Finding Text
Finding 2024-002 – Procurement, Suspension, and Debarment
Identification of the federal program:
Federal Grantor: United States Department of Health and Human Services
Assistance Listing No.: 93.493, Congressional Directives
Federal Award Number: 1 CE1HS52357‐01‐00
Federal Award Period of Performance: 09/30/2023–09/29/2026
Criteria or specific requirement (including statutory, regulatory, or other citation):
Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).”
Condition:
Procurement policies required by 2 CFR 200.318-326 were not formally documented.
Documentation was not consistently retained evidencing the review and approval of new vendors for suspension and debarment prior to adding them into PeopleSoft, CFNI’s vendor management platform.
Management represented that they performed a monthly reconciliation of the number of vendors screened and the number of vendors submitted to the third-party, however, management did not retain evidence of the reviews in fiscal year 2024.
CFNI’s third-party contractor for suspension and debarment does not have a SOC 1 (System and Organization Controls Report) report that covers the controls over suspension and debarment services provided. Management did not perform testing over the results of the third-party contractor to assess the accuracy of its procedures.
Effect or potential effect:
Suspension and debarment results provided by the third-party contractor may not be accurate. As a result, federal funds may be used to pay a contractor that is suspended or debarred.
Questioned costs:
None.
Context:
For three of 40 new vendors sampled during the fiscal year, the documentation evidencing the review of new vendors for suspension and debarment was not retained.
For Assistance Listing No. 93.493, the federal portion of procurement expenditures subject to suspension and debarment review totaled $1,441,622, which represents approximately 61.5% of total federal expenditures of $2,341,797 reported in the SEFA for the year ended June 30, 2024.
Identification as a repeat finding, if applicable:
This is not a repeat finding from the prior year.
Recommendation:
CFNI should revise its procurement policies to be in compliance with 2 CFR 200.318-326.
CFNI should implement procedures to reperform the testing for a sample of vendors from the third-party suspension and debarment results to ensure the accuracy of the results received.
CFNI should formalize the documentation of the reconciliation of the number of vendors screened and the number of vendors submitted to the third-party.
CFNI should update its policies and procedures over the new vendor setup process to require supporting documentation related to the suspension and debarment search performed be maintained.
Views of responsible officials: The audit identified three instances out of 40 sampled where CFNI did not retain documentation verifying that suspension and debarment reviews were conducted during the onboarding of new suppliers. Although CFNI has an established vetting process, it recognizes the need for consistent documentation to evidence compliance. CFNI will implement formalized procedures to ensure all suspension and debarment reviews are documented and retained for audit purposes.
CFNI engages a third-party contractor to monitor its supplier list against suspension and debarment databases. While the vendor provided a SOC 1 report, it did not specifically cover the suspension and debarment services provided. Additionally, CFNI did not conduct testing to validate the accuracy of the third-party's results. CFNI will revise its vendor management practices to ensure the SOC 1 reports cover the relevant services, and it will establish testing procedures to confirm the reliability of the vendor's outputs.
Although CFNI utilizes two processes to monitor active suppliers against suspension and debarment lists, no reconciliation was documented to confirm that the supplier lists provided to and received from the third party were complete and accurate. Additionally, no testing was conducted to validate the third party’s work. CFNI will implement a reconciliation process to verify the completeness and accuracy of supplier lists before and after third-party reviews. Furthermore, it will establish a sampling and testing procedure to validate the results provided by external vendors.