Institutional Federal Compliance Report 2021

STATE OF NEW YORK

Schedule of Findings and Questioned Costs

Year ended March 31, 2018

New York State Governmental Accountability, Audit and Internal Control Act of 1987 act highlighted the need for agency management to promote good internal controls and accountability in government. Article 45, Internal Control Responsibilities of State Agencies, Section 951 Executive Internal control responsibilities states the head of each state agency shall a) establish and maintain for the agency guidelines for a system of internal control that are in accordance with this article and internal control standards; b) establish and maintain for the agency a system of internal control and a program of internal control review. The program of internal control review shall be designed to identify internal control weaknesses, identify actions that are needed to correct these weaknesses, monitor the implementation of necessary corrective actions and periodically assess the adequacy of the agency’s ongoing internal control; c) make available to each officer and employee of the agency a clear and concise statement of the generally applicable management policies and standards with which the officer or employee of such agency shall be expected to comply. Such statement shall emphasize the importance of effective internal control to the agency and the responsibility of each officer and employee for effective internal control; d) designate an internal control officer, who shall report to the head of the agency, to implement and review the internal control responsibilities established pursuant to this section; e) implement education and training efforts to ensure that officers and employees within such agency have achieved adequate awareness and understanding of internal control standards and, as appropriate, evaluation techniques; and f) periodically evaluate the need for an internal audit function. Condition The Department of Health (the Department) did not maintain records of subrecipient monitoring activities and internal controls over subrecipient monitoring at a level of precision necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Additionally, the Department did not provide documentation supporting that risk assessment policies and procedures, established within the fiscal year, were in place, performed, and formally documented. During the fiscal year ended March 31, 2018, the Department passed through approximately $20,146,000 of federal funding to subrecipients through the Maternal and Child Health Services Block Grant to the States federal program (CFDA number 93.994). For 12 of the 23 subrecipients selected for testwork, management’s subrecipient monitoring was not at an appropriate level of detail. Additionally, evidence could not be provided to support management performance of the subrecipient monitoring policies, procedures and internal controls. Additionally, while the Department has policies and procedures regarding the risk assessment process to develop monitoring activities to be performed based on the level of assess risk, documentation evidencing the completion of the risk assessment and required monitoring activities performed were not provided. Cause The cause of the condition found was primarily due to the Department not maintaining records of its subrecipient monitoring activities inclusive of risk assessment procedures performed during the current fiscal year.

117

(Continued)