Since mid-March, three acts have been passed into law that provided in excess of $2 trillion in relief and support to address the COVID-19 pandemic. Now that organizations are starting to receive funding from federal agencies, recipients are working diligently to comply with terms and conditions that, in some cases, aren’t well-known or, worse yet, haven’t yet been established. While certain guidance from federal agencies is clearly lacking, history can serve as a great roadmap. Begin by assessing three things: (1) internal controls, (2) single audit triggers and considerations, and (3) compliance with best practices.
1. Are my internal controls enough?
You may find that COVID-19-related staffing changes like reduced or remote staff have required changes to your internal controls. In a rapidly changing environment, you must continually evaluate your internal control environment. We can look to the Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards, commonly called Uniform Guidance (UG), found at 2 CFR Part 200, for some guidance in this regard.
UG is a governmentwide framework for grants management and requires recipients to establish and maintain effective internal control to ensure federal awards are used in compliance with federal statutes, regulations, and terms and conditions of the award.
If your organization finds that you can maintain existing procedures and controls, assuming those controls were properly structured, you’re on easy street. If, however this “new normal” is preventing your organization from following existing procedures and controls, you’ll need to assess what’s changed.
First, take stock of your new control environment. Ask yourself what’s changed about the processes and controls in this remote working environment. After fully vetting the revised controls and processes, consider whether these changes have created additional risks that should be addressed to prevent errors, fraud, or noncompliance conditions. Consider what controls originally in place were removed or modified, and what the potential impact might be. Is proper segregation of duties still in place? Are review processes still effective? Are the right people still involved?
Your organization must understand current and potential risks when evaluating the effectiveness of your control environment. Once risks or potential risks are identified, the next step is to put appropriate controls in place to mitigate them. Since the environment is dynamic, we encourage you to regularly reevaluate and monitor compliance to assess the effectiveness of controls and take prompt action when noncompliance matters arise.
2. Do I need a single audit and, if so, what dollars are subject to audit?
A single audit is applicable to nonfederal entities such as governments, schools, and nonprofits that expend $750,000 or more in federal awards during a fiscal year. Keep in mind that federal awards come in many forms, such as grants, cost reimbursement contracts, direct appropriations, loans and loan guarantees, and federally donated goods. With increased funding, your organization must properly identify all sources of federal funding to determine the need for a single audit. Improper exclusion of federal activity could result in failing to identify the need for a single audit or improper audit work performed.
The Schedule of Expenditures of Federal Awards (SEFA) is the key to many single audit decisions. The SEFA is a supplemental schedule to the financial statements that lists the expenditures of federal awards received during the fiscal year. It’s often one of the first pieces of information auditors will request and is particularly important in confirming the need for a single audit.
One of the moment’s largest challenges is determining whether funding your organization receives is even subject to single audit, thus determining whether it should go on the SEFA or not. If you’re asking yourself this question, a good place to start is the grant agreement or related contract which, if subject to single audit, should associate an award with a specific identifying number. This is called the CFDA number, which stands for the Catalog of Federal Domestic Assistance. In addition, the grant agreement or contract may reference audit requirements under 2 CFR 200 Subpart F.
If the CFDA number isn’t provided, look to see if the agreements mention a federal program name. The program name, if provided, can be used to find out if the funding is potentially federal by searching for the name in the Assistance Listing on beta.sam.gov. If no CFDA number or program name is included in the grant agreement or contract, and there otherwise is no reference to Uniform Guidance or 2 CFR part 200, reach out to the funding or pass-through agency.
Once you’ve prepared the SEFA, a critical next step is to ensure the federal awards identified on the schedule are complete. Consider the following questions as a starting point:
- How does your organization determine whether you received federal funding during the year? Is there a process for notifying finance or accounting of federal awards?
- Who’s responsible for evaluating new funding to determine whether it’s federal and whether any compliance requirements exist?
- Who’s responsible for assessing the aggregate data in situations where there are multiple entities in the consolidated financial statements?
- Who is responsible for tracking federal awards, including clusters and R&D awards?
- Who is responsible for reviewing miscellaneous revenue to determine whether federal awards may have been overlooked?
3. Which best practices should I rely on for oversight and compliance?
Whether the grant received is federal or not, someone needs to be responsible for understanding the terms and conditions of awards. Your organization will need to allocate adequate time to develop procedures and controls to ensure grant requirements are met. Here are a few best practices to assist with compliance:
- Read all documents that accompany any funding received. To ensure compliance, you need to understand the requirements of receiving the award, including the allowability of costs. Further, understanding each federal agency’s reporting requirements is the key to establishing proper tracking mechanism. Please be careful, as there could be terms and conditions in supplemental award information, as well!
- Document decisions (including the guidance used) and track spending. If the federal agency hasn’t yet produced guidance, consider a separate tracking mechanism (like a separate GL account) so that when guidance is received, the information is readily available.
- Monitor federal agency websites often for any additional guidance. Sometimes, federal agencies will identify a contact or resource that could be valuable to your overall goal of understanding the requirements. This contact can also provide clarity regarding allowable and unallowable expenditures or eligibility concerns.
- Assume that agencies won’t duplicate assistance provided by other federal agencies. In other words, you can’t pay for the same expenditure with two different pots of money. No double dipping!
- If you use noncompetitive procurements, document your justification for noncompetitive procurement. Remember, in all cases, the costs must be reasonable.
As you adjust to our “new normal” and embark on the task of managing COVID-19 dollars, we’re here to help.
