FINDING 2022-004 Subject: Formula Grants for Rural Areas and Tribal Transit Program - Subrecipient Monitoring Federal Agency: Department of Transportation Federal Programs: COVID-19 - Formula Grants for Rural Areas and Tribal Transit Program, Formula Grants for Rural Areas and Tribal Transit Program Assistance Listings Number: 20.509 Federal Award Numbers and Years (or Other Identifying Numbers): EDS#A249-20-G20032, EDS#A249-22-G210088, EDS#A249-22-G210124 Pass-Through Entity: Indiana Department of Transportation Compliance Requirement: Subrecipient Monitoring Audit Findings: Material Weakness, Modified Opinion Condition and Context The County had not properly designed or implemented a system of internal controls, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, material noncompliance related to the Formula Grants for Rural Areas and Tribal Transit Program funds (Transit program) passed through to a subrecipient. The County received and passed through to a subrecipient $664,071 in Transit program funds. The County is to clearly identify the award and applicable requirements to the subrecipient, evaluate the risk of noncompliance related to the subrecipient to determine appropriate monitoring of the subaward, and monitor the activities of the subrecipient to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. As part of managing the award, the County is to evaluate the subrecipients risk of noncompliance to determine the extent of monitoring. Such factors to consider would include the subrecipients prior experience with the award or similar awards, results of previous audits, any personnel or system changes at the subrecipient, and the extent and results of federal reviews. Based on the results of the County's risk of noncompliance evaluation, the extent of monitoring can be determined. Monitoring activities include, but are not limited to, reviewing financial and performance reports, ensuring audits are obtained as required, follow-up to ensure appropriate action was taken on deficiencies identified during an audit, issuing management decisions for applicable findings related to the federal award, and ensuring audit findings related to the subaward are resolved. The County did not have any policies or procedures in place to evaluate the subrecipient's risk of noncompliance or to monitor the activity of the subrecipient. Per inquiry of the County, it was determined an evaluation of the risk of noncompliance for the subrecipient was not completed, nor did the subrecipient's files support any such evaluation. In addition, while the subrecipient provided reimbursement requests, the requests did not include sufficient evidence for the County to ascertain if the subrecipient was complying with the grant requirements. The County also did not request or review the subrecipient's audit or monitoring reports to identify any potential noncompliance, determine if management decisions were needed, or if any issues identified were properly resolved. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.332 Requirements for pass-through entities. (Revised Uniform Guidance) states in part: "All pass-through entities must: . . . (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in ? 200.208. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit Findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving cross-cutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Cause A proper system of internal controls was not designed by management of the County. Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the County's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. As a result, the County did not properly evaluate the subrecipients risk of noncompliance or adequately monitor the subrecipient. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the County. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the County implement a proper system of internal controls, including segregation of duties, to evaluate the subrecipients risk of noncompliance and adequately monitor the subrecipient. Additionally, policies and procedures should be implemented to ensure appropriate reviews, approvals, and oversight are taking place, as needed, to evaluate and monitor its subrecipient. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.