CITY OF OXFORD

Allowable Costs/Activities Allowed Material Weakness, Noncompliance 2024-002 Strengthen Controls to Ensure Compliance with Allowable Costs Requirements Agency: U.S. Department of Transportation; Passed-through Mississippi Office of Highway Safety ALN Numbers: 20.600 State and Community Highway Safety 20.616 National Priority Safety Programs Federal Award: M5TR-2024-MD-22-51 Repeat Finding: No Questioned Costs: $1,432.84 Criteria: In accordance with 2 CFR 200.403, costs charged to a federal award must be necessary, reasonable, and allocable. Further, per 2 CFR 200.303, the non-federal entity must establish and maintain effective internal controls over the federal award. Condition: During our evaluation and testing of the grant, we were alerted to improper payments totaling $1,432 made to employees as the result of misrepresentation of reimbursable expenses. The payments were processed and disbursed; however, internal controls subsequently identified and alerted officials to the improper payments. The employees were terminated, and no additional payments were made. Cause: Fraudulent requests for employee expense reimbursement for travel were submitted and not independently verified. Although controls were in place to verify such requests, the fraud attempt bypassed initial detection. The City’s post-disbursement review controls detected the issue, but only after payment had occurred. Effect: The City disbursed $1,432 in federal funds to fraudulent reimbursements. Although no additional losses occurred and corrective actions were taken, the incident reflects a breakdown in the preventative control environment over disbursement verification. Recommendation: We recommend that the City implement additional internal controls to ensure that proper and substantiated travel reimbursement payments are made. Views of Responsible Officials: The City concurs with the finding. While our internal post-payment review control ultimately identified the issue, we acknowledge the breakdown in the preventive stage. We have since revised our procedures to require independent verification. We also reported the incident to proper agencies as required.