Finding 575 (2021-006)

Finding 2021-006 – Lack of County-Wide Controls Over Major Federal Program - Disaster Grants - Public Assistance (Presidentially Declared Disasters) PASS THROUGH GRANTOR: Oklahoma Department of Emergency Management FEDERAL AGENCY: U.S. Department of Homeland Security ASSISTANCE LISTING: 97.036 FEDERAL PROGRAM NAME: Disaster Grants - Public Assistance (Presidentially Declared Disasters) FEDERAL AWARD NUMBER: DR 4438 and DR 4453 FEDERAL AWARD YEAR: 2020 CONTROL CATEGORY: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Period of Performance, Reporting and Special Tests and Provisions. QUESTIONED COSTS: $-0- Condition: Through the process of gaining an understanding of the County’s internal control structure for federal programs, it was noted that county-wide controls regarding Control Environment, Risk Assessment, Information and Communication, and Monitoring have not been designed. Cause of Condition: Policies and procedures have not been designed and implemented to ensure the County is in compliance with federal award requirements. Effect of Condition: Without an adequate system of county-wide controls, there is greater risk of a breakdown in control activities which could result in noncompliance to federal award requirements. Recommendation: The Oklahoma State Auditor & Inspector’s Office (OSAI) recommends that the County design and implement a system of county-wide procedures to identify and address risks related to compliance with federal award requirements and to ensure that information is communicated effectively. OSAI also recommends that the County design and implement monitoring procedures to assess the quality of performance over time. These procedures should be written policies and procedures and could be included in the County’s policies and procedures handbook. Management Response: Chairman of the Board of County Commissioners: Officials and employees tasked with the responsibility of expending any federal funds will attend training and to better understand the guidelines. Information received will be communicated to the other officials at the quarterly meetings. Criteria: The United States Government Accountability Office’s Standards for Internal Control in the Federal Government (2014 version) aided in guiding our assessments and conclusion. Although this publication (GAO Standards) addresses controls in the federal government, this criterion can be treated as best practices and may be applied as a framework for an internal control system for state, local, and quasigovernmental entities. 2 CFR § 200.303 Internal Controls (a) reads as follows: The non-Federal entity must: (a)Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Also, the GAO Standards – Section 1 – Fundamental Concepts of Internal Control – OV1.01 states in part: Definition of Internal Control Internal control is a process effected by an entity’s oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. Additionally, GAO Standards – Section 2 – Establishing an Effective Internal Control System – OV2.04 states in part: Components, Principles, and Attributes Control Environment - The foundation for an internal control system. It provides the discipline and structure to help an entity achieve its objectives. Risk Assessment - Assesses the risks facing the entity as it seeks to achieve its objectives. This assessment provides the basis for developing appropriate risk responses. Information and Communication - The quality information management and personnel communicate and use to support the internal control system. Monitoring - Activities management establishes and operates to assess the quality of performance over time and promptly resolve the findings of audits and other reviews.