Finding Text
Finding 2022-003 Identification of the federal program: R&D Cluster Federal Agency: U.S. Department of Health and Human Services Assistance Listing: 93.399 Award numbers: 5UG1CA189830-08, 5UG1CA189830-09 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? MH?s Federal Awards ? Subrecipients Monitoring policy includes the following: 5.1.3 Low risk subrecipients will be audited on-site every other year. Medium risk subrecipients will be audited on-site annually. High risk subrecipients will be audited on-site biannually. 6.1.1 Review performance reports in a timely manner by the Principal Investigator. Report any unusual or unforeseen items, investigate and document those findings, and retain records for officials and sponsors. Condition: Management was not following its subrecipient monitoring policy. Management did not perform the appropriate monitoring based on the subrecipient risk rating. In addition, during the year ended September 30, 2022, Management did not have effective internal controls in place to review and approve the subrecipient monitoring forms timely until the third quarter of fiscal 2022. Cause: MH?s internal controls over subrecipient monitoring are not robust enough to identify whether the appropriate level of monitoring is occurring. In addition, the revised subrecipient monitoring policy requiring sign-off by the reviewer on the quarterly subrecipient monitoring checklist was not implemented until the third quarter of fiscal 2022. Effect or potential effect: Subrecipient monitoring was not performed sufficiently or timely. Issues identified during the subrecipient monitoring might not be addressed timely. Questioned costs: Not applicable Context: Based on the timing of the prior year corrective action plan, Management did not have internal controls over the timely review of subrecipients for the first six months of fiscal 2022. We tested four subrecipients and identified one medium risk subrecipient ($764,435), which required an annual on-site visit. Per our inspection of the subrecipient monitoring form, there was no on-site visit conducted during fiscal 2022 for this subrecipient. The total R&D Cluster expenditures reported on the SEFA are $3,578,529 for the year ended September 30, 2022. Subrecipient costs total $1,911,935, which represent 53.4% of total R&D Cluster expenditures. Identification as a repeat finding: Repeat of finding 2021-003 Recommendation: We recommend that Management continue to perform the quarterly review of the subrecipient monitoring forms implemented in the third quarter of fiscal 2022 to monitor subrecipients and ensure they are following their monitoring policy requirements. Views of responsible officials: Management agrees with the finding. Management will review its policy and ensure it fully complies for its fiscal year 2023.