Finding Text
Criteria: A properly designed and effective system of internal control includes components of internal control at the overall entity level of an organization. These entity-level controls include the control environment, risk assessment, information and communication controls and monitoring controls. It is crucial that entity-level internal control components be designed properly and be operating effectively in order for the entire system of internal control, including activity-level internal control components, to properly prevent and detect financial reporting errors, including material weaknesses and significant deficiencies. Condition: Arizona Immigrant and Refugee Services, Inc. (‘AIRS”) has not properly designed an adequate internal control environment, does not appear to be conducting internal risk assessment, has inadequate board and senior management monitoring controls and does not appear to have appropriate communication with those charged with governance. During the year ended September 30, 2022, the Organization did not hold regular board meetings or have minutes or other documentation of formal communication with board members during the year ended September 30, 2022. The Organization also appears to lack written policies and procedures related to certain significant aspects of financial reporting, and does not appear to have a written purchasing or procurement manual. The Organization is also not periodically preparing comparative financial statements (budget to actual or prior period actual to current period actual) that are subject to review and approval by senior management or the board. Cause: AIRS has not properly designed or implemented adequate entity-level internal controls related to control environment risk assessment, information and communication with those charged with governance, or monitoring activities of those charged with governance or with senior management. In large part this is due to the fact that AIRS did not hold any board meetings during the year ended September 30, 2022. Effect: Since AIRS did not hold regular board meetings or have minutes or other documentation of formal communication with board members, and did not provide the board with periodic comparative financial statements, the board was unable to properly exercise its required fiduciary responsibilities or to provide for adequate risk assessment, and created a lack of sufficient monitoring and oversight of financial reporting, budgeting or the operations of AIRS. In addition, due to this condition, formal documented communication between senior management and board, in the form of board meeting minutes, are non-existent. AIRS management also does not appear to have created other written communications that are key to the operation of the Organization, such as a written procurement/purchasing manual or written accounting policies for certain significant aspects of the financial reporting system. Questioned Costs: None reported Repeat Finding from Prior Year: Yes Recommendation: In response to finding 2021-001 during the audit for the year ended September 30, 2021, AIRS created a schedule of board meetings for the year ended September 30, 2024. During the year ended September 30, 2024, the AIRS board did hold a meeting in January 2024, but due to extenuating circumstances AIRS board did not meet during the second or third quarter of 2024. Operational information and comparative financial information was provided to board members at the January 2024 meeting. I would strongly recommend that the boars schedule and hold regular meetings on a go-forward basis. In addition, during the year ended September 30, 2024, AIRS began the process of creating and revising its policies and procedures manual. I commend the Organization for its efforts to comply with finding 2021-001. However, during the years ended September 30, 2022 and September 30, 2023, the conditions originally noted in finding 2021-001 still existed. Views of Responsible Officials: Management concurs with this audit finding.