Finding Text
Inadequate Subrecipient Monitoring
21.027 Coronavirus State and Local Fiscal Recovery Funds
(Material Weakness in Internal Control over Compliance and on Compliance)
(Section M – Subrecipient Monitoring)
Condition: The Organization expended $383,497 in federal awards to subrecipients under an
annual contract with the subrecipient. The Organization did not adequately monitor the
subrecipients use of the federal awards or comply with other compliance requirements such
as internal risk assessment. Although a summary of funds spent is received, the Organization
does not receive supporting documentation for the subrecipient’s expenses nor is there
indication that the summary of expenses is reviewed by an appropriate member of
management.
Criteria: Per the Uniform Guidance Compliance Supplement, Section M, Subrecipient
Monitoring, the Organization must monitor the activities of the subrecipient as necessary to
ensure that the subaward is used for authorized purposes, complies with the terms and
conditions of the subaward, and achieves performance goals. Because the Organization is
held accountable for federal awards administered to its subrecipients, the Organization should
establish an appropriate subrecipient monitoring process to evaluate the additional monitoring
activities may be necessary to ensure the subrecipients compliance.
Cause: The Organization obtained their first federal funding as a result of the COVID-19
pandemic. The Organization did not have an internal control system in place to meet the
criteria required under the more robust internal control framework provided by the Uniform
Guidance. As a result, even though expenses were “approved” by the Executive Director, no
documentation existed showing such approval.
Effect: The Organization in compliance with the subrecipient monitoring requirement.
Recommendation: A sound system of internal control over compliance with federal award
programs includes the “who, what, when, and how” of controls. In other words, identify the
person with the necessary skills, knowledge, and experience, that performs the specified
control, whether it be preventative or detective in nature. Further, identify how the control is
performed and how often the control is performed.
In order to comply with the Subrecipient Monitoring compliance requirement, the Organization
should designation a person(s) with the appropriate skills, knowledge and experience to:
a. Review subrecipient’s financial and performance reports on a regular basis to ensure
they are accurate, submitted on time, and comply with requirements. This includes
reviewing the detail supporting documentation to support those financial reports. The
review should be documented by initial signature and date of review by the assigned
personnel.
b. Create written policies and procedures for subrecipient monitoring and risk assessment.
The risk assessment should evaluate the subrecipients risk of noncompliance based on
factors such as audits, personnel, and policies.
Management’s Response: See management’s corrective action plan.