Full text
DEPARTMENT OF THE TREASURY
OFFICE OF INSPECTOR GENERAL
Coronavirus Relief Fund
Risk Analytics Dashboard Procedures
OIG-CA-22-012
March 7, 2022
A. Coronavirus Relief Fund Overview
Title VI of the Social Security Act, as amended by Title V of Division A of
the Coronavirus Aid, Relief, and Economic Security Act1 (CARES Act)
established the Coronavirus Relief Fund (CRF) and appropriated
$150 billion for making payments to States, Tribal governments, units of
local government, the District of Columbia, and U.S. Territories. Payments
were made in accordance with requirements outlined in Title V, of which
$3 billion was reserved for payments to the District of Columbia and U.S.
Territories and $8 billion was reserved for payments to Tribal governments.
Further, no State received a payment of less than $1.25 billion. The CARES
Act assigned the Department of the Treasury (Treasury) Office of Inspector
General (OIG) with responsibility for compliance monitoring and oversight of
the receipt, disbursement, and use of CRF payments. Treasury OIG also was
assigned authority to recoup CRF proceeds in the event that it is determined
a recipient of a CRF payment failed to comply with requirements of
subsection 601(d) of the Social Security Act, as amended, (42 U.S.C.
801(d)). The Consolidated Appropriations Act, 20212 extended the covered
period for recipients of CRF payments to use proceeds from March 1, 2020
through December 31, 2021.
The CARES Act stipulates that CRF recipients shall use the funds provided
under a payment made under Title V to cover only those costs that:
(1) are necessary expenditures incurred due to the public health emergency
with respect to Coronavirus Disease 2019 (COVID-19);
(2) were not accounted for in the budget most recently approved as of
March 27, 2020; and
(3) were incurred between March 1, 2020 and December 31, 2021.
B. Prime Recipient Reporting Requirements
Beginning in September, 2020, each Prime recipient was required to report
COVID-19 related obligations and expenditures incurred during the covered
period, beginning March 1, 2020, and ending on December 31, 2021, as
outlined in the Coronavirus Relief Fund Reporting Requirements Update (OIG-
CA-20-025; July 31, 2020)3. GrantSolutions, a grant and program
1 P.L. 116-136 (March 27,2020)
2 P.L. 116-260 (December 27, 2020)
3 The original prime recipient reporting requirements are contained in Coronavirus Relief Fund
Reporting and Record Retention Requirements (OIG-CA-20-021; July 2, 2020),
https://oig.treasury.gov/sites/oig/files/2021-01/OIG-CA-20-025.pdf.
management Federal shared service provider under the U.S. Department of
Health and Human Services, developed a customized and user-friendly
reporting solution to capture the use of CRF payments.4 The GrantSolutions
portal was prepopulated with prime recipient data to include CRF payment
amount(s), date(s), recipient Dun & Bradstreet unique identification number
(DUNS number),5 and contact information.
On a quarterly basis, Treasury OIG’s CARES Act Monitoring Directorate
reviews each prime recipient’s Financial Progress Report in GrantSolutions
following the Coronavirus Relief Fund Prime Recipient Quarterly
GrantSolutions Submissions Monitoring and Review Procedures Guide (OIG-
CA-20-029R; April 19, 2021). The objective of the quarterly monitoring and
review is to monitor the progress of prime recipient reporting in the portal
and determine whether direct follow up/outreach is needed; and for certified
submissions, determine whether prime recipients’ submissions were timely
submitted in accordance with the GrantSolutions portal instructions prior to
Treasury OIG approval. Once the quarterly reviews are completed, the
Treasury OIG approved Financial Progress Report is extracted from
GrantSolutions and sent to the Pandemic Response Accountability
Committee (PRAC) for publication on its website
(www.pandemicoversight.gov) in accordance with Section 15010 of the
CARES Act.6
C. CRF Risk Analytics Dashboard Overview
Treasury OIG worked with the PRAC to develop a risk scoring model to
prioritize the risk associated with recipients of CRF payments at the prime
4 Prime recipients include all 50 States, units of local governments, the District of Columbia, U.S.
Territories, and Tribal Governments that received a direct Coronavirus Relief Fund payment from
Treasury in accordance with the CARES Act.
5
The Federal Government will stop using a DUNS number to uniquely identify entities on April 4,
2022. Entities doing business with the Federal Government will begin using a Unique Entity
Identifier (UEI) generated in the System for Award Management (SAM.gov).
6 Section 15010 of the CARES Act established the PRAC within the Council of Inspectors General
on Integrity and Efficiency to promote transparency and conduct and support oversight of
covered funds and the coronavirus response to (1) prevent and detect fraud, waste, abuse, and
mismanagement; and (2) mitigate major risks that cut across program and agency boundaries.
