Regulation 2 CFR Section 200.332(c) requires pass-through entities to evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. Regulation 2 CFR Section 200.332(e) requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward, and achieves performance goals and objectives. Pass-through entities are required to ensure the subrecipient takes corrective action on all significant developments that negatively affect the subaward, including findings from single audits, site visits, and other means. The SEMA enters into a subaward agreement and provides a grant award form to each DGPA program subrecipient with various information about the grant. The SEMA's tiered monitoring process, outlined in the SEMA's Risk Assessment Form and Recovery Division Monitoring Policy (monitoring policy), requires risk assessments be performed 24 months after the disaster declaration for each subrecipient. Risk assessments are performed to evaluate various risk indicators and categorize each subrecipient as high, medium, or low risk. The risk category determines the type and nature of monitoring required for the subrecipient. The policy requires on-site monitoring reviews for all high-risk subrecipients and desk reviews of 20% of medium-risk subrecipients. No additional action is required for low-risk subrecipients. The monitoring policy requires the SEMA to generate reports listing any deficiencies noted during on-site and desk monitoring reviews. The monitoring report will, if applicable, reflect any notice given to the subrecipient about delinquent reports, failure to submit proper documentation, and issues noted during the review. The monitoring report also identifies the SEMA's and subrecipient's actions and plans to resolve the issue(s) by documenting a brief written plan and timeline for the resolution of the issues identified. When all issues have been resolved, the policy requires a follow-up letter and updated monitoring report to be provided to the subrecipient. The policy requires that the appropriate section specialist and the fiscal manager approve the monitoring reports. Subaward information As similarly noted in a FEMA report summarizing an August 2025 FEMA review, during state fiscal year 2025, the SEMA did not include all required federal award identification information in the grant award forms. The grant award forms lacked the following required information: federal award date; subaward budget period start and end date; amount of federal funds obligated in the subaward; total amount of federal funds obligated to the subrecipient, including the current financial obligation; and total amount of the federal award committed to the subrecipient. When required federal grant award information is excluded from grant award forms, subrecipients can be uninformed about specific requirements pertaining to the subaward and there is increased risk of noncompliance with program requirements. In response to the FEMA review, the SEMA updated the grant award forms to include the missing information effective for grants issued in January 2026. Monitoring reviews During state fiscal year 2025, the SEMA performed risk assessments for all 1,049 subrecipients requiring risk assessments; however, the SEMA performed only 64 of the 259 (25%) monitoring reviews required by the monitoring policy. The following table shows the results of the risk assessments performed for fiscal year 2025, the monitoring reviews required by federal regulation and SEMA policy, the monitoring reviews completed, and the monitoring reviews outstanding at year end. In addition, our randomly-selected sample of 2 of the 17 on-site reviews and 5 of the 47 desk reviews completed during state fiscal year 2025, noted the 2 on-site monitoring reports were not approved by the Section Specialist or the Fiscal Manager, as required by the monitoring policy. SEMA personnel indicated they began performing monitoring reviews in January 2025, in response to the prior audit finding; however, they did not have enough time to complete all required monitoring reviews by the end of the fiscal year. SEMA personnel also explained they did not realize supervisory approval of the on-site monitoring reports was required by SEMA's monitoring policy. When subrecipient monitoring reviews are not performed as required by federal regulation and SEMA policy, there is increased risk that noncompliance with program requirements will go undetected. Without adequate supervisory review of monitoring reports, the SEMA has less assurance the reviews were performed adequately and in accordance with the monitoring policy. Conclusions Without adequate internal controls over subrecipient monitoring requirements, there is increased risk of noncompliance, errors, fraud, waste, and abuse of federal funds. Adherence to policies and procedures is necessary to ensure compliance with subrecipient monitoring requirements. Regulation 2 CFR Section 200.303(a) requires the recipient to "[e]stablish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The SEMA continue to strengthen controls and procedures to communicate federal award information to DGPA program subrecipients and monitor subrecipients in accordance with the monitoring policy. In addition, the SEMA should ensure supervisory reviews of monitoring reports are performed, as required. Auditee's Response We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.