2022-002 Internal Control and Compliance Finding Related to Proper Review and Approval of Internal Purchase Orders, Invoices, and Purchase Requisitions a. Condition Our review of compliance and internal controls testing in accordance with OMB 2022 Compliance Supplement for Part A. Activities Allowed or Unallowed; Part B. Allowable Cost/Cost Principles; and Part H. Period of Performance identified an internal control deficiency relating to the review and approval of internal purchase orders, non-subcontract invoices, and purchase requisitions. Inter-organizational transfer (IOT) costs are recorded to account number 5-4-080 ? IOT from LLC?s. We performed transaction testing for claimed IOT costs under auditable contracts. We judgmentally selected twenty-two IOT transactions amounting to $19,851,674 or 85 percent of the FY 2022 IOT auditable universe. Direct Material costs are recorded to account number 5-3-000 ? Non-Inventory Direct Materials. We performed transaction testing for claimed direct material costs under auditable contracts. We tested thirty-two direct material transactions amounting to $872,022 or 47 percent of the FY 2022 direct material auditable universe. During our examination of the selected IOT costs, we examined invoices and invoice approval eForms to ensure the auditee complied with internal controls related to invoice approval and to ensure subcontract monitoring procedures were performed. The selected IOT transactions were incurred under two internal purchase orders (IPOs). Eleven invoice approval eForms are applicable to one IPO. For five of the eleven invoice approval eForms, we noted the invoice was appropriately approved by the SRC program manager and financial analyst. For the other six invoice approvals eForms, no indication of review or approval by the SRC program manager was identified; instead, the eForms were approved by the program manager of the performing company (related entity). Additionally, during our examination of the selected IOT costs, we evaluated the IPO award eForms for the two selected IPOs to ensure the auditee complied with internal controls related to IPO approval. We identified for both IPOs, the IPO award eForms, for the base and all change orders, were approved by the related entity?s program manager instead of a SRC program manager. The SRC program manager is required to be involved in the monitoring, reviewing, and approving IOT costs claimed at the prime contract level. Having the related entity program manager reviewing and approving their own invoices, is a clear lack of segregation of duties. During our examination of the selected direct material costs and period of performance testing, we requested and reviewed the purchase requisition (PR) eForms to ensure the auditee complied with internal controls related to PR approval. Three transactions that were incurred under contract FC003.07 had the PR approved by the related entity program manager, instead of the SRC program manager. The auditee stated the individual was given verbal delegation to approve on behalf of FC003 in the FY. SRC is allowing a program manager from a related entity to approve SRC purchase requisitions; which further supports that there is a clear lack of segregation of duties. This noncompliance pertains to all Federal Contracts under SRC's R&D cluster. b. Criteria: OMB 2022 Compliance Supplement, dated April 2022, for the requirements of Part A. Activities Allowed and Unallowed and Part B. Allowable Costs/Cost Principles, requires us to plan and perform tests of internal control including control activities, which requires policies and procedures to achieve objectives and respond to risks in the internal control system which includes the entity?s information system. We performed testing to determine if: There is adequate segregation of duties established between entering/authorizing information, reviewing/approving the information, and for maintaining records supporting the information. Reports and communications include relevant, accurate, and complete information that is provided to appropriate individuals on a timely basis. Ongoing or recurring practices are demonstrated that monitor activities or results, and should be evidenced by adequate documentation of the monitoring activity, the results of the monitoring, and timely communication of any actions required due to observed deficiencies or deviations. Procedures are in place to ensure that monitoring is routinely performed. Appropriate levels of management review supporting documentation to ensure accuracy of the reported or billed allowable cost. FAR 42.202(e)(2) requires that: "The prime contractor is responsible for managing its subcontracts." This includes but is not limited to performing activities similar to that done by a Government contracting officer?s representative (i.e., the billings from the subcontractor are consistent with the scope work performed, an analysis of the allowability of the costs on the subcontract billing, subcontractor billing rates are updated timely to reflect year-end actual allowable rates, resolving any subcontractor overpayments timely). We examined SRC?s CORP-P-100, Approval and Signature Authority policy, dated June 22, 2021, and SRC CORP-D-100, Signature Authority Matrix Revisions with effective dates of June 30, 2021; January 20, 2022; and June 30, 2022 which state and include in part: The procedure defines signature authority as identified in our Signature Authority Matrix. A sound internal control environment requires that only officers of the Company and their designees approve financial and contractual transactions for the company. The Signatory Authority Matrix included in CORP-D-100 for Forms indicates that for non-subcontract invoice eForms, approval by the program manager and review by the financial analyst is required. We additionally examined SRC's ACC-P-301, Subcontractor and IPO Accounts Payable Process, dated August 14, 2020, which includes a flowchart in line with CORP-D-100 requirements requiring approval by the program manager and financial analyst. The Signatory Authority Matrix included in CORP-D-100 for Forms indicates that for IPO award eForms, approval by the supervisor, program manager, financial analyst, contracts/subcontracts/purchasing manager, and materials program manager (if material) is required. We additionally examined SRC's SPP 10.1, Internal Purchase Orders, dated January 5, 2021 and June 17, 2022, which state and include in part: Once complete, the requestor shall route the IPO award eForm to the performing company's Contract Administrator... If determined to be correct and current, the Contracts Administrator shall route IPO award eForms containing Material to the Manufacturing Program Manager (MPM) group and service only IPOs directly to the Center Approver. For Material IPOs, the MPMs will review and confirm the information related to the Material and shipping, then route the eForm the Center Approver. The Center Approver shall review the eForm, approve, and route to the FA. The FA shall review and confirm the Accounting Information is correct, approve, and route to Subcontracts. The Signatory Authority Matrix included in CORP-D-100 for Forms indicates that for PR eForms, approval by the program manager and financial analyst is required. We additionally examined SRC?s PUR-P-100, Purchase Requisition Process, dated May 15, 2020 and June 24, 2022, which states and includes in part: The Center Approver reviews the requisition, approves, and routes to the Financial Analyst (FA)... The FA reviews the requisition for completeness... validates the project, account, and organization numbers [then] reviews the REQ for approvals per the Signature Authority and approves Requisition and forwards to Purchasing. c. Recommendation The auditee should comply with its formal policies and procedures and ensure the appropriate personnel are reviewing and approving the IPO invoice approval eForms, the IPO award eForms, and the PR eForms related to direct material. d. Contractor Response SRC concurs to our findings. SRC?s complete response is included in the Corrective Action Plan for Current Year Findings in Appendix 3.