Finding 636126 (2022-001)

Material Weakness, Compliance and Internal Control over Compliance, Subrecipient Monitoring ALN 21.027: Coronavirus State and Local Fiscal Recovery Funds Federal Agency: U.S. Department of the Treasury Criteria Or Specific Requirement: Per 2 CFR 200.332, Mesa County is responsible for informing subrecipients of the Federal award identifiers including but not limited to award date, period of performance and Federal awarding agency and Assistance Listing Number and title. Mesa County is required to assess the subrecipient?s risk of noncompliance with Federal statutes, regulations and the terms and conditions of the subaward. In addition, the County should also verify that the subrecipient is audited as required by Subpart F- Audit Requirement under the Uniform Guidance. The monitoring policy should include an initial valuation of risk of noncompliance to determine the appropriate level of monitoring required related to the subaward as well as appropriate awarding documentation. Condition: We noted that management did not evaluate the risk of noncompliance of the subrecipient and did not convey expectation of requirements for audit under Federal Regulations. Effect: The County was not in compliance with the subrecipient monitoring regulations set forth in the Uniform Guidance. The possibility exists that noncompliance with federal requirements could go undetected without proper controls over compliance relating to the aforementioned requirements. Questioned Costs: None Context: During the testing performed, we noted the County did not perform a risk assessment of subrecipient nor did the County have documentation of informing the subrecipient of all required rules and regulations, including the need for the subrecipient to receive an audit as required under Uniform Guidance. Identification As A Repeat Finding: Not Applicable Recommendation: We recommend that management implement a formal subrecipient monitoring policy that defines how the County will monitor each subrecipient. This policy should include an evaluation of the risk of noncompliance for each subrecipient as well as how the subrecipients will be monitored. The County should also request a copy of the subrecipient?s audit, if applicable.