7
recipient and subrecipient7 levels. The risk scoring model is displayed in the
CRF Risk Analytics Dashboard that will assist Treasury OIG in identifying
which prime recipients and subrecipients are at a higher risk for fraud,
waste, abuse, and unallowable uses of CRF payments. High risk prime
recipients and prime recipients with high risk subrecipients will be elevated
for desk reviews and/or audits.
Purpose
The purpose of the CRF Risk Analytics Dashboard procedures is to aid
Treasury OIG in analyzing reporting deficiencies, data anomalies, and
unallowable uses of CRF payments from the GrantSolutions portal identified
by the (1) quarterly reviews monitoring/approval team, (2) desk review
engagement team, and/or (3) data analytics team. In addition, the CRF Risk
Analytics Dashboard procedures will be used to select higher risk prime
recipients and related subrecipients for audit or desk review. Procedures for
monitoring, reviewing, and approving prime recipient’s quarterly
GrantSolutions submissions are documented separately in the Coronavirus
Relief Fund: Prime Recipient Quarterly GrantSolutions Submissions
Monitoring and Review Procedures Guide. Procedures for desk reviews of the
prime recipient’s receipt, disbursements, and uses of CRF proceeds are
documented separately in the Coronavirus Relief Fund: Prime Recipient Desk
Review Procedures Guide (OIG-CA-21-004R; March 22, 2021).
Per the Department of the Treasury Office of Inspector General Coronavirus Relief Fund
Frequently Asked Questions Related to Reporting and Recordkeeping (Revised)(OIG-CA-20-028R;
March 2, 2021) question 3: “Treasury has provided guidance on the applicability of Single Audit
and 2 C.F.R. Part 200, Subpart F in response to question B.13 of its Coronavirus Relief Fund
Frequently Asked Questions (FAQs).6 According to Treasury’s FAQ, “the Single Audit Act and 2
C.F.R. Part 200, Subpart F regarding audit requirements apply to any non-federal entity, as
defined in 2 C.F.R. 200.69, that receives payments from the Fund in the amount of $750,000 or
more. Non-federal entities include subrecipients of payments from the Fund, including recipients
of transfers from a State, territory, local government, or tribal government that received a
payment directly from Treasury. However, sub-recipients would not include individuals and
organizations (e.g., businesses, non-profits, or educational institutions) that are beneficiaries of
an assistance program established using payments from the Fund. The Single Audit Act and 2
C.F.R. Part 200, Subpart F regarding audit requirements do not apply to beneficiaries.” While the
Treasury definition above is used for Single Audit Act purposes, Treasury OIG requires that the
prime recipient report on both a beneficiary and a sub-recipient in the GrantSolutions portal.
Since there is no separate category to capture a beneficiary’s data in the portal, the prime
recipient must report on the beneficiary in the sub-recipient data fields. As such, for
GrantSolutions reporting, a subrecipient/beneficiary is any entity to which a prime recipient issues
a contract, grant, loan, direct payment, or transfer to another government entity of $50,000 or
more.”
D. CRF Risk Analytics Dashboard Procedures
The following procedures will be used by Treasury OIG to prioritize the risk
associated with entities receiving CRF funds at the prime and subrecipient
level. These procedures are to be used at the discretion of the reviewer and
do not exclude other reviews and analysis of prime recipient data as deemed
appropriate.
CARES Act : CRF Risk Analytics Dashboard Procedures
Objective: To identify which prime recipients should be selected for desk
review and/or audit based on their risk scores and other known factors such
as complaints received or congressional interest.
Pre-Assessment of Prime Recipients
1. Access the Risk Score page on the CRF Risk Analytics BI Dashboard.
The Risk Score page provides summary level data for prime and
subrecipients to include the PRAC entity ID, entity name, recipient
type, risk scores, and expenditures. It also includes functionality to
sort, filter, and export data for additional analysis outside of the
Dashboard.
2. On the Risk Score page, filter the “Prime or Sub” category to display
prime recipients only by selecting the “Prime Recipient” and “Prime
Type” options.
3. Analyze prime recipient data to identify prime recipients to be selected
for desk review and/or audit. Data analysis may be performed within
the Risk Score page. Alternatively, the data may be exported to
Microsoft Excel for analysis by selecting “More Options”, the three dots
icon located at the top right, and then selecting “Export data”.
a. Coordinate with the CARES Act Monitoring Directorate Audit
Director or Audit Manager to determine which prime recipients
have desk reviews and/or audits in progress/completed. Prime
recipients previously selected for a desk review and/or audit
should be removed from the population.
