New American Association of Massachusetts, Inc.Non-Profit

2024-001 – Subrecipient Monitoring Federal Program: Refugee and Entrant Assistance Program Federal Agency: U.S. Department of Health and Human Services Assistance Listing Number: 93.566 Repeat of Prior Finding: Yes, initial finding during fiscal year 2023. Finding 2023-006. Type of Finding: Noncompliance and Material Weakness in Internal Controls Over Compliance Criteria According to 2 CFR §200.331, a pass-through entity must adhere to the provisions in 2 CFR §200.332 which require passthrough entities to perform certain subrecipient monitoring procedures. These procedures include providing the subrecipient necessary award information so that the federal award is used in accordance with federal regulations, evaluating risks of noncompliance of subrecipients, implementing monitoring procedures based upon identified risks, and, if applicable, obtaining a copy of the subrecipients’ annual audit, and taking appropriate action on deficiencies detected through the audits, as well as other requirements. Additionally, the nonfederal entity must establish and maintain effective internal controls over the federal award to provide reasonable assurance that the non-federal entity is managing the award in compliance with federal regulations. Further, according to 2 CFR §200.331(a), specific information must be explicitly included in agreements with subrecipients that includes but is not limited to providing the Assistance Listing number, whether funding is COVID related, and that the subrecipient is responsible for compliance with 2 CFR §200 including Subpart F, if applicable. Condition and Context The Organization did not have procedures and adequate internal controls in place during the fiscal year to ensure the terms and conditions of the subaward required by 2 CFR §200.332 were provided to the subrecipient in a timely manner prior to disbursing the federal funds. Cause The Organization lacked a formal process during the fiscal year for providing subaward agreements or written notifications to subrecipients regarding federal award terms and conditions in accordance with applicable regulations prior to awarding the subaward. Effect or Potential Effect Without providing the subrecipient with details on the subaward as required at the time the subaward is made, subrecipients may be unaware that their award is subject to federal compliance requirements. Questioned Costs None noted. Recommendations We recommend developing and implementing formal procedures to ensure all subrecipients are provided with a written subaward agreement or equivalent documentation stating the required award details at the time of the subaward. Views of Responsible Officials and Planned Corrective Actions Management agrees with the finding and recommendations. See the attached corrective action plan.

2023-005 – Allowable Costs/Cost Principles and Cash Management Federal Program: Refugee and Entrant Assistance Program Federal Agency: U.S. Department of Health and Human Services Assistance Listing Number: 93.566 Repeat of Prior Finding: No Type of Finding: Noncompliance and Material Weakness in Internal Controls Over Compliance Criteria In accordance Title 2 of U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Subpart D § 200.303 states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ‘Standards for Internal Control in the Federal Government’ issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal awards. (c) Evaluate and monitor the non-Federal entity's compliance with statutes, regulations and the terms and conditions of Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings (e) Take reasonable measures to safeguard protected personally identifiable information and other information the Federal awarding agency or pass-through entity designates as sensitive or the non-Federal entity considers sensitive consistent with applicable Federal, State, local, and tribal laws regarding privacy and responsibility over confidentiality.” Additionally, 2 CFR Section 200 Subpart E outlines cost provisions, including what constitutes allowable costs, and permitted allocations of costs. To be allowable, costs generally must: be necessary and reasonable for the performance of the federal award and be allocable under the principles in 2 CFR Part 200, Subpart E; conform to any limitations or exclusions set forth in 2 CFR Part 200, Subpart E; be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the non-federal entity; be accorded consistent treatment; be in accordance with U.S. GAAP; not be included as a cost or used to meet cost-sharing or matching requirements; and must be adequately documented. Further, in accordance with cash management compliance requirements, expenses should be incurred prior to charging the grant. Condition and Context During our testing of certain cost reimbursement government contracts, it was determined that certain budgeted costs, including certain administrative and overhead line items, that were not actually incurred were billed by the Organization and reimbursed by the purchasing agency. The errors occurred, in part, because the Organization billed the maximum budgeted amount of administrative and overhead line items for certain contracts rather than the actual amount of costs incurred. Additionally, there was an instance where costs were not incurred prior to being billed. Cause The Organization had insufficient internal controls and policies to ensure that billings under cost reimbursement contracts did not exceed actual costs incurred (overbillings) and that billings are only submitted after expenses have been incurred. Effect or Potential Effect The Organization was not in compliance with the requirements for cost reimbursement contracting or recording in accordance with the Code of Massachusetts Regulations (CMR) and allowable cost principles set forth by the OMB (Office of Management and Budget) Uniform Guidance. This resulted in revenues that exceeded actual costs incurred of approximately $98,041. The overbillings resulted in a liability in that amount, subject to final adjustment by the Commonwealth of Massachusetts. Questioned Costs None noted. Recommendation We recommend the Organization establish internal controls and policies to ensure that costs which are not incurred are not charged to contracts and that costs are actually incurred prior to being charged to contracts. Views of Responsible Officials and Planned Corrective Actions Management agrees with the finding and recommendations. See the attached corrective action plan.

