Finding 554490 (2021-011)

Finding 2021-011 – Lack of County-Wide Controls Over Major Federal Program – Coronavirus Relief Fund PASS-THROUGH GRANTOR: Oklahoma Department of Emergency Management; Oklahoma Office of Management and Enterprise Services FEDERAL AGENCY: U.S. Department of Treasury ASSISTANCE LISTING: 21.019 FEDERAL PROGRAM NAME: Coronavirus Relief Fund FEDERAL AWARD NUMBER: Oklahoma CARES PPE – Reimbursement 2020; 4530-DR-OK; SA- 2242 FEDERAL AWARD YEAR: 2020 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Costs Principles; and Period of Performance QUESTIONED COSTS: - $0 - Condition: Through the process of gaining an understanding of the County’s internal control structure for federal programs, it was noted that county-wide internal controls regarding Control Environment, Risk Assessment, Information and Communication, and Monitoring have not been designed. The following deficiencies were noted: • The BOCC is aware there are compliance supplement requirements; however, they are not aware of the specifics of the requirements. There is no evidence the BOCC looked over submissions to ensure they were in compliance with federal guidance prior to submission to the awarding agency. • The County did start keeping a reconciliation of federal expenditures; however, it was not accurate with the expenditures submitted, and the County did not continue to update to include the Sheriff Office payroll. Additionally, there is no evidence of a BOCC review. • The risks of incorrect financial reporting, resulting from fraud or error for the SEFA are not addressed verbally or in written communication. • The County is relying on the Clerk and Treasurer to ensure the accuracy of the SEFA. Cause of Condition: Policies and procedures have not been designed and implemented to ensure the County complies with grant requirements. Effect of Condition: Without an adequate system of county-wide controls, there is greater risk of a breakdown in control activities which could result in unrecorded transactions, undetected errors, misappropriation of funds, and noncompliance with federal grant requirements. Recommendation: OSAI recommends that the County implement a system of internal controls to ensure compliance with grant requirements. Management Response: District 1 County Commissioner: Not by way of excuse, but truly in response, the Federal programs associated with the COVID response were unnecessarily arduous and created confusion at all levels of government. While the monetary response was accepted, the premise of these programs was nothing more than an administrative shell game. From the outset of the response, guidance was termed as “interim”, then “final interim” and finally, “final” (redundancy intentional). The intent of our national level leadership became more apparent as these programs progressed with each iteration of programming being reliant on returned funds from the previous. Without grandstanding, I will simply say that no entity, regardless of their planning with these programs, will be found as fully compliant. As these programs have a sunset in the near term, I suspect these findings will disappear. District 2 County Commissioner: I was not in office the year audited, but I will work with the other elected officials to implement a system of internal controls to ensure compliance with grant requirements. District 3 County Commissioner: I will work with the other elected officials creating internal controls to ensure compliance with grant requirements. Criteria: The GAO Standards – Section 1 – Fundamental Concepts of Internal Control – OV1.01 states in part: Definition of Internal Control Internal control is a process effected by an entity’s oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. Additionally, GAO Standards – Section 2 – Establishing an Effective Internal Control System – OV2.04 states in part: Components, Principles, and Attributes Control Environment - The foundation for an internal control system. It provides the discipline and structure to help an entity achieve its objectives. Risk Assessment - Assesses the risks facing the entity as it seeks to achieve its objectives. This assessment provides the basis for developing appropriate risk responses. Information and Communication - The quality information management and personnel communicate and use to support the internal control system. Monitoring - Activities management establishes and operates to assess the quality of performance over time and promptly resolve the findings of audits and other reviews. Furthermore, 2 CFR § 200.303 Internal Controls (a) reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).