Financial Manual for Grants & Contracts Appendix I: Internal Control Matrix

The OMB Circular A-133 Compliance Supplement, Part 6, provides auditees and auditors with guidance to obtain an understanding of and evaluate the adequacy of internal control.  These characteristics are described for 13 of the 14 types of compliance requirements identified in Part 3 of the Compliance Supplement (See Chapter 2 for additional detail).  In using the following characteristics Part 6 of the Supplement provides:

"This Part 6 is intended to assist non-federal entities and their auditors in complying with these [testing requirements of OMB Circular A-133] by describing, for each type of compliance requirement, the objectives of internal control, and certain characteristics of internal controls that, when present and operating effectively, may ensure compliance with program requirements.  However, the categorizations reflected in this Part 6 may not necessarily reflect how an entity considers and implements internal control [i.e., depending on the organization’s structure, functions, etc.].  Also, this part is not a checklist of required internal control characteristics.  Non-federal entities could have adequate internal control even though some or all of the characteristics included in Part 6 are not present.  Further, non-federal entities could have other appropriate internal controls operating effectively that have not been included in this Part 6.  Non-federal entities and their auditors will need to exercise judgment in determining the most cost effective internal control in a given environment or circumstance to provide reasonable assurance for compliance with federal [or state] program requirements."

The characteristics in Part 6 of the OMB Circular A-133 Compliance Supplement are carried into the Financial Manual for Grants and Contracts in this Appendix for the purpose of providing Contractors and monitors with guidelines for evaluating internal control. This Appendix organizes the 13 types of compliance requirements for which characteristics of internal control are discussed as shown below, retaining the same format as used in the Compliance Supplement.

Control Objectives – To provide reasonable assurance that the draw down of federal cash is only for immediate needs and recipients limit payments to subrecipients to immediate cash needs.

Control Environment

• Appropriate assignment of responsibility for approval of cash drawdowns and payments to subrecipients
• Budgets for drawdowns are consistent with realistic cash needs

Risk Assessment

• Mechanisms exist to anticipate, identify, and react to routine events that affect cash needs
• Routine assessment of adequacy of subrecipient cash needs
• Management has identified programs that receive cash advances and is aware of cash management requirements

Control Activities

• Cash flow statements by program are prepared to determine essential cash flow needs
• Accounting system is capable of scheduling payments for accounts payable and requests for funds from Treasury to avoid time lapse between draw down of funds and actual disbursements of funds
• Appropriate level of supervisory review of cash management activities
• Written policy that provides:
  • Procedures for requesting cash advances as close as is administratively possible to actual cash outlays
  • Monitoring of cash management activities
  • Repayment of excess interest earnings where required

Information & Communication

• Variance reporting of expected versus actual cash disbursements of federal awards and drawdowns of federal funds
• Established channel of communication between pass-through entity and subrecipients regarding cash needs

Monitoring

• Periodic independent evaluation (e.g. by internal audit, top management) of entity cash management, budget and actual results, repayment of excess interest earnings, and federal draw down activities
• Subrecipients’ requests for federal funds are evaluated
• Review of compliance with Treasury-State agreements

Control Objectives – To provide reasonable assurance that only eligible individuals and organizations receive assistance under federal award programs, that subawards are made only to eligible subrecipients, and that amounts provided to or on behalf of eligibles were calculated in accordance with program requirements.

Control Environment

• Staff size and competence provides for proper making of eligibility determinations
• Realistic caseload/performance targets established for eligibility determinations
• Lines of authority clear for determining eligibility

Risk Assessment

• Identification of risk that eligibility information prepared internally or received from external sources could be incorrect
• Conflict-of-interest statements are maintained for individuals who determine eligibility
• Process for assessing risks resulting from changes to eligibility determination systems

