Finding 520210 (2023-007)

FINDING 2023-007: LACK OF INTERNAL CONTROLS OVER COMPLIANCE (MATERIAL WEAKNESS) Condition The organization lacks sufficient internal controls to ensure compliance with applicable laws, regulations, and policies. Specifically, there are no formalized procedures for monitoring compliance activities, insufficient oversight mechanisms, and inadequate documentation of compliance-related actions. Criteria Government auditing standards require that organizations establish and maintain effective internal controls to ensure compliance with laws, regulations, and policies. Standards such as those outlined in the Federal Internal Control Standards (Green Book) emphasize the need for control activities, monitoring, and documentation to ensure compliance. Cause Although the organization has prepared a Finance and Administrative Policies and Procedures Manual (Effective July 1, 2023), that documents certain internal processes, the organization has not prioritized the development and implementation of a comprehensive compliance management framework for internal controls over compliance. Limited resources, competing priorities and lack of understanding of COSO and Green Book standards have contributed to the absence of adequate internal controls. Effect The lack of internal controls over compliance increases the risk of noncompliance with laws, regulations, and policies. This could result in financial penalties, reputational damage, and loss of funding. Recommendation The organization should design and implement a robust internal control framework for compliance that includes the following: 1. Establishing written policies and procedures for compliance activities. 2. Assigning responsibility for compliance monitoring to a designated individual or team. 3. Implementing regular compliance reviews. 4. Providing training to staff on compliance-related responsibilities. 5. Documenting and maintaining records of compliance activities. Management Response Management concurs with this finding and plans to remediate the finding described above as further explained in the corrective action plan.