New Mexico Department of Homeland Security and Emergency ManagementState Government

REPORTING Reference Number: 2025-004 (2024-006) Category of Finding: Reporting Type of Finding: Material Noncompliance and Material Weakness State Administering Department: Homeland Security and Emergency Management Assistance Listing Number: 93.036 Federal Program Title: Disaster Grants – Public Assistance Federal Award Numbers and Years: 5184DRNMP5SNM500 4529DRNMP5SNM500 4625DRNMP5SNM500 5281DRNMP5SNM500 5430DRNMP5SNM500 4795DRNMP5SNM500 4843DRNMP5SNM500 5461DRNMP5SNM500 Assistance Listing Number: 93.039 Federal Program Title: Hazard Mitigation Grant Program Federal Award Numbers and Years: 5184FMNMP5SNM500 4529FMNMP5SNM500 4625FMNMP5SNM500 5281FMNMP5SNM500 5430FMNMP5SNM500 4795FMNMP5SNM500 4843FMNMP5SNM500 5461FMNMP5SNM500 Assistance Listing Number: 93.042 Federal Program Title: Emergency Management Performance Grant Federal Award Numbers and Years: EMT2023EP00002; 2023 EMT2024EP05014; 2024 Assistance Listing Number: 93.067 Federal Program Title: Homeland Security Grant Program Federal Award Numbers and Years: EMW2023SS00015; 2023 EMW2024SS05231; 2024 Criteria Title 2 - Grants and Agreements, Subtitle A - Office of Management and Budget Guidance for Grants and Agreements, Chapter II - Office of Management and Budget Guidance, Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D - Post Federal Award Requirements, Standards for Financial and Program Management, §200.328 Financial Reporting (2 CFR 200.328):(c) The recipient or subrecipient must submit financial reports as required by the Federal award. Reports submitted annually by the recipient or subrecipient must be due no later than 90 calendar days after the reporting period. Reports submitted quarterly or semi-annually must be due no later than 30 calendar days after the reporting period. Title 2 - Grants and Agreements, Subtitle A - Office of Management and Budget Guidance for Grants and Agreements, Chapter II - Office of Management and Budget Guidance, Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D - Post Federal Award Requirements, Standards for Financial and Program Management, §200.302 Financial Management (2 CFR 200.302): (a) Each State must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State's funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award Condition The Department did not submit the required SF-425 financial status reports by the required submission date, 30 calendar days from the end of the reporting period as follows: • 97.036 Disaster Grants Public Assistance, 4 of 8 reports sampled were not submitted timely. • 97.039 Hazard Mitigation Grant Program, 2 of 8 reports sampled were not submitted timely. • 97.042 Emergency Management Performance Grants, 2 of 4 reports sampled were not submitted timely. • 97.067 Homeland Security Grant Program, 3 of 5 reports sampled were not submitted timely. Management made some progress. Identification as a Repeat Finding Finding 2024-006 is repeated and modified. Cause The Department experienced a high level of turnover in financial division personnel, during which time the processes in place did not allow for the timely preparation and submission of required quarterly SF-425 Financial reports. Effect Untimely report submissions can result in ineffective oversight by the federal oversight agency. Questioned Costs Questioned costs were not identified. Context The Department is required to submit financial status reports quarterly for all federal grant programs. The turnover in staffing resulted in delayed submissions for approximately half of the fiscal year, primarily impacting reporting periods ended March 31, 2025 and June 30, 2025. Recommendation The Department should ensure that as part of the revisions to policies and procedures over the financial reporting of the Department’s federal grants, there are practices in place that provide for alternate personnel that can compile, review and submit financial status reports in the event of unexpected vacancies or absences from the positions designated primary reporting responsibilities.

2024-004 CASH MANAGEMENT Federal agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants – Public Assistance (Presidentially Declared Disasters) - 97.036 Hazard Mitigation Grant Program – 97.039 Emergency Management Performance Grants – 97.042 Homeland Security Grant Program – 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Non-compliance Compliance Areas: Cash Management Questioned Costs: None Condition Management has been unable to provide sufficient appropriate audit evidence relating to the completeness, existence, accuracy, and valuation of the Department’s federal revenue, accounts receivable/payable and related deferred inflows of resources reported as of June 30, 2024. This was included in our basis for qualifying opinion on Governmental Activities and the Federal Grants Fund. The Department lacked effective processes and controls for determining the amount Due From Federal Government as part of its year-end close process. The Department did not consistently apply its process for recording the Due From amount for all federal grants throughout the year. The Federal Grants Fund (Fund 40280) has a deficit fund balance of $24,515,842 and a $31,837,546 balance related to deferred inflows for FEMA grant funds that were not received within the 90-day period of availability after fiscal year-end. Subsequent drawdowns/collections on the June 30, 2024 amount Due From Federal Government of $37,384,520 were poor, with the Department drawing down or receiving $10,160,346 from July 1, 2024 through November 22, 2024. The accounts receivable summary by grant as of June 30, 2024 contained abnormal credit balances in the amount of $328,175, which the Department will need to research to determine if there are any overdrawn amounts. Management’s Progress for Repeated Finding: Management did make progress implementing adequate controls to resolve the finding from the prior years, by billing and receiving amounts from previous fiscal years. However, a material weakness still exists over controls over these account balances. Criteria According to §200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Department, federal reimbursement requests are completed quarterly with the reporting process. According to NMSA 1978 §6.-5-2, the Financial Control Division (the division) shall issue a manual of model accounting practices containing the procedures and policies. State agencies shall comply with the model accounting practices established by the division, and the administrative head of each state agency shall ensure that the model accounting practices are followed. According to FIN 16 General Accounting Practices in the Manual of Model Accounting Practices, all reporting of financial information must be timely, complete, and accurate, to the state agency’s management and to oversight agencies and entities. Effect State agency’s management and other agencies and entities may not be able to rely on the financial information presented by the Department due to untimely, incomplete, and inaccurate financial reporting. The Federal Government may place the Department on controlled draws. Cause While the Department has made improvements from prior year related to the reconciliation and draw down of all federal receivables, the Department continues to lack an effective control environment that allows for timely and accurate drawdowns, financial reporting, and accounting of the Department’s Federal accounts receivable/payable balance and related deferred inflows of resources.

