Finding 49755 (2022-003)

2022-003 Matching Federal Agency: U.S. Department of Housing and Urban Development Program: Continuum of Care Program (ALN 14.267) Federal Assistance Identification Number or Pass-Through Numbers: MN0311L5K002007, MN0364L5K002005, MN0372L5K002105 Federal Award Years: Year ended December 31, 2022; Year ended December 31, 2022; Year ended October 31, 2023 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: 2 CFR 200.303(a), requires that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 24 CFR 578.73(a) requires that the recipient must match all grant funds, except for leasing funds, with no less than 25 percent of funds or in-kind contributions from other sources. For grantees where there is more than one grant agreement, the 25 percent match must be provided on a grant-by-grant basis. Cash match must be used for the costs of activities that are eligible as program costs under 24 CFR 578 Subpart D. 2 CFR 200.306(b)(1) requires that any shared costs or matching funds must be verifiable from the non-Federal entity's records. Condition: While testing the matching requirement, we noted that internal controls are not properly designed. While the County was able to provide documentation that the matching requirement was met, we noted the following: ? The documentation to demonstrate that the required match was met was on a calendar-year basis for all grants in total instead of on the required grant-by-grant basis. ? The data utilized in determining the match requirement was met was obtained from the State?s information system, MAXIS, and the County did not retain this data. ? Reporting of the match on the HUD Annual Performance Report is completed by multiplying the total direct costs by the required match percentage instead of the actual match. ? There was a lack of evidence that a supervisory review was periodically performed over matching. In addition, while we were able to test a manual compensating control over matching, we were not able to review and test the automated application controls and related ITGCs within the MAXIS system. The State was not able to provide information regarding the design and implementation of MAXIS system controls, nor were we able to test those controls directly. Cause: Historically the County has believed that the ability to demonstrate the match requirement was met was sufficient. There are no written policies and procedures over the review of the matching requirement. In addition, the State was not able to provide information regarding the design and implementation of MAXIS system controls nor were we able to review and test the MAXIS system due to complexities of data privacy and resources within the State. Effect: Without written policies and procedures over the review of the matching requirement and without documentation of the review, there is an increased risk of noncompliance with the matching requirement. Context: We reviewed the matching requirements for all awards for this ALN that required a match during the year. Questioned Costs: None Repeat Finding?: No Recommendation: We recommend that controls be established to include determination of the match on a on a grant-by-grant basis more often than annually, that documentation of this determination is retained in the County?s records, and that a review is performed and documented. In addition, we suggest that the County encourage the State to provide an independent audit of the design and implementation of MAXIS system controls. View of responsible officials of the auditee: Hennepin County has reviewed and agrees with the finding and recommendation.