Finding 1236504 (2025-001)

Finding 2025-001 Lack of Internal Control over Activities Allowed or Unallowed and Allowable Cost Principles – Cash Disbursements – Approvals Significant Deficiency Criteria: The Organization’s internal control policies and procedures should provide for appropriate authorization and approval of significant financial transactions. Approvals should be documented and retained to provide evidence that transactions have been reviewed and authorized by appropriate personnel. Condition and Context: During our review of the Organization’s internal control procedures, we noted that the Organization does not have a formal, documented approval system for certain financial transactions. Due to the small size of the Organization, approvals are generally communicated verbally. As a result, there is limited documentation available to demonstrate that transactions were reviewed and approved by appropriate personnel prior to being processed. Cause: The Organization has relied primarily on informal and verbal approval procedures due to its limited number of personnel and the small size of its operations. Effect: The lack of documented approvals increases the risk that unauthorized or inappropriate transactions could be processed without timely detection. Additionally, the absence of supporting documentation makes it difficult to verify that transactions were properly reviewed and approved and may reduce management’s ability to demonstrate that appropriate internal controls were consistently performed. Questioned Costs: None noted. Repeat Finding: This is not a repeat finding. Recommendation: Management should establish and implement a documented approval process for significant financial transactions. The approval process should identify the individuals authorized to approve transactions and should require evidence of approval, such as signatures, initials, email confirmations, or electronic approvals. The procedures should be designed to be practical for the size of the Organization while providing sufficient documentation that transactions have been appropriately reviewed and authorized. Management Response: Management concurs with this finding. See Corrective Action Plan.