2024-005 SUBRECIPIENT MONITORING Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants – Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants – 97.042 Homeland Security Grant Program – 97.067 Award Period: Various Type of Finding:Significant Deficiency in Internal Control over Compliance Other Non-compliance Condition: During our testing, we noted the Department did not have adequate internal controls in place to ensure compliance with subrecipient monitoring. . ALN 97.036, ALN 97.042, ALN 97.067 The Department lacked an effective process to timely provide documentation to the auditors which would evidence compliance with the Subrecipient Monitoring compliance requirement. This makes it difficult for management to monitor for compliance or for a third party to test compliance. All requested documentation was ultimate provided. ALN 97.036 o We reviewed files for 5 subrecipients, from which there were 16 ongoing projects during fiscal year 2024. Of these, 1 of 5 subrecipients did not have evidence that a risk assessment was performed. 2 of 5 subrecipients did not have adequate documentation of monitoring activities performed, including the Department's monitoring checklist. Management's Progress for Repeated Finding: Management made some progress in the performing of risk assessments and reviews of audits for non-disaster grants, but still has opportunity to improve controls in the areas described above. Criteria: According to §200.332 Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. In addition, the pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass- through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 Management Decision. Department Policy No. GRA 418 Sub-Grant Recipient Monitoring effective June 30, 2017 establishes and implements policy and procedures for the Department staff engaged in the Department's sub- grant recipient monitoring process. For Mitigation Sub-Grant Monitoring, the Mitigation Specialist shall review the local progress quarterly reports due to the Department. For Non-Disaster Sub-Grant Recipient Monitoring, the Program Manager shall review the local progress quarterly reports due to the Department. Specific to Pre-Monitoring Requirements and Considerations, Department Program Staff shall perform risk-based assessments and apply the assessment to all of the Department's approved sub-recipients for monitoring purposes and risk designation.

2024-006 REPORTING Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants - Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants - 97.042 Award Period: Various Type of Finding: Significant Deficiency in Internal Control over Compliance Other Non-compliance Questioned Costs: Unknown Condition: We noted the Department was not in compliance with requirements related to the reporting of grants. ALN 97.042 The Department did not complete the recipient share section of the federal financial reports for 4 out of 4 reports tested. ALN 97.036 We reviewed files for 5 subrecipients, from which there were 16 ongoing projects during fiscal year 2024. Of these, 4 of the 16 projects did not have evidence of the required reporting for Federal Funding Accountability and Transparency Act (FFATA). Criteria According to §200.302 Financial management of 2 CFR Part 200, the State's, and the other non- Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. According to §200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effect. The auditor noted instances of noncompliance. Non-compliance may result in delayed reimbursement of eligible federal expenditures or the potential loss of federal funding. Cause The Department lacks established internal controls and procedures over financial grant management to ensure submitted reports are complete, agree to supporting spreadsheets, submitted timely, and properlv maintained in the files of the Department.

2024-007 SPECIAL TESTS - DISASTER GRANT PROJECTS Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants - Public Assistance (Presidentially Declared Disasters) - 97.036 Award Period: 2023 Type of Finding: Significant Deficiency in Internal Control over Compliance Other Non-compliance Questioned Costs: Unknown Condition We noted the Department was not in compliance with requirements related to accounting to FEMA of eligible costs for large, completed projects: ALN 97.036 We reviewed cost documentation support for 13 completed projects with $11,269,633 in total expenditures, and noted $4,340 in costs that were unsupported. Criteria For large projects, the subrecipient must make an accounting to the recipient. In submitting the accounting, the entity is required to certify that reported costs were incurred in performance of eligible work, that the approved work was completed, that the project was in compliance with the provisions of FEMA-State agreement, all grant conditions were met, and that payments were made in accordance with the applicable payment provisions. Effect The Department was not in compliance with the requirement to account for total costs as allowable. Cause The Department did not have adequate controls in place to monitor this compliance requirement.

2023-003 (2019-010) CASH MANAGEMENT – Repeated and Modified Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants – Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants – 97.042 Pre-Disaster Mitigation – 97.047 Homeland Security Grant Program – 97.067 Award Period: Various Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Non-compliance Condition In the audit for fiscal year ended June 30, 2022, the Department was unable to provide sufficient audit evidence regarding the accuracy, completeness, and valuation of the Federal accounts receivable/payable and related deferred inflows of resources balances as of June 30, 2022. During fiscal year 2023 and during fiscal year-end close, management continued to research, identify, and resolve a substantial majority of them by dollar amount. As a result of resolving these issues, the Department made or will make some untimely drawdowns of federal awards outside the quarterly reporting process. As a result of research performed by management and from the final reconciliation of those balances as of June 30, 2023, management was able to reduce the deficit fund balance in the Federal Grants Fund from $11,169,582 (before restatement) to $8,645,124, as of June 30, 2022 and 2023, respectively. Of the June 30, 2023 balance, $5,808,116 of the deficit balance is driven by revenues that were classified as deferred inflows, and are considered to be unavailable as they relate to FEMA funds that were not received within 90 days after fiscal year-end. For the two largest balances that make up this amount, first, management expects to draw $1,814,028 in Homeland Security Grant funds in early November 2023. Also, the Department has incurred $2,944,261 in management costs that they expect to bill to the Public Assistance Disaster Grants. Of the remaining deficit of $2,887,586 in the Federal Grants Fund that is not explained by these deferred inflows, the entire amount relates to $2,989,552 in grants awarded to two subrecipients several years ago, for which the Department is not able to draw funds from the federal government. These amounts have been allowed for (see Note 4). Management’s Progress for Repeated Findings: Management did make significant progress implementing adequate controls to resolve the finding from the prior years, resulting in an improvement from a Qualified Opinion to an Unmodified Opinion on the Federal Grants Fund, Federal Grants Fund Budgetary Comparison, and for Governmental Activities. However, a material weakness still exists over controls over these account balances.   Criteria According to §200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Department, federal reimbursement requests are completed quarterly with the reporting process. According to NMSA 1978 §6.-5-2, the Financial Control Division (the division) shall issue a manual of model accounting practices containing the procedures and policies. State agencies shall comply with the model accounting practices established by the division, and the administrative head of each state agency shall ensure that the model accounting practices are followed. According to FIN 16 General Accounting Practices in the Manual of Model Accounting Practices, all reporting of financial information must be timely, complete, and accurate, to the state agency’s management and to oversight agencies and entities. Effect State agency’s management and other agencies and entities may not be able to rely on the financial information presented by the Department due to untimely, incomplete, and inaccurate financial reporting. The Federal Government may place the Department on controlled draws. Cause While the Department has made significant improvements from prior year related to the reconciliation and draw down of all federal receivables, the Department continues to lack an effective control environment that allows for timely and accurate drawdowns, financial reporting, and accounting of the Department’s Federal accounts receivable/payable balance and related deferred inflows of resources.