Control Activities

• Written policies provide direction for making and documenting eligibility determinations
• Procedures to calculate eligibility amounts consistent with program requirements
• Eligibility objectives and procedures clearly communicated to employees
• Authorized signatures (manual or electronic) on eligibility documents periodically reviewed
• Access to eligibility records limited to appropriate persons
• Manual criteria checklists or automated process used in making eligibility determinations
• Process for periodic eligibility re-determinations in accordance with program requirements
• Verification of accuracy of information used in eligibility determinations
• Procedures to ensure the accuracy and completeness of data used to determine eligibility requirements

Information & Communication

• Information system meets needs of eligibility decision-makers and program management
• Processing of eligibility information subject to edit checks and balancing procedures
• Training programs inform employees of eligibility requirements
• Channels of communication exist for people to report suspected eligibility improprieties
• Management receptive to suggestions to strengthen eligibility determination process
• Documentation of eligibility determinations in accordance with program requirements

Monitoring

• Periodic analytical reviews of eligibility determinations performed by management
• Program quality control procedures performed
• Periodic audits of detailed transactions

Control Objectives – To provide reasonable assurance that matching, level of effort, or earmarking requirements are met using only allowable funds or costs which are properly calculated and valued.

Control Environment

• Commitment from management to meet matching, level of effort, and earmarking requirements (e.g., adequate budget resources to meet a specified matching requirement or maintain a required level of effort)
• Budgeting process addresses/provides adequate resources to meet matching, level of effort, or earmarking goals
• Official written policy exists outlining:
  • Responsibilities for determining required amounts or limits for matching, level of effort, or earmarking
  • Methods of valuing matching requirements, e.g., “in-kind” contributions of property and services, calculations of levels of effort
  • Allowable costs that may be claimed for matching, level of effort, or earmarking
  • Methods of accounting for and documenting amounts used to calculate amounts claimed for matching, level of effort, or earmarking

Risk Assessment

• Identification of areas where estimated values will be used for matching, level of effort, or earmarking
• Management has sufficient understanding of the accounting system to identify potential recording problems

Control Activities

• Evidence obtained such as a certification from the donor, or other procedures performed to identify whether matching contributions:
  • Are from non-federal sources
  • Involve federal funding, directly or indirectly
  • Were used for another federally-assisted program
  • Note: Generally, matching contributions must be from a non-federal source and may not involve federal funding or be used for another federally assisted program
• Adequate review of monthly cost reports and adjusting entries

Information & Communication

• Accounting system capable of:
  • Separately accounting for data used to support matching, level of effort, or earmarking amounts or limits or calculations
  • Ensuring that expenditures or expenses, refunds, and cash receipts or revenues are properly classified and recorded only once as to their effect on matching, level of effort, or earmarking
  • Documenting the value of “in-kind” contributions of property or services, including:
    • Basis for local labor market rates for valuing volunteer services
    • Payroll records or confirmation from other organizations for services provided by their employees
    • Quotes, published prices, or independent appraisals used as the basis for donated equipment, supplies, land, buildings, or use of space

Monitoring

• Supervisory review of matching, level of effort, or earmarking activities performed to assess the accuracy and allowability of transactions and determinations, e.g., at the time reports on federal awards are prepared

Note: Refer also to B.3 Internal Controls in the FMGC Supplement on Procurement in Appendix D to this manual, for additional discussion about internal controls within the context of purchasing and procurement.

Control Objectives – To provide reasonable assurance that procurement of goods and services are made in compliance with the provisions of the A-102 Common Rule or OMB Circular A-110, as applicable, and that covered transactions (as defined in the suspension and debarment common rule) are not made with a debarred or suspended party.

Control Environment

• Existence and implementation of codes of conduct and other policies regarding acceptable practice, conflicts-of-interest, or expected standards of ethical and moral behavior for making procurements
• Procurement manual that incorporated federal requirements
• Absence of pressure to meet unrealistic procurement performance targets
• Management’s prohibition against intervention or overriding established procurement controls
• Board or governing body oversight required for high dollar, lengthy, or other sensitive procurement contracts
• Adequate knowledge and experience of key procurement managers in light of responsibilities for procurements for federal awards
• Clear assignment of authority for issuing purchasing orders and contracting for goods and services

