Pueblo County, Colorado

Criteria or specific requirement: The State prepares the Everyday Eats and Emergency Food Assistance Program Policy and Procedure Manuals, with specific requirements for eligibility, review of case files and documentation retention requirements. The County should have internal controls designed to ensure compliance with these provisions.

Condition: During our testing, we noted four out of forty cases that did not have appropriate supporting documentation for program eligibility. Additionally, no formal review process has been established for eligibility files in either program; however, case reviews are taking place on an informal basis. The corrective action on the error within this case file was not taken until brought up during the audit. There were no incorrect payments made.

Questioned costs: None

Context: Within our sample of forty case reviews, documentation was either missing or insufficient to support the eligibility determination in four instances. While the case reviews were conducted, there is currently no established policy specifying the frequency of reviews or identifying the personnel responsible for conducting them. Cause: The County lacks a formal eligibility review policy, and due to a new system and record retention changes, some eligibility documentation was not kept. Effect: The case file did not have the correct documentation on file.

Repeat Finding: No

Recommendation: We recommend the County review controls and procedures surrounding the programs including review and record retention requirements.

Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Non-federal entities other than states, including those operating federal programs as subrecipients of states, must follow the procurement standards set out at 2 CFR sections 200.318 through 200.326. They must use their own documented procurement procedures, which reflect applicable state and local laws and regulations, provided that the procurements conform to applicable federal statutes and the procurement requirements identified in 2 CFR Part 200. This procurement process must be documented with proper supporting documentation.

Condition: The County did not have proper procurement documentation available for the contracts tested in the audit.

Questioned costs: None

Context: Five of the five contracts tested did not have the proper supporting documentation to demonstrate that procurement procedures were followed in accordance with the County’s procurement policy.

Cause: The contracts were in process before the funding was assigned to the projects and there was turnover at the County.

Effect: Failure to document the procurement process exposes the County to the risk that the County’s procurement policy was not followed before the contracts were awarded.

Repeat Finding: Yes, repeat of prior year finding 2023-003.

Recommendation: [the auditor] recommends the County follow their internal procurement policy procedures and keep documentation of such procedures to ensure compliance with the federal procurement requirements.

Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Per 2 CFR 200.331(a) states that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes, federal award identification, subrecipient name, subrecipient’s DUNS number, federal award identification number (FAIN), federal award date, subaward start and end date, amount of federal funds obligated, total amount of federal award, federal award project description, name of federal awarding agency, Assistance Listing (ALN) number and name, identification of whether the award is R&D and indirect cost rate for federal award.

Per 2 CFR 200.303, requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal control should include procedures to ensure required information is communicated prior to the issuance of the subaward.

Per 2 CFR 200.331(a)(1), pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate level of monitoring of the subrecipient.

Per 2 CFR 200.332(d) through (f), pass-through entities must monitor the activities of the subrecipient, which includes reviewing financial reports required by the pass-through entity.

Condition: During our testing, we noted subrecipients tested had required information omitted from the sub agreements to the subrecipients including Assistance Listing (CFDA) title and number, subrecipient’s DUNS number, Federal Award Identification Number (FAIN), identification of whether the award is research and development, and indirect cost rate for federal award. Subrecipients tested did not have evidence of the County’s evaluation of the risk of noncompliance by the subrecipients, nor was there evidence of monitoring of annual audits for the subrecipients. Internal checklists that aid in compliance were missing for certain subrecipients. Reporting requirements from the subrecipients to the County were also not met. Per 2 CFR 200.331(a)(1), pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate level of monitoring of the subrecipient.

Questioned costs: None.

Context: Five out of the five subrecipients did not include required information in subaward agreements issued to subrecipients and lacked evidence of both the evaluation of risk of noncompliance of the subrecipient and monitoring of annual audits for the subrecipients. Five of the five subrecipients were missing an internal checklist that is signed by the County Manager.

Cause: Lack of sufficient controls in place to ensure that subrecipient agreements contain all required information and are monitored appropriately.

Effect: Failure to communicate required information and to adequately monitor the subrecipients could result in subrecipients not properly administering the federal programs in accordance with federal regulations.

Repeat Finding: Yes, repeat of prior year finding 2023-004.

Recommendation: [the auditor] recommends that the County review its procedures for communicating information to subrecipients and implement the procedures necessary to ensure information is included in the subrecipient award documents at time of funding and that appropriate monitoring is performed for each subrecipient.

Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Per 2 CFR 200.303, requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures in place to ensure the required certifications for covered contracts and subawards are received, documented, and contracts are not made with a debarred or suspended party.

Condition: During our testing of five covered transactions, we noted the County did not have proper suspension and debarment documentation for the vendors and subawards selected for testing.

Questioned costs: None.

Context: All five covered transaction tested did not have proper supporting documentation for suspension and debarment procedures.

Cause: Lack of sufficient controls in place to ensure that suspension and debarment checks were performed prior to entering into contracts.

Effect: Failure to obtain the required certifications or perform verification procedures with the SAM could result in the payment of federal funds to vendors that are suspended or debarred from participation in federal assistance programs.

Repeat Finding: Yes, repeat of prior year finding 2023-005.

Recommendation: [the auditor] recommends the County obtain certifications from vendors stating their organization is not suspended, debarred, or otherwise excluded from participation in federal assistance programs or document the procedures performed to verify the vendor is not identified as suspended or debarred on SAM.

Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Per the State of Colorado, Colorado Benefits Management System, SOC 1 Type 2 Report, covering July 1, 2023 through June 30, 2024, Complementary User Entity Controls, each county using CBMS is responsible for managing the access privileges granted to each county user. These user organizations should implement controls for authorizing user access for their application users.

Condition: The County was not able to produce a listing of all application users for the full year and support that the access controls were operating as designed for the full year.

Questioned costs: None

Context: The County was able to produce a listing that was for 1/1/2024 -9/3/2024; however was not able to produce a listing of all users for the full 2024 year. Tested 14 selections related to granting and terminating access for the time period covered by the listing, noting no exceptions. Cause: County could not provide documentation that the controls related to access of CBMS were working as designed for the full year. Effect: User access controls could not be tested through the full year.

Repeat Finding: No

Recommendation: [the auditor] recommends the County runs annual full user reports to ensure that access is being granted and terminated in a timely basis.

Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: The State prepares the Colorado Child Care Assistance Program (CCAP) Quality Assurance Reviewer Guide, with specific requirements for review of case files. The County should have internal controls designed to ensure compliance with these provisions.

Condition: During our testing, we noted one out of ten cases that did not have an appropriate review. The corrective action on the error within this case file was not taken until brought up during the audit. There were no incorrect payments made.

Questioned costs: None

Context: From our sample of ten case reviews, there was one case where the review was not performed appropriately and the corrective action on the error within the case file (surrounding identification) was not taken at that time. Corrective action was not taken until 9/5/2024 when we inquired of the resolution to the error noted during the review. There were no incorrect payments made related to this error. This error was corrected on 9/5/2024.

Cause: The individual responsible for the case did not resolve the error when brought to their attention after the case review in November 2023.

Effect: The case file did not have the correct identification verification on file.

Repeat Finding: No

Recommendation: We recommend the County review controls and procedures surrounding the follow-up by individual case managers surrounding errors noted on their case review to ensure corrective action is taken in a timely manner.

Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Per Colorado Regulation 3.755.17 - Archiving Case Files, the County is responsible for archiving 3 program years plus the current program year files.

Condition: During our testing, we noted one out of forty case files the County was unable to locate.

Questioned costs: None

Context: The County was unable to locate the case file for one of the selected individuals for eligibility testing.

Cause: The County is in the process of scanning in old case files as was unable to locate the selected case file.

Effect: The County was unable to locate the case file.

Repeat Finding: No

Recommendation: [the auditor] recommends the County review controls and procedures surrounding file storage/retention to ensure files are being archived in accordance with Colorado Regulation 3.755.17 - Archiving Case Files.

Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Non-federal entities other than states, including those operating federal programs as subrecipients of states, must follow the procurement standards set out at 2 CFR sections 200.318 through 200.326. They must use their own documented procurement procedures, which reflect applicable state and local laws and regulations, provided that the procurements conform to applicable federal statutes and the procurement requirements identified in 2 CFR Part 200. This procurement process must be documented with proper supporting documentation.

Condition: The County did not have proper procurement documentation available for the contracts tested in the audit.

Questioned costs: None

Context: Seven of the seven contracts tested did not have the proper supporting documentation to demonstrate that procurement procedures were followed in accordance with the County’s procurement policy.

Cause: The contracts were in process before the funding was assigned to the projects and there was turnover at the County.

Effect: Failure to document the procurement process exposes the County to the risk that the County’s procurement policy was not followed before the contracts were awarded.

Repeat Finding: Yes, repeat of prior year finding 2022-003.

