Finding 970673 (2023-004)

Criteria: Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) requires that pass-through entities clearly identify to each subrecipient significant Federal subaward information, including identifying award numbers, subaward period dates and budget dates, Federal Assistance Listings number and Title, and appropriate terms and conditions concerning closeout of the subaward. Typically this requirement is satisfied by utilizing a subrecipient contract, reflecting all necessary information, and requiring execution showing acknowledgement of the terms by both parties. 2 CFR section 200.332(b) requires that pass-through entities evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. The evaluation of this risk should include the subrecipient’s prior experience with the same or similar subawards, the results of previous subrecipient audits, whether the subrecipient has new personnel or substantially changed systems, and the extent and results of federal awarding agency monitoring if the subrecipient also receives federal awards directly. 2 CFR section 200.331(f) requires that pass-through entities verify that subrecipients expected to be audited are taking timely and appropriate action on deficiencies detected through audits. Condition: Internal controls should be in place to ensure the City is in compliance with all requirements of the federal award program. For the fiscal year ended June 30, 2023, the following conditions existed: • A risk assessment, required by 2 CFR section 200.332(b), was not performed on the City’s subrecipient of grant funds. • The City did not verify whether the subrecipient of the grant funds was required to be audited, as required by 2 CFR section 200.331(f). • The agreement between the City and its subrecipient did not include a description of the program’s compliance requirements, as required by 2 CFR section 200.331(a), including the specific requirements for the subrecipient’s periodic reporting to the City. Context/Cause: The City did not have adequate internal controls to ensure compliance with subrecipient monitoring requirements. Testing was performed over each requirement for the City, who had a single subrecipient for the fiscal year ended June 30, 2023. Effect: Noncompliance at the subrecipient level may occur due to the subrecipient not being aware of all of the grant’s requirements. Without a risk assessment being performed on the City’s subrecipient for its grant funds, the City will not be aware of problems with staffing or information systems of the subrecipient. Additionally, the City will be unable to effectively monitor the subrecipient if the City is unaware of whether the subrecipient is required to be audited. Recommendation: We recommend the City enhances internal controls to ensure compliance with subrecipient monitoring requirements. Auditee’s Response: We concur with the finding. We will take the necessary steps to ensure that subrecipient agreements include a communication of the federal requirements and that the City performs a risk assessment on subrecipients of federal funding.