4. The Risk Score page also identifies four risk scores that may be
considered when prioritizing prime recipients for a desk review and/or
audit.
a. The risk composite score is the overall risk associated with prime
recipients. The risk composite score includes the:
i. Risk Indicator Score which determines how risk-prone an
entity is. Twenty-seven risk metrics were consolidated into
18 risk indicators, weighted by risk level, and used to
calculate the Risk Indicator Score;
ii. Sub Propagation Score which determines how risk-prone a
prime’s subrecipients are; and
iii. Risk Amount Score which determines how much money is
associated with an entity.
While the Composite Risk Score provides an overall gauge of risk,
consider the impact of all risk scores along with the below risk
metrics/indicators and other reviews and analyses when determining
priority of prime recipients for a desk review and/or audit.
Priority of Prime Recipients Selected for Desk Review and/or Audit
5. A desk review and/or audit will be performed on the following prime
recipients with priority based on the risk composite score and other
known factors including:
a. All prime recipients whose risk indicator score is 100;
b. All prime recipients who reported all of their obligation and
expenditure data in the aggregate in the GrantSolutions portal;
c. All 50 states;
d. All territories;
e. Select local units of government whose risk composite score is
at least 70 percent;
f. Select tribal governments whose risk composite score is at least
70 percent.
g. Select prime recipients as a result of a CRF complaint; and
h. Select prime recipients as a result of Congressional interest.
Assessment of Selected Prime Recipient
6. Drill through the selected prime recipient’s transaction page to analyze
detailed information about the recipient related to the following:
a. Subrecipient count
b. Transaction count
c. Transaction amount
d. Expenditure Amounts
e. Expenditure Categories
f. Prime to Subrecipient transaction
7. Select the Entity Risk Summary tab to drill through risk indicators
associated with the selected prime recipient including the following:
a. The subrecipient’s name
b. Amount of CRF awarded
c. Risk scores associated with the prime
d. Entity address information
e. Risk flags triggered
Assessment of Selected Prime Recipient Risk Indicator Flags
8. Individual risk details for risk flags may be analyzed by right clicking on
the entity’s name on the Risk Score page and selecting the ‘Options’
drop down then “Drill Through” and “Entity Risk Summary”. Pay close
attention to the available options in the “Drill Through” menu and select
the corresponding risk details pages for more information. Risk flags are
summarized and explained below.
9. If Risk Indicator 1a, 1b, 1c, and/or 1d: Single Audit is populated, then
the prime is matched to the Single Audit database from the Federal
Audit Clearinghouse to identify prime recipients that were associated
with any of following 4 issues within the past 3 years:
a. Going Concern (1a)
b. Material Weakness (1b)
c. Reportable Condition (1c)
d. Material Non Compliance (1d)
The engagement team should review the single audit reports for internal
control or other deficiencies that may pose risk or impact the prime
recipient’s uses of CRF proceeds.
10. If Risk Indicator 2a, 2b - SAM Sensitive File is populated, prime and/or
subrecipients matched the SAM Sensitive File (containing sensitive data
elements that are not available in the public file) to identify entities that
were associated with the following 2 issues:
a. Federal Delinquent Debt flag (2a)
b. Shared Bank Accounts (2b)
The SAM Sensitive File includes data collected from prospective Federal
awardees required for conducting business with the Government,
annual representations and certifications, and identification of those
parties excluded from receiving Federal contracts.
11. If Risk Indicator 3 –SAM Debarments is populated, the prime and/or
subrecipients matched to the publicly available SAM exclusions
dataset. Both suspension and debarment data is displayed where there
was a match on DUNS (not utilizing the DUNS connector table in this
iteration) or Name/State.
The engagement team should determine if the prime recipient awarded
contracts to subrecipients who are suspended and/or debarred from
doing business with the Government for a specified period of time. If
selected for a desk review of audit, the engagement team should
assess the prime’s efforts to provide oversight of the subrecipient’s use
of CRF proceeds.
12. If Risk Indicator 4 - FAPIIS Terminations is populated, prime and/or
subrecipients matched to the Federal Awardee Performance and
Integrity Information System (FAPIIS) that contains Federal contractor
criminal, civil, and administrative proceedings in connection with
Federal awards; suspensions and debarments; administrative
agreements issued in lieu of suspension or debarment; non-
responsibility determinations; contract terminations for cause or
default; and defective pricing determinations. If selected for a desk
review of audit, the engagement team should assess the prime’s efforts
to provide oversight of the subrecipient’s use of CRF proceeds.
13. If Risk Indicator 5 – Treasury OIG Hotline is populated, the prime and/or
subrecipients matched to the Treasury OIG Hotline data for hotline
complaints. The engagement team should coordinate with the Office of
Investigation and the CARES Act II audit director for results of any
investigations and/or inquiries performed on the prime recipient.