2023-004 (2019-015) SUBRECIPIENT MONITORING – Repeated and Modified Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Homeland Security Grant Program – 97.067 Award Period: Various Type of Finding: Significant Deficiency in Internal Control over Compliance Other Non-compliance Condition During our testing, we noted the Department did not have adequate internal controls in place to ensure compliance with subrecipient monitoring. • Homeland Security Grant Program – 97.067 o This program of the Department lacked evidence that a risk assessment was performed for subrecipients as relates to the risk of noncompliance for those subawards subject to the Uniform Guidance. o This program of the Department lacked evidence that reviews of audits of subrecipients were performed that would allow the Department to identify any potential deficiencies that would require follow-up. Management’s Progress for Repeated Findings: Management made some progress in the performing of risk assessments and reviews of audits for Emergency Management Performance Grants, Disaster Grants – Public Assistance, and Pre-Disaster Mitigation programs. In other areas noted above, management has not yet implemented adequate controls to resolve the finding from the prior years. Criteria According to §200.332 Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. In addition, the pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 Management Decision. Department Policy No. GRA 418 Sub-Grant Recipient Monitoring effective June 30, 2017 establishes and implements policy and procedures for the Department staff engaged in the Department’s sub-grant recipient monitoring process. For Mitigation Sub-Grant Monitoring, the Mitigation Specialist shall review the local progress quarterly reports due to the Department. For Non-Disaster Sub-Grant Recipient Monitoring, the Program Manager shall review the local progress quarterly reports due to the Department. Specific to Pre-Monitoring Requirements and Considerations, Department Program Staff shall perform risk-based assessments and apply the assessment to all of the Department’s approved sub-recipients for monitoring purposes and risk designation. Effect The lack of internal controls over this compliance requirement provides an opportunity for noncompliance at the subrecipient level. Potential costs outside the scope of work as well as overall effective project management at the subrecipient level. Cause The Department lacks established internal controls and procedures over financial grant management to ensure compliance with applicable compliance requirements.

2022-004 (2019-010) CASH MANAGEMENT ? Repeated and Modified Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants ? 97.042 Fire Management Assistance Grants ? 97.046 Pre-Disaster Mitigation ? 97.047 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Questioned Costs: Unknown Condition: During our testing, we noted the Department was not performing timely reimbursement requests of federal awards within the quarterly reporting process. Previously uncollectable amounts have caused a large deficit fund balance to accrue for federal programs. ? All o Fund balance in the Federal Grants Fund (40280) decreased from a deficit of $7,105,386 to a deficit of $11,169,582, a reduction of $4,064,195. Of this reduction, $1,851,874 could not be readily explained, and the majority of this figure likely represents federal expenditures from FY22 or prior that had not been requested as of January 17, 2023. ? Assistance Listing 97.036 o An operating unit was not identified on $50,653 in FY22 expenditures. o 1 of 23 requests tested was for a FY19 expenditure, which had not been disbursed to the subrecipient until FY22. ? Assistance Listing 97.067 o 1 of 17 requests tested was for a FY21 expenditure, which had not been disbursed to the subrecipient until 06/30/2022. o 6 of 17 payments to subrecipients tested were missing pertinent signatures indicating review and approval. o 4 of 17 payments to subrecipients tested lacked adequate supporting documented from the subrecipients for reimbursement. Management?s Progress for Repeated Findings: Management has made significant progress to address the prior year condition relating to the identification of operating units in accounting entries, and in reconciling grant trackers to the general ledger. Management failed to implement adequate controls to resolve other conditions of the finding from the prior years. Criteria: According to ?200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Department, federal reimbursement requests are completed quarterly with the reporting process. Effect: The auditor noted instances of noncompliance. Noncompliance results in possible under or over charges to the grants. Cause: The Department continued to have staff turnover. Also, the Department lacks established internal controls and procedures over financial grant management to ensure the tracking of unbilled amounts and over timely compliance with applicable compliance requirements.

2022-005 (2019-013) REPORTING ? Repeated and Modified Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants ? 97.042 Fire Management Assistance Grants ? 97.046 Pre-Disaster Mitigation ? 97.047 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Questioned Costs: Unknown Condition: We noted the Department was not in compliance with requirements related to the reporting of grants. ? Assistance Listing 97.036 o The Department did not complete the recipient share section of the federal financial reports for 2 out of 10 reports tested. ? Assistance Listing 97.042 o The Department did not complete the recipient share section of the federal financial reports for 4 out of 9 reports tested. o 2 out of 9 federal financial reports tested were not submitted timely. ? Assistance Listing 97.046 o 2 out of 6 federal financial reports tested were not provided to us. ? Assistance Listing 97.047 o The Department did not complete the recipient share section of the federal financial reports for 3 out of 6 reports tested. ? Assistance Listing 97.067 o All but one Performance Progress Report was not submitted for FY22. Management?s Progress for Repeated Findings: Management failed to implement adequate controls to resolve the finding from the prior years. Criteria: According to ?200.302 Financial management of 2 CFR Part 200, the State?s, and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. According to ?200.303 Internal controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effect: The auditor noted instances of noncompliance. Noncompliance results in delayed reimbursement of eligible federal expenditures. Potential loss of federal funding. Cause: The Department lacks established internal controls and procedures over financial grant management to ensure submitted reports are complete, agree to supporting spreadsheets, submitted timely, and properly maintained in the files of the Department.