Recommendation: [the auditor] recommends the County follow their internal procurement policy procedures and keep documentation of such procedures to ensure compliance with the federal procurement requirements.

Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Per 2 CFR 200.331(a) states that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes, federal award identification, subrecipient name, subrecipient’s DUNS number, federal award identification number (FAIN), federal award date, subaward start and end date, amount of federal funds obligated, total amount of federal award, federal award project description, name of federal awarding agency, Assistance Listing (CFDA) number and name, identification of whether the award is R&D and indirect cost rate for federal award.

Per 2 CFR 200.303, requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal control should include procedures to ensure required information is communicated prior to the issuance of the subaward.

Per 2 CFR 200.331(a)(1), pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate level of monitoring of the subrecipient.

Per 2 CFR 200.332(d) through (f), pass-through entities must monitor the activities of the subrecipient, which includes reviewing financial reports required by the pass-through entity.

Condition: During our testing, we noted subrecipients tested had required information omitted from the sub agreements to the subrecipients including Assistance Listing (CFDA) title and number, subrecipient’s DUNS number, Federal Award Identification Number (FAIN), identification of whether the award is research and development, and indirect cost rate for federal award. Subrecipients tested did not have evidence of the County’s evaluation of the risk of noncompliance by the subrecipients, nor was there evidence of monitoring of annual audits for the subrecipients. Internal checklists that aid in compliance were missing for certain subrecipients. Quarterly reports were also not submitted to the County by the subrecipients subsequent to funding.

Questioned costs: None.

Context: Five out of the five subrecipients did not include required information in subaward agreements issued to subrecipients and lacked evidence of both the evaluation of risk of noncompliance of the subrecipient and monitoring of annual audits for the subrecipients. One of the five subrecipients was missing an internal checklist that is signed by the County Manager. Five of the five subrecipients were provided the funding at the beginning of the grant award period and no required quarterly reports were submitted to the County subsequent to funding.

Cause: Lack of sufficient controls in place to ensure that subrecipient agreements contain all required information and are monitored appropriately.

Effect: Failure to communicate required information and to adequately monitor the subrecipients could result in subrecipients not properly administering the federal programs in accordance with federal regulations.

Repeat Finding: Yes, repeat of prior year finding 2022-004.

Recommendation: [the auditor] recommends that the County review its procedures for communicating information to subrecipients and implement the procedures necessary to ensure information is included in the subrecipient award documents at time of funding and that appropriate monitoring is performed for each subrecipient.

Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Per 2 CFR 200.303, requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures in place to ensure the required certifications for covered contracts and subawards are received, documented, and contracts are not made with a debarred or suspended party.

Condition: During our testing of six covered transactions, we noted all vendors and subawards did not have proper supporting documentation for suspension and debarment procedures for vendors.

Questioned costs: None.

Context: All six covered transaction tested did not have proper supporting documentation for suspension and debarment procedures.

Cause: Lack of sufficient controls in place to ensure that suspension and debarment checks were performed prior to entering into contracts.

Effect: Failure to obtain the required certifications or perform verification procedures with the SAM could result in the payment of federal funds to vendors that are suspended or debarred from participation in federal assistance programs.

Repeat Finding: Yes, repeat of prior year finding 2022-005.

Recommendation: [the auditor] recommends the County obtain certifications from vendors stating their organization is not suspended, debarred, or otherwise excluded from participation in federal assistance programs or document the procedures performed to verify the vendor is not identified as suspended or debarred on SAM.

Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: 2 CFR Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Award requires compliance with allowable costs and activities. The County should have internal controls designed to ensure compliance with these provisions, including review of expenditure detail when preparing the Scheduled of Expenditures of Federal Awards (SEFA).

Condition: The County did not identify SLFRF expenditures associated with revenue replacement funds until after the SEFA was prepared.

Questioned costs: None

Context: The County had support behind the overall totals reported in aggregate on the SEFA for the SLFRF program, but the specific expenditure detail was not readily available. The County had to go back through and put together expenditure level detail to support the amounts reported on the SEFA. The County worked with an ARPA consultant for the $10 million revenue replacement, but did not have a listing of related expenditures until we brought this up during the audit.

Cause: The County did not have proper procedures in place to support amounts reported on the SEFA for the SLFRF program.

Effect: The County did not identify SLFRF expenditures associated with revenue replacement funds until after the SEFA was prepared.

Repeat Finding: No

Recommendation: We recommend the County review its controls and procedures in place surrounding tracking detail of federal expenditures.

Views of responsible officials: There is no disagreement with the audit finding.