2023-006 – Subrecipient Monitoring Federal Program: Refugee and Entrant Assistance Program Federal Agency: U.S. Department of Health and Human Services Assistance Listing Number: 93.566 Repeat of Prior Finding: No Type of Finding: Noncompliance and Material Weakness in Internal Controls Over Compliance Criteria According to 2 CFR § 200.331, a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. If determined to be a subrecipient, the entity must adhere to the provisions in 2 CFR § 200.332 which require passthrough entities to perform certain subrecipient monitoring procedures. These procedures include providing the subrecipient necessary award information so that the federal award is used in accordance with federal regulations, evaluating risks of noncompliance of subrecipients, implementing monitoring procedures based upon identified risks, and, if applicable, obtaining a copy of the subrecipients’ annual audit, and taking appropriate action on deficiencies detected through the audits, as well as other requirements. Additionally, the nonfederal entity must establish and maintain effective internal controls over the federal award to provide reasonable assurance that the non-federal entity is managing the award in compliance with federal regulations. Further, according to 2 CFR § 200.331(a), specific information must be explicitly included in agreements with subrecipients that includes but is not limited to providing the Assistance Listing number, whether funding is COVID related, and that the subrecipient is responsible for compliance with 2 CFR § 200 including Subpart F, if applicable. Condition and Context The Organization did not have written policies and procedures in place to ensure that subrecipients are monitored and managed in accordance with Uniform Guidance 2 CFR § 200.332. The Organization did not have procedures in place to properly identify the party receiving funds from the Organization as a subrecipient and therefore assumed that the recipient was a subcontractor. As the proper determination was not made, there were no written agreements between the Organization and the subrecipients. Cause The Organization was unaware of these requirements and determined the receiver of the funds to be a subcontractor. Accordingly, there was no monitoring performed by the Organization over the subrecipient. Effect or Potential Effect Without a proper written grant agreement, subrecipients may be unaware that their award is subject to federal compliance requirements. The Organization could award federal funds to a high-risk entity and fail to adjust the methods of monitoring accordingly. Questioned Costs None noted. Recommendations We recommend that the Organization establish a written policy to monitor subrecipients and develop procedures for determining if the party receiving the funds is considered to be a subrecipient or a contractor. Further, we recommend maintaining a template to be in compliance with applicable regulations, ensuring that the subrecipient is aware of their responsibilities to adhere to federal regulations. Views of Responsible Officials and Planned Corrective Actions Management agrees with the finding and recommendations. See the attached corrective action plan

