Finding Text
FINDING 2024-003
Subject: Child Nutrition Cluster - Internal Controls
Federal Agency: Department of Agriculture
Federal Programs: School Breakfast Program, National School Lunch
Program, Special Milk Program for Children
Assistance Listings Numbers: 10.553, 10.555, 10.556
Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024
Pass-Through Entity: Indiana Department of Education
Compliance Requirements: Reporting, Special Tests and Provisions -
Nonprofit School Food Service Accounts
Audit Finding: Material Weakness
Condition and Context
Internal control is generally defined as a process affected by an entity's oversight body, management,
and other personnel that provides reasonable assurance that the objectives of an entity will be
achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required
to establish and maintain internal control over federal awards that provides reasonable assurance that the
nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms
and conditions of the federal awards.
Internal control is not one event or circumstance, but a dynamic and continual process. The
process is based on fundamental principles that operate as a whole. The fundamental principles are related
to five components of internal control which are as follows: Control Environment, Risk Assessment, Control
Activities, Information and Communication, and Monitoring. If a component is not effective, or the components
are not operating together in an integrated manner, then an internal control system cannot be effective.
Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities
components.
INDIANA STATE BOARD OF ACCOUNTS
20
CANNELTON CITY SCHOOL CORPORATION
SCHEDULE OF FINDINGS AND QUESTIONED COSTS
(Continued)
Risk Assessment - Reporting and Special Tests and Provisions -
Nonprofit School Food Service Accounts
The School Corporation has not established a formal risk assessment process. There is no
documented risk assessment policy, nor is there evidence of periodic risk identification,
analysis, or evaluation.
Monitoring - Reporting and Special Tests and Provisions -
Nonprofit School Food Service Accounts
The School Corporation did not conduct ongoing or periodic reviews to ensure that internal
controls were operating as intended and to identify areas for improvement. Furthermore, the
School Corporation did not have a process to follow up on corrective actions written as a
response to audit findings.
Control Activities - Reporting
The School Corporation's Food Service Director was solely responsible for submitting the
Monthly Sponsor Claims for reimbursement. There was no evidence of an oversight, review,
or approval process to ensure the accuracy and completeness of the reports prior to submission.
Control Activities - Special Tests and Provisions - Nonprofit School Food Service Accounts
The Treasurer was solely responsible for posting all revenues and expenditures of the nonprofit
school food service program into the School Corporation's accounting software. There was no
evidence of an oversight, review, or approval process to ensure that only activity of the nonprofit
school food service program was posted to the food service account or to ensure that all
reimbursements were correctly credited to the nonprofit school food service account.
The lack of internal controls was a systemic issue throughout the audit period.
Criteria
2 CFR 200.303 states in part:
"The non-Federal entity must:
(a) Establish and maintain effective internal control over the Federal award that provides
reasonable assurance that the non-Federal entity is managing the Federal award in
compliance with Federal statutes, regulations, and the terms and conditions of the Federal
award. These internal controls should be in compliance with guidance in 'Standards for
Internal Control in the Federal Government' issued by the Comptroller General of the
United States or the 'Internal Control Integrated Framework', issued by the Committee of
Sponsoring Organizations of the Treadway Commission (COSO). . . ."
Cause
Due to the small size of the School Corporation, there was often only one individual involved with
various aspects of the federal program with limited opportunity for proper segregation of duties. Additionally,
management has not taken steps to design and implement policies and procedures to assess risks
facing the School Corporation or to establish and operate monitoring activities that monitor the internal
control system.
INDIANA STATE BOARD OF ACCOUNTS
21
CANNELTON CITY SCHOOL CORPORATION
SCHEDULE OF FINDINGS AND QUESTIONED COSTS
(Continued)
Effect
As a result of the five components of internal control not being adequately designed and implemented,
the internal control system cannot be effective. Thus, general risks or specific risks from fraud and
significant changes could negatively impact the School Corporation, identified internal control deficiencies
could continue, and unidentified flaws within the internal control system could exist. Finally, reimbursement
requests could be inaccurate when submitted and the activity of the school food service account could be
incorrectly recorded leading to incorrect requests for reimbursement or other errors in reporting or
management of the food service account.
Questioned Costs
There were no questioned costs identified.
Recommendation
We recommended that the School Corporation's management establish a proper system of internal
controls, which would include policies and procedures related to risk assessment and monitoring.
Additionally, we recommended that the School Corporation's management establish a proper system of
internal controls to ensure that reports for reimbursement are complete and accurate, and the activity of the
school food service account is properly recorded.
Views of Responsible Officials
For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.