2022-006 (2019-015) SUBRECIPIENT MONITORING ? Repeated and Modified Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants ? 97.042 Fire Management Assistance Grants ? 97.046 Pre-Disaster Mitigation ? 97.047 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Questioned Costs: None Condition: During our testing, we noted the Department did not have adequate internal controls in place to ensure compliance with subrecipient monitoring. ? All o The Department lacked evidence that a risk assessment was performed for subrecipients as relates to the risk of noncompliance for those subawards subject to the Uniform Guidance. o The Department lacked a process for all federal programs to review the audits of subrecipients that would allow the Department to identify any potential deficiencies that would require follow-up. o The Department lacked a process to ensure timely reporting by subgrantees of financial reporting and performance reporting. Also, the Department lacked a process to ensure timely review of reports submitted by subgrantees. Management?s Progress for Repeated Findings: Management failed to implement adequate controls to resolve the finding from the prior years. Criteria: According to ?200.332 Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. In addition, the pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ?200.521 Management Decision. Department Policy No. GRA 418 Sub-Grant Recipient Monitoring effective June 30, 2017 establishes and implements policy and procedures for the Department staff engaged in the Department?s sub-grant recipient monitoring process. For Mitigation Sub-Grant Monitoring, the Mitigation Specialist shall review the local progress quarterly reports due to the Department. For Non-Disaster Sub-Grant Recipient Monitoring, the Program Manager shall review the local progress quarterly reports due to the Department. Specific to Pre-Monitoring Requirements and Considerations, Department Program Staff shall perform risk-based assessments and apply the assessment to all of the Department?s approved sub-recipients for monitoring purposes and risk designation. Effect: The auditor noted instances of material noncompliance. Noncompliance results in possible federal funds provided to ineligible subrecipients. Also, the lack of internal controls over this compliance requirement provides an opportunity for noncompliance at the subrecipient level. Potential costs outside the scope of work as well as overall effective project management at the subrecipient level. Cause: The program staff continue to not operate under the Sub-Grant Recipient Monitoring effective June 30, 2017. The Department continues to lack established internal controls and procedures over financial grant management to ensure compliance with applicable compliance requirements.

Federal agency: U.S. Department of Homeland Security/FEMA Federal program title and Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) ? 97.036 Award Period: Various Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: According to ?200.303 Internal controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During our testing, we noted exceptions related to the Department?s utilization of the operating unit field and missing invoice approvals. Management?s Progress for Repeated Findings: Management failed to implement adequate controls to resolve the finding from the prior years. Questioned costs: $81,491 Context: We noted the Department did not identify an operating unit for 8 of the 35 disbursements totaling an approximate amount of $16K. Also, we noted the Department did identify an operating unit for 25 of the 35 disbursements totaling an approximate amount of $65K. However, we were not provided with a reconciliation from the contractor timesheets to the costs charged to the grant to test the accuracy of the operating unit. The Department utilizes the operating unit field to identify the grant within the program to charge costs. The Department utilizes a vendor to assist in grant management activity. Most of the disbursements are related to these contractual services. The timesheets provided to us identify the contractor?s activity. However, this information is not being entered in at the time of expenditure recognition. Furthermore, the Department is not performing a consistent review of the blank operating units to allocate costs for reflection in the accounting records via a journal entry. Lastly, 2 of the 35 disbursements did not contain a signature and OK to pay evidencing review and approval of the costs prior to disbursement. The sample was a statistically valid sample. Cause: The Department continued to have staff turnover. Also, the Department lacks established internal controls and procedures over financial grant management to ensure timely compliance with applicable compliance requirements. Repeat finding: The finding is a repeat of a finding in the immediately prior years. Prior year finding numbers are 2020-007 and 2019-008. Effect: The auditor noted instances of noncompliance. Noncompliance results in possible under or over charges to the grants. Recommendation: We realize the Department continues to have staff turnover. Also, we realize the task of including the operating unit may be cumbersome based on the contractor?s activity. We recommend the Department review its process and implement effective policies, procedures, and controls to ensure the accounting records appropriately reflect the activity of the grant. The Department should consider efficiencies to make the process less cumbersome. Lastly, we recommend the Department ensures costs are reviewed and approved prior to disbursement. Views of responsible officials: The Department understands the issue. The Department has already implemented a process to reconcile invoices and timesheets quarterly and make necessary adjustments. As for the $81,491 in Questioned Costs, the Department would like to clarify that funds were never drawn from the federal government due to a coding error in SHARE. A procedure to analyze contractor expenditures and make sound adjusting entries has been developed and will be utilized to eliminate this finding at the direction of the Chief Financial Officer.