2023-007 – Internal Controls Over Compliance Federal Program: Refugee and Entrant Assistance Program Federal Agency: U.S. Department of Health and Human Services Assistance Listing Number: 93.566 Repeat of Prior Finding: No Type of Finding: Significant Deficiency in Internal Controls Over Compliance Criteria In accordance Title 2 of U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Subpart D § 200.303 states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ‘Standards for Internal Control in the Federal Government’ issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal awards. (c) Evaluate and monitor the non-Federal entity's compliance with statutes, regulations and the terms and conditions of Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings (e) Take reasonable measures to safeguard protected personally identifiable information and other information the Federal awarding agency or pass-through entity designates as sensitive or the non-Federal entity considers sensitive consistent with applicable Federal, State, local, and tribal laws regarding privacy and responsibility over confidentiality.” Condition and Context During our testing of payroll transactions, it was determined that certain timesheets selected did not have sufficient evidence that the timesheet was submitted by the employee and approved by the supervisor or management. Additionally, certain timesheets were not submitted timely resulting in late payment of employee compensation. Further, there were instances where dates on timesheets did not coincide with the Organization’s stated pay period. Lastly, overtime pay for hourly workers should have been remitted but was not. Condition and Context During our testing of payroll transactions, it was determined that certain timesheets selected did not have sufficient evidence that the timesheet was submitted by the employee and approved by the supervisor or management. Additionally, certain timesheets were not submitted timely resulting in late payment of employee compensation. Further, there were instances where dates on timesheets did not coincide with the Organization’s stated pay period. Lastly, overtime pay for hourly workers should have been remitted but was not. Cause The Organization did not maintain proper controls over payroll transactions sufficient to ensure that all timesheets were properly submitted and approved in a timely manner. Additionally, there were not controls in place to ensure that overtime pay was properly calculated and distributed. Effect or Potential Effect Failure to establish internal controls sufficient to ensure proper and timely submission and approval of employee timesheets could potentially result in errors and unallowable costs being charged to the grants and/or untimely payment of compensation to employees. Additionally, failure to establish controls around employee time reporting could result in employees not receiving overtime pay to which they were entitled. Questioned Costs None noted. Recommendations We recommend the Organization establish internal controls and policies to ensure that timesheets are tracked properly, submitted by employees and verified and approved by a supervisor, with adequate documented support of the approvals. Additionally, we recommend that the Organization establishes controls that dates on timesheet align with the Organization’s stated pay period. Views of Responsible Officials and Planned Corrective Actions Management agrees with the finding and recommendations. See the attached corrective action plan.

2023-008 – Internal Controls Over Compliance Federal Program: Refugee and Entrant Assistance Program Federal Agency: U.S. Department of Health and Human Services Assistance Listing Number: 93.566 Repeat of Prior Finding: No Type of Finding: Significant Deficiency in Internal Controls Over Compliance Criteria In accordance with 2 CFR § 200.302, the Organizations’ financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statues, regulations, and the terms and conditions of the federal award. Additionally, as required by 2 CFR 200.302(b)(4), the non-federal entity must exercise effective control over, and accountability for, all federal funds. Per 2 CFR. 200.303(a), the non-federal entity should use the Internal Control Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) as a guideline. The COSO guideline indicates that proper segregation of duties between initiating, recording, and authorizing is a best practice as well as retaining documentation of performance and authorization controls. Condition and Context During our audit it was noted that the Organization had inadequate segregation of duties over cash disbursements. Further, written policies concerning cash management practices were not followed and there are no written policies in place regarding written approval of expenses prior to submitting requests for reimbursement. Cause Lack of segregation of incompatible tasks and written policies were not consistently followed. Effect or Potential Effect Lack of internal controls around supervising and authorizing cash management and financial management systems could result in mismanagement of federal funds. Questioned Costs None noted. Recommendations Initiating, authorizing, and recording transaction should not be performed by the same individual. Segregation of incompatible tasks should be implemented so that authorization and review of cash draws of federal or state funds is done by someone other than the individual who initiates and records the transaction. Additionally, there should be written policies in place surrounding cash management. Views of Responsible Officials and Planned Corrective Actions Management agrees with the finding and recommendations. See the attached corrective action plan.