2025-001 Finding – Federal Award Type: Subrecipient Monitoring – Non-Compliance and Material Weakness in Internal Control Over Compliance (Partial repeat of Finding 2024-002) Identification of Federal Program: Assistance Listing (AL) No. 81.086 – Conservation Research and Development Program Criteria / Requirement: 2 CFR 200.303 requires non-federal entities receiving federal awards to establish, document, and maintain effective internal control over federal awards that provides reasonable assurance that the entity is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. In accordance with 2 CFR 200.332, a pass-through entity is required to clearly identify the federal award as a subaward and provide the subrecipient with required federal award information and all applicable requirements imposed by the pass-through entity. The pass-through entity must also evaluate the risk of noncompliance for each subrecipient, monitor the activities of subrecipients to ensure that federal awards are used for authorized purposes and that performance goals are achieved, and take appropriate action when necessary. Condition / Context: Forth passed through $2,260,902 in federal funding to subrecipients under AL No. 81.086. During the audit, we noted that Forth made improvements to its subrecipient monitoring process during fiscal year 2025. Specifically, Forth established and documented a policy addressing subrecipient monitoring, including an administrative review to be completed by subrecipients and a risk assessment process for subrecipients prior to entering into new subaward agreements. We also noted that required federal award information was included in subaward agreements and, when applicable, Forth obtained and reviewed the subrecipient's audit under 2 CFR Subpart F for relevant audit findings. However, the established subrecipient monitoring policy was not consistently followed and was not applied retroactively to previously established subrecipients. Specifically, the risk assessment process was implemented for new subrecipients but was not applied to existing or previously engaged subrecipients. Additionally, Forth did not consistently maintain formal documentation evidencing ongoing monitoring activities, including regular meetings with subrecipients to assess timely completion of tasks and the provision of technical assistance when needed. Further, although a risk assessment was performed for new subrecipients, Forth had not established a systematic process to ensure that the results of the risk assessment were consistently used to determine, document, and execute the appropriate level of monitoring for each subrecipient. As a result, Forth was unable to demonstrate that its established subrecipient monitoring policy was consistently implemented and that monitoring procedures were appropriately applied based on the risk of noncompliance for each federal subrecipient. Cause: Although Forth had established a subrecipient monitoring policy, controls were not sufficient to ensure the policy was consistently implemented and applied to all applicable subrecipients. Management had not established an effective process to ensure that existing subrecipients were incorporated into the risk assessment process or that required monitoring activities and related documentation were consistently completed and retained. Effect: Failure to consistently implement and document the established subrecipient monitoring policy increases the risk that subrecipient noncompliance may not be identified, evaluated, or addressed timely. Incomplete award and monitoring documentation also limits Forth's ability to demonstrate that it exercised appropriate oversight over federal subawards and complied with the requirements of 2 CFR 200.303 and 200.332. Questioned Costs: None. Recommendation: Forth should strengthen its implementation and oversight of its existing subrecipient monitoring policy to ensure that the policy is consistently followed and applied prospectively to all applicable subrecipients. Specifically, Forth should: 1. Apply and document the required risk assessment for all subrecipients, including existing and previously engaged subrecipients, and establish procedures for periodic reassessment as appropriate; 2. Ensure that the results of each risk assessment are documented and used to determine the appropriate nature, timing, and extent of subrecipient monitoring; 3. Maintain complete and accurate documentation of subaward information and ongoing monitoring activities, including meetings, technical assistance, performance reviews, follow-up, and resolution of identified issues; and 4. Establish management review and other internal controls to verify that the subrecipient monitoring policy is consistently implemented, documented, and applied to all applicable federal subrecipients. Management should also perform a review of existing subrecipient files to identify and remediate instances where required risk assessments, monitoring documentation, or other award documentation were not completed in accordance with the established policy. Management’s Response: We agree with the auditor's comments. Forth made progress in FY2025 by establishing a documented subrecipient monitoring policy, a risk assessment process for new subawards, and including required federal award information in subaward agreements. In FY2026, we will extend the risk assessment retroactively to all existing subrecipients, formalize a written process that ties risk assessment results to a defined monitoring plan, implement a standard monitoring log to document ongoing activities, and establish a semi-annual management review to confirm consistent application - with full implementation targeted by December 31, 2026.