Finding 2025-002 Internal Control Finding: Documentation of Procurement and Suspension and Debarment Control Procedures Condition: The Organization has established internal control policies and procedures related to procurement activities, including procedures intended to address suspension and debarment requirements for vendors, subcontractors, and contractors. However, during the audit, documentation supporting the performance of these procedures was not consistently maintained in a manner that allowed the control process to be readily traced, tested, and verified. Specifically, while management represented that procurement and suspension and debarment procedures were performed, the audit evidence available did not consistently demonstrate: • The specific procedures performed for each selected vendor, subcontractor, or contractor; • The timing of suspension and debarment verification relative to procurement or contract approval; • The individual responsible for performing and/or reviewing the procedures; • Evidence of review, approval, or resolution of exceptions, if applicable; and • A clear audit trail connecting procurement files, vendor approvals, contract documentation, and suspension and debarment checks. As a result, the audit team experienced difficulty following and testing the full control process from initiation through approval and verification. Criteria: An effective internal control system should include policies and procedures that are not only designed appropriately but also documented in a manner sufficient to demonstrate that the controls were performed as intended. For procurement and compliance-related controls, documentation should provide evidence that required procedures were completed timely, reviewed as applicable, and retained in a format that supports monitoring, oversight, and auditability. For vendors, subcontractors, and contractors subject to suspension and debarment requirements, the Organization should maintain adequate documentation showing that appropriate verification procedures were performed before entering into covered transactions or otherwise as required by the Organization’s policies and applicable compliance requirements. Cause: The Organization has policies in place; however, the related procedures and documentation practices did not consistently result in a complete, centralized, and readily testable audit trail. In certain instances, evidence of the procurement process and suspension and debarment verification was maintained across multiple files, systems, emails, or supporting documents, making it difficult to determine whether all required steps were completed and reviewed in accordance with established policies. This appears to be due, at least in part, to a lack of standardized documentation requirements, inconsistent retention of supporting evidence, and limited use of a uniform checklist or approval record to demonstrate completion of the control process. Effect: When documentation is not maintained in a consistent and readily testable manner, there is an increased risk that required procurement and suspension and debarment procedures may not be performed, reviewed, or retained consistently. In addition, management may have reduced ability to demonstrate compliance with internal policies and applicable requirements. The lack of clear documentation and process traceability may also result in: • Difficulty verifying that vendors, subcontractors, and contractors were appropriately reviewed prior to selection, approval, or contract execution; • Increased risk of entering into transactions with parties that are suspended, debarred, or otherwise ineligible; • Inconsistent application of procurement procedures across departments, programs, or personnel; • Reduced effectiveness of management review and monitoring controls; • Delays or inefficiencies during audits, monitoring reviews, or compliance examinations; and • Increased risk of questioned costs, compliance findings, or reputational harm if required procedures cannot be substantiated. Recommendation: We recommend that management enhance the documentation and traceability of its procurement and suspension and debarment control procedures. Although policies are already in place, management should consider implementing a standardized process to ensure evidence of control performance is complete, consistent, and readily available for review. Recommended actions include: 1. Develop a standardized procurement and eligibility verification checklist to be completed for applicable vendors, subcontractors, and contractors. 2. Require documentation of suspension and debarment checks, including the date performed, source used, name of the party searched, results of the search, and the individual performing the verification. 3. Document supervisory review or approval, including evidence of review prior to vendor approval, contract execution, or payment, as applicable. 4. Centralize retention of procurement and compliance documentation within the vendor, contract, or procurement file to provide a clear audit trail. 5. Establish clear documentation retention expectations for emails, screenshots, system reports, approval forms, and other supporting evidence. 6. Periodically monitor compliance with documentation requirements to confirm that procedures are being performed and retained consistently. 7. Provide training to personnel involved in procurement and contracting to reinforce documentation expectations and the importance of maintaining evidence of control performance. Implementing these enhancements would improve management’s ability to demonstrate that procurement and suspension and debarment controls are operating effectively and would support more efficient testing by internal or external reviewers.