FINDING 2024-008
Subject: COVID-19 - Education Stabilization Fund - Reporting
Federal Agency: Department of Education
Federal Program: COVID-19 - Education Stabilization Fund
Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W
Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013,
S425U210013, S425W210015
Pass-Through Entity: Indiana Department of Education
Compliance Requirement: Reporting
Audit Findings: Material Weakness, Modified Opinion
This is a repeat finding from the immediately prior audit report. The prior audit finding number was
2022-004.
Condition and Context
Internal control is generally defined as a process affected by an entity's oversight body, management,
and other personnel that provides reasonable assurance that the objectives of an entity will be
achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required
to establish and maintain internal control over federal awards that provides reasonable assurance that the
nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms
and conditions of the federal awards.
Internal control is not one event or circumstance, but a dynamic and iterative process. The internal
control process is based on fundamental principles that operate as a whole but are best understood when
analyzed individually. The fundamental principles are related to five components of internal control which
are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication,
and Monitoring. If a component is not effective, or the components are not operating together in an
integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were
identified in the risk assessment, monitoring, and control activities components.
Risk Assessment
The School Corporation has not established a formal risk assessment process. There is no
documented risk assessment policy, nor is there evidence of periodic risk identification,
analysis, or evaluation.
INDIANA STATE BOARD OF ACCOUNTS
33
CANNELTON CITY SCHOOL CORPORATION
SCHEDULE OF FINDINGS AND QUESTIONED COSTS
(Continued)
Monitoring
The School Corporation did not conduct ongoing or periodic reviews to ensure that internal
controls were operating as intended and to identify areas for improvement. Furthermore, the
School Corporation did not have a process to follow up on corrective actions written as a
response to audit findings.
Control Activities
The School Corporation was required to submit annual data reports to the Indiana Department
of Education via JotForm, a form/report builder. Data to be submitted included, but was not
limited to, current period expenditures, prior period expenditures, and key line items such as
"Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds
. . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions."
As part of sound management of the federal award, the School Corporation was responsible for
implementing a system of internal controls that would ensure compliance with the applicable requirements.
The School Corporation had not properly designed or implemented such a system, which would include
appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting,
noncompliance.
During the audit period, the School Corporation submitted one ESSER I report, two ESSER II
reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no
evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission.
All six reports were selected for testing. Four of the reports were not supported by the School
Corporation's records, and their accuracy and completeness could not be verified. The following errors
were identified:
The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to
June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not
able to be traced to supporting documentation. For both reports, the supplies line item
could not be traced to the School Corporation's records. For ESSER II, Year 3, the School
Corporation reported Other Purchased Services, but the School Corporation's supporting
documentation did not include any items that would be classified as such.
The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022,
Key Line Items were not able to be traced to supporting documentation. The School
Corporation reported the purchase of Chromebooks as Purchased Property Services,
which was not the appropriate classification for the expenditure.
The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023,
Key Line Items were not able to be traced to supporting documentation. The School
Corporation reported amounts related to Purchased Property Services and Personnel
Services - Salaries that were not supported by the School Corporation's records.
The lack of internal controls and noncompliance were systemic issues throughout the audit period.
INDIANA STATE BOARD OF ACCOUNTS
34
CANNELTON CITY SCHOOL CORPORATION
SCHEDULE OF FINDINGS AND QUESTIONED COSTS
(Continued)
Criteria
2 CFR 200.303 states in part:
"The non-Federal entity must:
(a) Establish and maintain effective internal control over the Federal award that provides
reasonable assurance that the non-Federal entity is managing the Federal award in
compliance with Federal statutes, regulations, and the terms and conditions of the Federal
award. These internal controls should be in compliance with guidance in 'Standards for
Internal Control in the Federal Government' issued by the Comptroller General of the
United States or the 'Internal Control Integrated Framework', issued by the Committee of
Sponsoring Organizations of the Treadway Commission (COSO). . . ."
2 CFR 200.302(b) states in part:
"The financial management system of each non-Federal entity must provide for the following
. . .
(2) Accurate, current, and complete disclosure of the financial results of each Federal
award or program in accordance with the reporting requirements set forth in §§ 200.328
and 200.329. . . ."
34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format
that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other
responsibilities under the program. . . ."
34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with
program requirements."
Cause
Management of the School Corporation had not taken steps to design and implement policies and
procedures to assess risks facing the School Corporation or to establish and operate monitoring activities
that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective
action plan submitted in response to the same finding included in the prior audit and did not take further
steps to ensure compliance.
Effect
As a result of the five components of internal control not being adequately designed and
implemented, the internal control system cannot be effective. Thus, general risks or specific risks from
fraud and significant changes could negatively impact the School Corporation, identified internal control
deficiencies could continue, and unidentified flaws within the internal control system could exist.
Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER
II and ESSER III reports that were not supported by the School Corporation's records. As a result, material
noncompliance occurred and remained undetected.
Questioned Costs
There were no questioned costs identified.
INDIANA STATE BOARD OF ACCOUNTS
35
CANNELTON CITY SCHOOL CORPORATION
SCHEDULE OF FINDINGS AND QUESTIONED COSTS
(Continued)
Recommendation
We recommended that the School Corporation's management establish a proper system of internal
controls, which would include policies and procedures related to risk assessment and monitoring.
Additionally, we recommended that the School Corporation's management establish a proper system of
internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate.
Views of Responsible Officials
For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.