Finding Text
2023-007 – Internal Controls Over Compliance
Federal Program: Refugee and Entrant Assistance Program
Federal Agency: U.S. Department of Health and Human Services
Assistance Listing Number: 93.566
Repeat of Prior Finding: No
Type of Finding: Significant Deficiency in Internal Controls Over Compliance
Criteria
In accordance Title 2 of U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Subpart D § 200.303 states the following regarding internal control:
“The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ‘Standards for Internal Control in the Federal Government’ issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal awards. (c) Evaluate and monitor the non-Federal entity's compliance with statutes, regulations and the terms and conditions of Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings (e) Take reasonable measures to safeguard protected personally identifiable information and other information the Federal awarding agency or pass-through entity designates as sensitive or the non-Federal entity considers sensitive consistent with applicable Federal, State, local, and tribal laws regarding privacy and responsibility over confidentiality.”
Condition and Context
During our testing of payroll transactions, it was determined that certain timesheets selected did not have sufficient evidence that the timesheet was submitted by the employee and approved by the supervisor or management. Additionally, certain timesheets were not submitted timely resulting in late payment of employee compensation. Further, there were instances where dates on timesheets did not coincide with the Organization’s stated pay period. Lastly, overtime pay for hourly workers should have been remitted but was not.
Condition and Context
During our testing of payroll transactions, it was determined that certain timesheets selected did not have sufficient evidence that the timesheet was submitted by the employee and approved by the supervisor or management. Additionally, certain timesheets were not submitted timely resulting in late payment of employee compensation. Further, there were instances where dates on timesheets did not coincide with the Organization’s stated pay period. Lastly, overtime pay for hourly workers should have been remitted but was not.
Cause
The Organization did not maintain proper controls over payroll transactions sufficient to ensure that all timesheets were properly submitted and approved in a timely manner. Additionally, there were not controls in place to ensure that overtime pay was properly calculated and distributed.
Effect or Potential Effect
Failure to establish internal controls sufficient to ensure proper and timely submission and approval of employee timesheets could potentially result in errors and unallowable costs being charged to the grants and/or untimely payment of compensation to employees. Additionally, failure to establish controls around employee time reporting could result in employees not receiving overtime pay to which they were entitled.
Questioned Costs
None noted.
Recommendations
We recommend the Organization establish internal controls and policies to ensure that timesheets are tracked properly, submitted by employees and verified and approved by a supervisor, with adequate documented support of the approvals. Additionally, we recommend that the Organization establishes controls that dates on timesheet align with the Organization’s stated pay period.
Views of Responsible Officials and Planned Corrective Actions
Management agrees with the finding and recommendations. See the attached corrective action plan.