Federal agency: U.S. Department of Homeland Security/FEMA Federal program title and Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) ? 97.036 Emergency Management Performance Grants ? 97.042 Award Period: Various Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: According to ?200.303 Internal Controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. According to ?200.430 Compensation?personal services of 2 CFR Part 200, costs of compensation are allowable to the extent the costs are reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities and follows an appointment made in accordance with a non-Federal entity's laws and/or rules or written policies. According to the Department?s FIN-114 Payroll Allocation Policy, DHSEM staff working on more than one (1) project or grant throughout the day must ensure that time allocated to a specific grant is accurately reflected in the daily written record and ultimately in the SHARE payroll system with appropriate notation in the comment box. Condition: During our testing, we were unable to recalculate a few payroll costs charged to the grant. Also, we were unable to recalculate a gross wage. Management?s Progress for Repeated Findings: Management failed to implement adequate controls to resolve the finding from the prior years. Questioned costs: $7,028 Context: During our testing, we noted the following exceptions: ? Assistance Listing 97.036 o For 2 of the 5 disbursements, we were unable to recalculate the wages and benefits charged to the grant totaling an approximate amount of $5.3K. ? Assistance Listing 97.042 o For 1 of the 20 disbursements, we were unable to recalculate the gross wage as the employee was no longer in SHARE for us to access the gross wage information and we were not provided with the requested payroll register. o For 1 of the 20 disbursements, we were unable to recalculate the wages and benefits charged to the grant totaling an approximate amount of $1.4K. o For 1 of the 20 disbursements, we noted an employee?s total payroll costs of approximately $2.6K allocated 50% to the grant. However, this is not consistent with the 38% Federal EMPG % Salary Paid in the EMPG 2020 Program Workbook. The samples were statistically valid samples. Cause: Management oversight. Repeat finding: The finding is a repeat of a finding in the immediately prior years. Prior year finding numbers are 2020-008 and 2019-009. Effect: The auditor noted instances of noncompliance. Noncompliance results in possible under or over charges to the grants. Recommendation: We recommend the Department design controls to ensure an adequate review process is in place related to the payroll costs charged to the grants. This review should be no less than quarterly and no more than semi-annual and include a final review of the hours charged to the grant against the actual hours worked on the grant by the employee to ensure overall reasonableness of the payroll costs charged to the grants. Views of responsible officials: Department understands these issues. The Department?s payroll is complex due to over 40 funding sources. The Department is committed to: - Providing better training for staff on charging time accurately. - ASB performing payroll reconciliations. - Meet and train with FCD to implement a process to reconcile payroll monthly by utilizing tools available within SHARE The Chief Financial Officer will coordinate efforts to eliminate this finding.

Federal agency: U.S. Department of Homeland Security/FEMA Federal program title and Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) ? 97.036 Hazard Mitigation Grant ? 97.039 Emergency Management Performance Grants ? 97.042 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: ? Material Weakness in Internal Control over Compliance ? Material Noncompliance (Modified Opinion) Criteria or specific requirement: According to ?200.303 Internal controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Department, federal reimbursement requests are completed quarterly with the reporting process. requests of federal awards. Management?s Progress for Repeated Findings: Management failed to implement adequate controls to resolve the finding from the prior years. Questioned costs: Unknown Context: During our testing, we noted reimbursement requests were not requested within the quarterly reporting process. We noted the following exceptions: ? Assistance Listing 97.036 o Federal expenditures in an approximate amount of $1 million have not been requested as a result of no identification of operating unit and no reconciliation by the Department to allocate costs to grants. The Department incurred these expenditures in the prior and current fiscal years. o Federal expenditures in an approximate amount of $1.2 million have not been requested as of 9/3/2021. The Department incurred these expenditures in the current fiscal year. o The Total Expenditures Cumulative in SHARE in the PA Disaster Recon did not agree to the general ledger by an approximate amount of $30K. o Two requests have yet to be fully disbursed to the subrecipients. The total yet to be disbursed is approximately $35K. o One request of approximately $64K was not disbursed to the subrecipient until fiscal year 2022. Approximately 7 months after the request. ? Assistance Listing 97.039 o One request of approximately $94K did not contain evidence of review and approval of the reimbursement prior to the request. o One request contained expenditures from fiscal years 2016 through 2020. The request occurred in July 2020. o One request contained expenditures from fiscal year 2019. The request occurred in April 2021. o One request occurred approximately two months after the quarterly reporting due date. o Two requests occurred approximately five months after the quarterly reporting due date. o Federal expenditures in an approximate amount of $3.8 million have not been requested as of 9/3/2021. The Department incurred these expenditures in the current fiscal year. ? Assistance Listing 97.042 o Two requests contained expenditures from fiscal year 2019. The requests occurred in October 2020. o We were unable to agree one request of approximately $275K to the general ledger. Variance of approximately $225K. o Federal expenditures in an approximate amount of $325K have not been requested as of 9/3/2021. The Department incurred these expenditures in the prior and current fiscal years. Context (Continued): ? Assistance Listing 97.067 o We were unable to agree two requests totaling approximately $5.2 million to the general ledger. Total variance of approximately $818K. o Two requests contained expenditures from prior fiscal years. One request occurring in March 2021 contained expenditures from fiscal year 2019. The other request occurring in December 2020 contained expenditures from fiscal years 2019 and 2020. o Federal expenditures in an approximate amount of $979K have not been requested as of 9/3/2021 or 9/20/2021. The Department incurred these expenditures in the prior and current fiscal years. The samples were statistically valid samples. Cause: The Department continued to have staff turnover. Also, the Department lacks established internal controls and procedures over financial grant management to ensure timely compliance with applicable compliance requirements. Effect: The auditor noted instances of noncompliance. Noncompliance results in delayed reimbursement of eligible Federal expenditures. Repeat finding: The finding is a repeat of a finding in the immediately prior years. Prior year finding numbers are 2020-009 and 2019-010. Recommendation: We recommend the Department establish and implement a monthly reimbursement request process which includes updating of the Department?s Policy No. GRA 415 Grant Drawdowns. The monthly reimbursement request process should include a reconciliation of the grants to the general ledger to ensure all federal expenditures are requested so that requests represent the most recent activity of the grants. Also, we recommend the Department complete a reconciliation of reimbursement requests to federal expenditures in the general ledger with running of the general ledger since inception of the grant to capture all adjustments to the grants. This should especially be done before closing each grant. Views of responsible officials: The Department understands the issues. The Department plan to resolve the findings: - Quarterly review reconciliation of general ledger - Work with DFA Financial Control Division to create a new fund that houses the reconciled grants which will separate out the legacy grants which will continue to create future findings - As processes continue to improve, Department will update policies and procedures - Additional training for Department staff The Chief Financial Officer will coordinate improved cash management.