Risk Assessment

• Procedures to identify risks arising from vendor inadequacy, e.g., quality of goods and services, delivery schedules, warranty assurances, user support
• Procedures established to identify risks arising from conflicts-of-interest, e.g., kickbacks, related party transactions, bribery
• Management understands the requirements for procurement and suspension and debarment, and, given the organization’s staff, departments, and processes, has identified where noncompliance could likely occur
• Conflict-of-interest statements are maintained for individuals with responsibility for procurement of goods or services

Control Activities

• Job descriptions or other means of defining tasks that comprise particular procurement jobs
• Contractor’s performance with the terms, conditions, and specifications of the contract is monitored and documented
• Establish segregation of duties between employees responsible for contracting and accounts payable and cash disbursing
• Procurement actions appropriately documented in the procurement files
• Supervisors review procurement and contracting decisions for compliance with federal procurement policies
• Procedures established to verify that vendors providing goods and services under the award have not been suspended or debarred by the federal government
• Official written policy for procurement and contracts establishing:
  • Contract files that document significant procurement history
  • Methods of procurement, authorized including selection of contract type, contractor selection or rejection, and the basis of contract price
  • Verification that procurements provide full and open competition
  • Requirements for cost or price analysis, including for contract modifications
  • Obtaining and reacting to suspension and debarment certifications
  • Other applicable requirements for procurements under federal awards are followed
• Official written policy for suspension and debarment that:
  • Contains or references the federal requirements
  • Prohibits the award of a subaward, covered contract, or any other covered agreement for program administration, goods, services, or any other program purpose with any suspended or debarred party
  • Before November 26, 2003, requires staff to obtain certifications from entities receiving subawards of any value and procurement contracts equal to or exceeding $100,000, certifying that the organization and its principals are not suspended or debarred.  As of November 26, 2003, requires staff to determine that entities receiving subawards of any value and procurement contracts equal to or exceeding $25,000 and their principals are not suspended or debarred, and specifies the means that will be used to make that determination, i.e., checking the Excluded Parties Listing System (EPLS), which is maintained by the General Services Administration; obtaining a certification; or inserting a clause in the agreement.

Information & Communication

• A system in place to assure that procurement documentation is retained for the time period required by the A-102 Common Rule, OMB Circular A-110, award agreements, contracts, and program regulations. Documentation includes:
  • The basis for contractor selection
  • Justification for lack of competition when competitive bids or offers are not obtained
  • The basis for award cost or price
• Employees’ procurement duties and control responsibilities are effectively communicated
• Procurement staff are provided a current hard-copy EPLS or have on-line access
• Channels of communication are provided for people to report suspected procurement and contracting improprieties

Monitoring

• Management periodically conducts independent reviews of procurements and contracting activities to determine whether policies and procedures are being followed as intended

Control Objectives – To provide reasonable assurance of compliance with the real property acquisition, appraisal, negotiation, and relocation requirements.

Control Environment

• Management committed to ensuring compliance with the Uniform Relocation Assistance and Real Property Acquisition Policies Act of 1970, as amended (URA)
• Written policies exist for handling relocation assistance and real property acquisition

Risk Assessment

• Identification of risk that relocation will not be conducted in accordance with the URA, e.g., improper payments will be made to individuals or businesses that relocate

Control Activities

• Employees handling relocation assistance and real property acquisition have been trained in the requirements of the URA
• Review of expenditures pertaining to real property acquisition and relocation assistance by employees knowledgeable in the URA

Information & Communication

• A system is in place to adequately document relocation assistance and real property acquisition

Monitoring

• Management monitors relocation assistance and real property acquisition for compliance with the URA

Control Objectives – To provide reasonable assurance that federal award information and compliance requirements are identified to subrecipients, subrecipient activities are monitored, subrecipient audit findings are resolved, and the impact of any subrecipient noncompliance on the pass-through entity is evaluated. Also, the pass-through entity should perform procedures to provide reasonable assurance that the subrecipient obtained required audits and takes appropriate corrective action on audit findings.