14. If Risk Indicator 6a, 6b – IRS Form 990 is populated, the prime and/or
subrecipients matched to the Internal Revenue Service Form 990
dataset to identify entities that were associated with the following 2
issues:
a. Significant Diversion of Assets (6a)
b. Excess Benefit Transactions (6b)
A diversion of assets includes any unauthorized conversion or use of
the organization's assets other than for the organization's authorized
purposes, including but not limited to embezzlement or theft. Excess
benefit generally means the excess of the economic benefit received
from the applicable organization over the consideration given (including
services) by a disqualified person.
15. If Risk Indicator 7 - SBIR/STTR is populated, the prime and/or
subrecipient matched to the Small Business Innovation Research (SBIR)
and Small Business Technology Transfer (STTR) programs to identify
entities that received SBIR/STTR funding.
16. If Risk Indicator 8 - Multi-Dipping is populated, the prime and/or
subrecipient is matched to the COVID-19/pandemic programs extract
on USAspending.gov.
17. If Risk Indicator 9 - Circular Relationships is populated, prime and
subrecipient pairs where one entity serves as the other entity's prime
recipient in some transactions, and in other transactions, the same
entity was the subrecipient to the other entity is identified.
18. If Risk Indicator 10a, 10b - CMRA/PO Box Address is populated, the
addresses for all prime and subrecipients were analyzed to identify the
following 2 conditions:
a. CMRA Address Match (10a) - Identify CRF entities whose
addresses match with the Commercial Mail Receiving Agency
(CMRA) private mailbox data set. CMRA is a private business
that accepts mail from the Postal Service on behalf of third
parties. A CMRA may also be known as a mail drop (e.g.,
mailboxes at a UPS store).
b. PO Box Address (10b) – Identifies CRF entities with a PO Box
address.
19. If Risk Indicator 11 – Benford’s Law is populated, prime recipients
whose transactions differed significantly from what was expected were
flagged. Benford's Law describes the expected distribution of leading
digits in many naturally occurring sets of numbers such as financial
records. An entity is flagged if the total deviance score surpasses the
defined threshold score of 20.090, which represents the chi-squared
distribution cut point for .01 with 8 degrees of freedom.
20. If Risk Indicator 12 – Duplicate Payments is populated, transactions
were identified as duplicate if they were disbursed from the same prime
to the same subrecipient for the same expenditure category on the
same start date and for the same amount after excluding reversal pairs.
21.If Risk Indicator 13 – Round Dollar Payments is populated, transactions
were identified that do not report exact cents. In this case, the risk is
attributed to the subrecipient for not reporting exact expenditure
details.
22. If Risk Indicator 14 – Statistical Modeling is populated, transactions
were identified as high relative to transactions at similar time points,
similar award descriptions, and that were disbursed by the same prime
recipient. Factors are accounted for simultaneously using a statistical
(mixed effects) model with a threshold of 3 standard deviations.
23. If Risk Indicator 15 – Duplicate Address is populated, subrecipients that
share the same full address are identified. This output also includes
subrecipients that share the same PO Box.
24.If Risk Indicator 16a, 16b, 16c, 16d: Expenditures are populated, the
following applies:
a. Aggregate subrecipient expenditure percentage analysis (16a)
identifies top 10% of prime recipients when ranked in terms of
percent of award or obligated or expended that is disbursed to
aggregate recipients and when ranked in terms of magnitude of
award that is disbursed to aggregate recipients
b. Individual subrecipient expenditure percentage analysis (16b)
identifies top 10% of prime recipients when ranked in terms of
percent of award or obligated or expended that is disbursed to
individual recipients and when ranked in terms of magnitude of
award that is disbursed to individual recipients
c. Small business assistance expenditure (16c) – identifies top 10%
of prime recipients when ranked in terms of percent of award or
obligated or expended that is disbursed to subrecipients for
“small business assistance” expenditure category and when
ranked in terms of magnitude of award that is disbursed for the
“small business assistance” expenditure category
d. "Items not listed above" expenditure ratio (16d) – identifies top
10% of prime recipients when ranked in terms of percent of
award or obligated or expended that is disbursed to subrecipients
for “Items Not Listed Above” expenditure category and when
ranked in terms of magnitude of award that is disbursed for the
“Items Not Listed Above” expenditure category
25.If Risk Indicator 17 - Foreign Address is populated, prime and/or
subrecipients were identified where the country is not the "US". Three
country code fields were used:
a. Sub-country code
b. Primary place of performance country code
c. Recipient country code
26. If Risk Indicator 18 - Vague Language is populated, subrecipients with
expenditure category of “Item Not Listed Above” and the description
contains one or more of keywords:
a. miscellaneous, various, n/a, null, payroll,
b. hazard pay, tourism, construction, renovations, infrastructure,
c. patrol, security, vehicle, truck, FEMA, acquisitions, financial
assistance