Federal agency: U.S. Department of Homeland Security/FEMA Federal program title and Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) ? 97.036 Hazard Mitigation Grant ? 97.039 Emergency Management Performance Grants ? 97.042 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: ? Material Weakness in Internal Control over Compliance ? Material Noncompliance (Modified Opinion) Criteria or specific requirement: According to ?200.302 Financial management of 2 CFR Part 200, the state?s and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. According to ?200.303 Internal controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: We noted the Department is not in compliance with requirements related to the reporting of grants. Management?s Progress for Repeated Findings: Management failed to implement adequate controls to resolve the finding from the prior years. Questioned costs: Unknown Context: During our testing, we noted the following exceptions: ? Assistance Listing 97.036 o The Department did not complete the recipient share section of the federal financial reports for four of four quarters. o The Department prepares quarterly a cumulative federal financial report for the program as well as federal financial reports for each grant. 12 of the 36 quarterly grant federal financial reports did not reconcile to the PA Disaster Recon provided to us. Context (Continued): ? Assistance Listing 97.036 (Continued) o We were not provided with 1 of the 1 final federal financial report. o The Department did not submit 4 of the 4 quarterly progress reports timely. ? Assistance Listing 97.039 o The Department prepares quarterly a cumulative federal financial report for the program as well as federal financial reports for each grant. 3 of the 19 quarterly grant federal financial reports did not reconcile to the HM Disaster Recon provided to us. o The Department did not complete the recipient share section of the federal financial reports for 18 of the 19 quarterly grant federal financial reports. o 1 of the 19 quarterly federal financial reports was not signed. o We were not provided with 1 of the 19 quarterly federal financial reports. ? Assistance Listing 97.042 o For 1 of the 1 final federal financial report, we were unable to agree the amount reported as federal share of expenditures and the EMPG Recon provided to us to the general ledger. o We were not provided with 2 of the 4 quarterly federal financial reports. o The Department did not complete the recipient share section for 2 of the 3 federal financial reports. ? Assistance Listing 97.067 o For 3 of the 4 quarterly and 1 of the 1 final federal financial reports, we were unable to agree the amount reported as federal share of expenditures to the general ledger. o For 1 of the 4 quarterly federal financial reports, we noted the total federal funds authorized reported by the Department did not agree to the award amount. o For 1 of the 5 federal financial reports, the report was not signed. o We were not provided with 2 of the 5 Performance Progress Reports (PPRs). o For 2 of the 5 PPRs, no submission date was provided to us. As such, we were unable to test for timely submission. o For 3 of the 5 Biannual Strategy Implementation Reports (BSIRs), no submission date was provided to us. As such, we were unable to test for timely submission. Also, no evidence of Department review and approval of reports prior to submission. o For 2 of the 5 BSIRs, we were provided with the incorrect reporting period end reports. As such, we were unable to test for timely submission. ? All Assistance Listings o The Department is not reporting the action in FSRS no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. The Department is entering the action in FSRS, but is not submitting the action in FSRS until the Department closes the grant. Cause: The Department lacks established internal controls and procedures over financial grant management to ensure submitted reports are complete, agree to supporting spreadsheets, submitted timely, and properly maintained in the files of the Department. Effect: The auditor noted instances of noncompliance. Noncompliance results in delayed reimbursement of eligible federal expenditures. Potential loss of federal funding. Repeat finding: The finding is a repeat of a finding in the immediately prior years. Prior year finding numbers are 2020-011 and 2019-013. Recommendation: We recommend the Department review the instructions for completion of the federal financial reports with training provided to the program staff preparing and reviewing the federal financial reports to ensure submitted reports are complete and timely. We recommend the Department implement effective processes and procedures to maintain the submitted reports and the documentation used to prepare the reports in the files of the Department. Specific to special reports for FFATA, we recommend the Department provide training on the requirements to those employees responsible for reporting the action in FSRS. Views of responsible officials: The Department understands the issues and is taking corrective action to improve reporting. This action will be managed by the Chief Financial Officer.

Federal agency: U.S. Department of Homeland Security/FEMA Federal program title and Assistance Listing Number: Emergency Management Performance Grants ? 97.042 Award Period: 10/01/2019 - 09/30/2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: 2 CFR Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Award requires compliance with the provisions of suspension and debarment. The Department should have internal controls designed to ensure compliance with this provision. Condition: We noted the Department is not in compliance with requirements related to suspension and debarment. Management?s Progress for Repeated Findings: Management failed to implement adequate controls to resolve the finding from the prior years. Questioned costs: None Context: During our testing, we noted the following exceptions: ? 3 of the 7 subaward transactions did not contain evidence of review and approval of the exclusion checks in SAM. ? 2 of the 7 subaward transactions did not have the exclusion check in SAM completed before the Department entered into the subaward transactions. ? 1 of the 7 subaward transactions was unable to be tested for completion of the exclusion check in SAM before the Department entered into the subaward transaction as we were not provided with the sub-grant agreement. ? 3 of the 7 subaward transactions was unable to be tested as no exclusion check in SAM provided to us. Entity Data Detailed Results provided to us. However, no exclusion results included in the data. ? 1 of the 7 subaward transactions was unable to be tested as no exclusion check in SAM nor sub-grant agreement provided to us. Cause: The Department lacks established internal controls and procedures over financial grant management. Management oversight. Effect: The auditor noted instances of noncompliance. Noncompliance results in possible federal funds provided to ineligible subrecipients. Repeat finding: The finding is a repeat of a finding in the immediately prior years. Prior year finding numbers are 2020-012 and 2019-014. Recommendation: We recommend the Department to implement an adequate review process to ensure the exclusion check is completed, results of the check are reviewed and approved with the approval documented, and the results of the check maintained in the sub-grantee file. Furthermore, we recommend the Department's suspension and debarment process be written into a formal procedure. Views of responsible officials: The Department will re-implement process to review suspension and debarment information prior to entering into an agreement with subrecipients. This process will also occur prior to encumbering funds as part of the Internal Purchase Request approval. We will update our policy and procedure to include updated information. The Chief Financial Officer will oversee this process.

