Finding 1238366 (2025-001)

Material Weakness Repeat Finding
Requirement
L
Questioned Costs
-
Year
2025
Accepted
2026-09-29
Audit: 413210
Organization: Pennsylvannia Certified Organic (PA)

AI Summary

  • Core Issue: There was a material weakness in internal controls, leading to unauthorized transactions totaling approximately $216,387.
  • Impacted Requirements: Existing authorization procedures and monitoring controls over disbursement activities were found inadequate.
  • Recommended Follow-Up: Strengthen internal controls, implement new authorization protocols, enhance monitoring, and ensure proper segregation of duties.

Finding Text

Material Weakness in Internal Control Related to Unauthorized Transactions: Criteria and Condition The Organization's internal control is designed to prevent or timely detect unauthorized transactions. During the year ended December 31, 2025, the Organization identified certain unauthorized transactions initiated by an external party. The matter was promptly investigated and contained upon discovery. Context The unauthorized transactions resulted in a recorded loss of approximately $216,387 during the year ended December 31, 2025. Cause The investigation performed by management and external parties identified weaknesses in the Organization’s existing authorization procedures and monitoring controls over disbursement-related activities. Potential Effect The deficiencies in internal control resulted in unauthorized transactions and a material loss to the Organization. These control deficiencies create a reasonable possibility that unauthorized transactions could occur and not be prevented or detected and corrected on a timely basis. Recommendation We recommend that the Organization strengthen internal controls, implement new authorization protocols, enhanced monitoring controls, segregation of duties, additional management review procedures, and assess financial institution security for alignment with Organizational needs. Views of Responsible Officials and Planned Corrective Action Management agrees with the finding and all planned remediation measures have been fully implemented, including strengthened authentication and access controls across financial institutions, enhanced transaction monitoring, updated authorization policies, a reassessment of banking relationships, and increased staff training and cyber insurance coverage. Anticipated Completion Completed

Corrective Action Plan

Corrective Action Plan Steps & Status - Complete All planned remediation measures have been fully implemented, including strengthened authentication and access controls across financial institutions, enhanced transaction monitoring, updated authorization policies, a reassessment of banking relationships, and increased staff training and cyber insurance coverage. 1. Multi-factor Authentication for all financial institutions and key business systems 2. Segregation of user controls for all financial institutions 3. ACH/wire limit review of all financial institutions 4. ACH and Positive Pay enabled for operating account 5. New Vendor / Vendor changes policy 6. Reassess Banking Institutions for security and alignment with PCO banking needs 7. Ongoing staff cyber security training 8. Increase Cyber insurance coverage

Categories

Internal Control / Segregation of Duties Subrecipient Monitoring Material Weakness

Programs in Audit

ALN Program Name Expenditures
10.163 MARKET PROTECTION AND PROMOTION $3.32M