Finding Text
Finding 2023-004 – Subrecipient MonitoringInformation of the federal program:Federal Grantor: United States Department of Health and Human ServicesPass-Through Grantor: City of ChicagoAssistance Listing No.: 93.391, Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare CrisisCriteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation):Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).”Section 200.332 of the Uniform Guidance states that all pass-through entities must:“(b) Evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as:(1) The subrecipient’s prior experience with the same or similar subawards,(2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program,(3) Whether the subrecipient has new personnel or new or substantially changed systems, and(4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency).”Section 200.332 of the Uniform Guidance further states that all pass-through entities must:“(g) Consider whether the results of the subrecipient’s audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records.”Condition:Although subrecipient monitoring procedures were performed during the fiscal year, management did not perform and document a risk assessment upon entering into subaward agreements with its subrecipients in order to determine the extent of monitoring procedures that should be performed to be responsive to the assessed risk. In addition, management did not obtain the Uniform Guidance audit report from its subrecipients.Cause:Management did not have internal controls in place that required completion of the documentation evidencing review of the risk assessment of the subrecipients at the beginning of the award and monitoring of the Uniform Guidance audit reports of the subrecipients. The documentation was not completed as management considered the subrecipients vendors.Questioned costs:None.Context:Endeavor’s total federal expenditures passed through to subrecipients that required a risk assessment of Uniform Guidance audit report reported in the Schedule were $885,840, representing 70.20% of total STLT expenditures of $1,261,948 for the year ended December 31, 2023.Effect or potential effect:Monitoring performed over a subrecipient may not be responsive to the risk for that subrecipient. A subrecipient’s Uniform Guidance audit report could contain findings that are not properly reviewed and evaluated.Identification as a repeat finding, if applicable:The finding is not a repeat finding.Recommendation:Management should establish written internal controls and procedures related to subrecipient risk assessments in accordance with Uniform Guidance Section 200.33 2(b). In addition, Endeavor should modify the subrecipient Uniform Guidance audit report review process to include a section for Endeavor to document its review of and conclusions reached over the subrecipient’s Uniform Guidance audit report.Views of Responsible Officials:Management will establish written internal procedures related to sub-recipient risk assessments in accordance with the Uniform Guidance Section 200.33 2(b). Management will leverage its key resources at the system level to improve the process for R&D sub-recipients assessment and monitoring. In addition, management will consult with legal, finance, and compliance teams to evaluate and correct, if necessary, current review processes and documentation of review results moving forward.