Vail Health Services

Finding 2023-001 – Significant Deficiency in Internal Control - Subrecipient Monitoring

Federal Program: Block Grants for Community Mental Health Services Assistance Listing Number: 93.958 Federal Agency: U.S. Dept of Health and Human Services Passed-Through Agency: Colorado Department of Health Services Behavioral Health Division Award Number: 23 IBEH 175467 / 24 IBEH 184610 / 24 IBEH 187913 Award Year: 2023 and 2024 Compliance Requirement: Subrecipient Monitoring Questioned Costs: Not determinable Criteria: 2 CFR 200.332(a) requires that every subaward agreement includes certain information, including 1) subrecipient's unique entity identifier; 2) name of federal awarding agency; 3) assistance listing number and title; 4) identification of whether the award is R&D; and 5) indirect cost rate for the federal award (including if the de minimis rate is charged). 2 CFR 200.332(b) requires an evaluation of the subrecipient's risk of noncompliance with federal statutes, regulations and the terms and conditions of subawards as part of subrecipient monitoring and identifies specific considerations to be made during this process. 2 CFR 180.22 requires that contract awards not be made to parties listed on the government wide exclusions in the System for Award Management, which contains the names of parties debarred, suspended or otherwise excluded by agencies as well as parties declared ineligible under statutory or regulatory authority. Condition and Context: Subrecipient agreements entered into did not contain all required components as stipulated in 2 CFR 200.332(a). While the organization did have policies and procedures to evaluate its subrecipients, not all considerations noted in 2 CFR 200.332(b) are included in the policies. Furthermore, formal documentation was not maintained of specific considerations to the subrecipients that the Organization ultimately contracted with. Formal documentation was also not maintained related to verification that the subrecipients were not on the government wide exclusions list. Effect: Subrecipient agreements are missing certain data points that are required by the federal government. This could impact the subrecipients in their reporting. Lack of proper subrecipient monitoring, including the risk assessment component and verification of suspension/debarred status could result in the Organization entering into subrecipient agreements with organizations that will not comply with federal laws and regulations. Cause: The omitted components of the agreements, including lack of formal documentation of the risk assessment and verification that subrecipients were not on the federal governmentwide exclusions list were not detected by the Organization’s internal control process. Recommendation: We recommend that management implement procedures to ensure that future subrecipient agreements are compared against all requirements in 2 CFR 200.332(a), 2 CFR 200.332(b) and 2 CFR 180.22 and that formal documentation of such considerations be maintained. Planned Corrective Actions and View of Responsible Officials: Management agrees with the finding and is in the process of updating policies and procedures to be in compliance with the requirements of 2 CFR 200.332(a), 2 CFR 200.332(b) and 2 CFR 180.22.