Federal agency: U.S. Department of Homeland Security/FEMA Federal program title and Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) ? 97.036 Hazard Mitigation Grant ? 97.039 Emergency Management Performance Grants ? 97.042 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: ? Material Weakness in Internal Control over Compliance ? Material Noncompliance (Modified Opinion) Criteria or specific requirement: According to ?200.332 Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. In addition, the pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ?200.521 Management Decision. Department Policy No. GRA 418 Sub-Grant Recipient Monitoring effective June 30, 2017 establishes and implements policy and procedures for the Department staff engaged in the Department?s sub-grant recipient monitoring process. For Mitigation Sub-Grant Monitoring, the Mitigation Specialist shall review the local progress quarterly reports due to the Department. For Non-Disaster Sub-Grant Recipient Monitoring, the Program Manager shall review the local progress quarterly reports due to the Department. Specific to Pre Monitoring Requirements and Considerations, Department Program Staff shall perform risk-based assessments and apply the assessment to all of the Department?s approved sub-recipients for monitoring purposes and risk designation. Condition: During our testing, we noted the Department did not have adequate internal controls in place to ensure compliance with subrecipient monitoring. Management?s Progress for Repeated Findings: Management failed to implement adequate controls to resolve the finding from the prior years. Questioned costs: None Context: During our testing, we noted the following exceptions: ? All o The Department lacked evidence that a risk assessment was performed for subrecipients as relates to the risk of noncompliance for those subawards subject to the Uniform Guidance. o The Department lacked a process for all federal programs to review the audits of subrecipients that would allow the Department to identify any potential deficiencies that would require follow-up. o The Department lacked a process to ensure timely reporting by subgrantees of financial reporting and performance reporting. Also, the Department lacked a process to ensure timely review of reports submitted by subgrantees. ? Assistance Listing 97.036 ? Reviewed files for 19 subrecipients of which 4 subrecipients did not require reporting during the fiscal year and 3 no exceptions noted related to reporting. All other noted exceptions apply to these 7 subrecipients. ? Assistance Listing 97.039 ? Reviewed files for 6 subrecipients. For 2 of the 6 subrecipients, there was evidence of the Department performing a risk assessment. However, we noted the same monitoring procedures for these two subrecipients although 1 of the 2 subrecipients received a High Risk score. ? Assistance Listing 97.042 ? Reviewed files for 8 subrecipients. For 2 of the 8 subrecipients, we noted a CPA letter was provided by the subrecipient that exempts them from a single audit because the expenditures did not exceed the threshold of $750K. All other noted exceptions apply to these 2 subrecipients. ? Assistance Listing 97.067 ? Reviewed files for 8 subrecipients. For 3 of the 8 subrecipients, the Department met the requirement for filing of annual audit. All other noted exceptions apply to these 3 subrecipients. The samples were statistically valid samples. Cause: The program staff continue to not operate under the Sub-Grant Recipient Monitoring effective June 30, 2017. The Department continues to lack established internal controls and procedures over financial grant management to ensure compliance with applicable compliance requirements. Effect: The auditor noted instances of material noncompliance. Noncompliance results in possible federal funds provided to ineligible subrecipients. Also, the lack of internal controls over this compliance requirement provides an opportunity for noncompliance at the subrecipient level. Potential costs outside the scope of work as well as overall effective project management at the subrecipient level. Repeat finding: The finding is a repeat of a finding in the immediately prior years. Prior year finding numbers are 2020-013 and 2019-015. Recommendation: We recognize the agency has established a policy over sub-grant recipient files effective June 29, 2017. We recommend the policy begin to be enforced in fiscal year 2022. Also, we recommend any updating to the policy for implementation of effective internal controls and procedures over subrecipient monitoring and tracking that allow for compliance with all applicable federal laws, regulations, and compliance requirements of various federal grants. Views of responsible officials: Department understands this issue. Administrative Services Bureau does complete subrecipient monitoring via desktop review and uses a monitoring checklist housed in the subgrant files. The checklist form that is used was updated in 2021 and inadvertently removed the word ?monitoring? from the form and has since been corrected and updated. We will update policies and procedures to include this information. The Cabinet Secretary or designee will coordinate an agency wide improvement process.

Federal agency: U.S. Department of Homeland Security/FEMA Federal program title and Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) ? 97.036 Emergency Management Performance Grants ? 97.042 Award Period: PA4152 and 10/01/2019 - 09/30/2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: According to ?200.303 Internal controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During our testing, we noted the Department did not have adequate internal controls in place to ensure compliance with matching. Questioned costs: $41,732 Context: During our testing, we noted the following exceptions: ? Assistance Listing 97.036 o For 1 of the 8 projects, we noted the Department has not made the final payment of $268,766 ($230,371 Federal, $38,395 State). Project closeout date of 8/27/2020. No final payment has been made as of 10/13/2021. ? Assistance Listing 97.042 o Expenditures of approximately $42K related to a grant management software used for matching the 2020 grant. However, the expenditure is not in the approved budget for the 2020 grant. Also, one of the matching transactions did not contain an ok to pay by program staff on the invoice. Cause: Lack of established internal controls and procedures over financial grant management to ensure timely compliance with applicable compliance requirement. Effect: Noncompliance with the applicable compliance requirement. Possibility of matching requirement not being met. Recommendation: We recommend the Department implement effective internal controls and procedures to ensure final payments are made before closing out a project. We recommend the Department implement effective internal controls and procedures to ensure costs used to match the grant are contained in the approved budget of the grant and, as such, an allowable cost of the grant. Specific to the 2020 grant, we recommend the Department submit an amendment to FEMA for its review and final determination of the expenditure as an allowable cost of the grant. Views of responsible officials: The Department is updating internal controls to ensure proper Project Worksheet closeout, which should avoid this happening in the future. FEMA confirmed that similar grant management software is used by other states in Region 6 and is an eligible expense. To resolve this issue, the Department will submit a budget adjustment request to FEMA and is committed to improving on its grant budget process. Responsibility to enforce proper project closeouts will be managed by the Cabinet Secretary and ASB.

