Finding 565800 (2023-001)

Opioid STR Grant ALN 93.788 Criteria The Office of Management and Budget issuance of the Code of Federal Regulations (CFR) specifically states uniform administrative requirements, cost principles, and audit requirements for federal awards. CFR 200.303(a) states, “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” A good internal control structure consists of proper segregation of duties where no one person is involved in all aspects of a given transaction. This includes proper segregation of the following functions: authorization of transactions, custody of assets, and recordkeeping. Condition During the course of the audit, we noted improper segregation of duties over cash disbursements and payroll: Cash Disbursements: During the year ended June 30, 2023, the bookkeeper had access to a signature stamp along with full access to the general ledger. During our audit, we noted that there is inconsistently documented approval of nonpayroll expenses. Payroll: During our audit, we noted that there is no documented review and approval of the biweekly payrolls or timesheets. Cause The Organization has made a reasonable effort to design proper controls, but has faced challenges in implementing them effectively, due to growth across multiple locations and frequent turnover. Effect Without proper segregation of duties or proper approval processes over cash disbursements, funds could be misappropriated without detection by management or the Board. A lack of proper segregation over payroll controls such as review and approval of biweekly payrolls and timesheets could result in ghost employees on the Organization’s payroll or overpayment of hours and rates. Questioned Costs None Perspective Information During the audit we gained an understanding of the Organization’s internal controls through inquiry and observation, and by examining one item from each of the three cycles: cash receipts, cash disbursements, and payroll. We also tested a sample of forty (40) non-payroll cash disbursements and identified four (4) with no authorization. The Organization does contract with an outside accounting firm who reviews all transactions and performs reconciliations of the accounting records. Identification as a repeat finding There was no similar finding in the prior year. Recommendation We recommend that the Organization implement policies and procedures, including reviews and reconciliations where necessary, which ensure that no one individual is involved in all aspects of the cash disbursements and payroll processes. The Organization should review these processes and segregate duties as much as considered practical. We recommend that all non-payroll expenses be approved before disbursement and that all time sheets and biweekly payrolls be reviewed and approved by the appropriate supervisor/management. We recommend that control of the signature stamp be moved to a different member of the Carlisle office who does not have edit access to the accounting software, and that it continues to only be used at the approval of the Board Chair. View of Responsible Official Currently, based on the capacity of the Organization’s staffing pool, the most efficient and effective means of review and reconciliation of cash disbursements and payroll is the Organization’s Board Chair and CEO reviewing the cash disbursements and payroll every two weeks, prior to payments being made. The Organization’s bookkeeper forwards the Board Chair and CEO a listing of cash disbursements and payroll due with the suggested payments. The Board Chair and CEO each will ask questions and formally “approve” or “disapprove” each transaction, prior to any payments. Once reviewed, the CEO will contact the bookkeeper with the amounts to pay. Also, the Organization’s outsourced accountant will review and approve each monthly bank reconciliation and bank statement for all Organization accounts, as well as the monthly credit card statements. The outsourced accountant does not have the ability to access the monthly bank statements and make purchases. Going forward, the Organization’s Director of Communications will retain the Board Chair’s check stamp. The Director of Communication will only be allowed to use the Board Chair’s check stamp once the Board Chair and CEO approved payment.