Control Environment

• Establishment of “tone at the top” of management’s commitment to monitoring subrecipients
• Management’s intolerance of overriding established procedures to monitor subrecipients
• Entity’s organizational structure and its ability to provide the necessary information flow to monitor subrecipients are adequate
• Sufficient resources dedicated to subrecipient monitoring
• Knowledge, skills, and abilities needed to accomplish subrecipient monitoring tasks defined
• Individuals performing subrecipient monitoring possess knowledge, skills, and abilities required
• Subrecipients demonstrate that:
  • They are willing and able to comply with the requirements of the award
  • They have accounting systems, including the use of applicable cost principles, and internal control systems adequate to administer the award
  • Appropriate sanctions taken for subrecipient noncompliance

Risk Assessment

• Key managers understand the subrecipient’s environment, systems, and controls sufficient to identify the level and methods of monitoring required
• Mechanisms exist to identify risks arising from external sources affecting subrecipients, such as risks related to:
  • Economic conditions
  • Political conditions
  • Regulatory changes
  • Unreliable information
• Mechanisms exist to identify and react to changes in subrecipients, such as:
  • Financial problems that could lead to diversion of grant funds
  • Loss of essential personnel
  • Loss of license or accreditation to operate program
  • Rapid growth
  • New activities, products, or services
  • Organizational restructuring

Control Activities

• Identify to subrecipients the federal award information (e.g., CFDA title and number, award name, name of federal agency, amount of award) and applicable compliance requirements
• Include in agreements with subrecipients the requirement to comply with the compliance requirements applicable to the federal program, including the audit requirements of OMB Circular A-133
• Subrecipients’ compliance with audit requirements monitored using techniques such as the following:
  • Determining by inquiry and discussions whether subrecipient met thresholds requiring an audit under OMB Circular A-133
  • If an audit is required, assuring that the subrecipient submits the report, report package or the documents required by OMB circulars and/or recipient’s requirements
  • If a subrecipient was required to obtain an audit in accordance with OMB Circular A-133 but did not do so, following up with the subrecipient until the audit is completed. Taking appropriate actions such as withholding further funding until the subrecipient meets the audit requirements.
• Subrecipient’s compliance with federal program requirements monitored using such techniques as the following:
  • Issuing timely management decisions for audit and monitoring findings to inform the subrecipient whether the corrective action planned is acceptable
  • Maintain a system to track and following-up on reported deficiencies related to programs funded by the recipient and ensure that timely corrective action is taken
  • Regular contacts with subrecipients and appropriate inquiries concerning the federal program
  • Reviewing subrecipient reports and following-up on areas of concern
  • Monitoring subrecipient budgets
  • Performing site visits to subrecipient to review financial and programmatic records and observe operations
  • Offering subrecipients technical assistance where needed
• Official written policies and procedures exist establishing:
  • Communication of federal award requirements to subrecipients
  • Responsibilities for monitoring subrecipients
  • Process and procedures for monitoring
  • Methodology for resolving findings of subrecipient noncompliance or weaknesses in internal control
  • Requirements for and processing of subrecipient audits, including appropriate adjustment of pass-through entity’s accounts

Information & Communication

• Standard award documents used by the non-federal entity contain:
  • A listing of federal requirements that the subrecipient must follow. Items can be specifically listed in the award document, attached as an exhibit to the document, or incorporated by reference to specific criteria.
  • The description and program number for each program as stated in the CFDA. If the program funds include pass-through funds from another recipient, the pass-through program information should also be identified.
  • A statement signed by an official of the subrecipient, stating that the subrecipient was informed of, understands, and agrees to comply with the applicable compliance requirements.
• A recordkeeping system is in place to assure that documentation is retained for the time period required by the recipient
• Procedures are in place to provide channels for subrecipients to communicate concerns to the pass-through entity

Monitoring

• Establish a tracking system to assure timely submission of required reporting, such as: financial reports, performance reports, audit reports, onsite monitoring reviews of subrecipients, and timely resolution of audit findings
• Supervisory reviews performed to determine the adequacy of subrecipient monitoring