Federal agency: U.S. Department of Homeland Security/FEMA Federal program title and Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) ? 97.036 Award Period: Various Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: Per the compliance supplement, for large projects, the state is required to make an accounting to FEMA of eligible costs. Similarly, the subrecipient must make an accounting to the state. In submitting the accounting, the entity is required to certify that reported costs were incurred in performance of eligible work, that the approved work was completed, that the project is in compliance with the provisions of the FEMA-State Agreement, all grant conditions were met, and that payments for that project were made in accordance with the applicable payment provisions. Condition: During our testing, we noted the Department did not have adequate internal controls in place to ensure compliance with special tests and provisions. Questioned costs: None Context: For 2 of 5 large completed projects totaling an approximate amount of $236K, the Department did not have the Grant Adjustment Notices (GANs). The Department revised the GAN on 9/30/2020 to contain the language to meet the project accounting requirements. The sample was statistically valid. Cause: Lack of established internal controls and procedures over financial grant management to ensure timely compliance with applicable compliance requirement. Effect: Noncompliance with the applicable compliance requirement. Repeat finding: The finding is a repeat of a finding in the immediately prior years. Prior year finding numbers are 2020-014 and 2019-025. Recommendation: We recommend the Department implement effective internal controls and procedures to ensure all activities related to project closeout are completed and documentation is obtained and maintained in the file prior to requesting project closeout from FEMA. Views of responsible officials: The Department understands the issue. The department?s Recovery Program requested the Project Worksheet be closed prematurely and all cost documentation still had not been received and approved so the state funding has not been released and a GAN has not been issued. The department will develop policy and processes to ensure Project Worksheets are reviewed by both program and administration before close.

During our testing, we noted the following exceptions: ? CFDA 97.036 o 21 disbursements in the amount of $70,838 did not identify an operating unit in the accounting records. ? CFDA 97.067 o 5 disbursements in the amount of $18,419 were incorrectly coded to the Homeland Security Grant Program. They should have been charged to the Emergency Management Performance Grants.

During our testing, we noted payroll costs charged to the grant for an employee who was on unpaid military leave. Also, we noted the Department is not maintaining adequate records to support the payroll costs charged to the grant.

During our testing, we noted the Department was not performing timely drawdowns of Federal awards.

During our testing, we noted the following exceptions: ? CFDA 97.036 o The Department made subrecipient payments totaling approximately $1,231,314 for 14 of 21 projects past 180 days from the obligation date established by FEMA. ? CFDA 97.039 o The Department did not send the FEMA Close-out Request cover letter to FEMA within 90-days after the end of the sub-grant period of performance for 3 of 8 subrecipient files reviewed.

We noted the Department is not in compliance with requirements related to the reporting of grants.

The Department did not perform the suspension and debarment check prior to entering into procurement transactions.

During our testing, we noted the Department did not have adequate internal controls in place to ensure compliance with subrecipient monitoring.

During our testing, we noted the Department did not have adequate internal controls in place to ensure compliance with special tests and provisions.

During our testing, we noted the following exceptions: ? For 4 of 48 disbursements reviewed totaling an approximate amount of $11,672, the Department?s program staff did not sign/initial and date the OK to Pay stamp evidencing review and approval of the invoice prior to the disbursement. ? For 2 of 48 disbursements reviewed totaling an approximate amount of $4,936, the Department was unable to provide the contractor?s time detail evidencing the activity charged to the grant.

During our testing, we noted the following exceptions: ? CFDA 97.039 o For 4 of 4 disbursements reviewed totaling an approximate amount of $6,630, we noted the grant hours per the time sheet did not agree to the hours allocated to the grant in SHARE. A factor in the discrepancy is the comp time charged to the grant. The Hazard Mitigation program is not performing a final review of the hours charged to the grant to ensure reasonableness according to the actual hours worked on the grant. ? CFDA 97.042 o For 7 of 34 disbursements reviewed totaling an approximate amount of $7,091, we noted the employees? percent allocation of hours charged to the grant was not consistent with the percent allocation of 50% for other employees working on the same grant. The Department was unable to provide documentation to support the allocation of payroll costs charged to the grant.

During our testing, we noted the Department was not performing timely drawdowns of Federal awards.

During our testing, we noted the Department was not meeting the applicable State share of the matching requirement.

During our testing, we noted the following: ? CFDA 97.036 ? Three instances in which the Department did not make timely requests of project time extensions. Also, we noted nine instances in which the Department made subrecipient payments past the 90 day closeout period. ? CFDA 97.039 ? Five instances in which the Department did not send the FEMA Close-out Request cover letter within 90-days after the end of the sub-grant period of performance. ? CFDA 97.042 ? One instance in which the sub-grantee invoice was not signed by the Grant Manager authorizing the payment. Also, we noted one instance in which a cost was incorrectly charged to the grant. ? CFDA 97.067 ? Two instances in which the Department did not pay an obligation within 90 days after the end date of the period of performance.

During our testing, we noted the following: ? The Department was unable to provide the required Federal financial reports. ? The Department was unable to provide supporting documentation for submitted Federal financial reports. ? The Department is not completing all the required elements of the Federal financial reports. ? The Department continues to reconcile and close grants that are well beyond the grant expiration. ? The Department is not in compliance with the Federal Funding Accountability and Transparency Act (FFATA) reporting requirements through at least fiscal year 2019.

During our testing over procurement and suspension and debarment, we noted the following: ? CFDA 97.042 ? In two instances, the Department was unable to locate the procurement files. ? CFDA 97.046 ? In one instance, the Department did not perform the suspension and debarment check prior to entering into the transaction with the subrecipient.

During our testing, we noted the Department did not have adequate internal controls in place to ensure compliance with subrecipient monitoring.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION