Risk Assessment of Executive Branch Internal Controls for Federal Pandemic Relief Funds (November 14, 2022)

Summary

A November 14, 2022 memorandum from Stephen E. Cummings, Secretary of Finance, to Governor Glenn Youngkin and the chairs of the House Appropriations and Senate Finance and Appropriations Committees, submitting the Report of the Risk Assessment of Executive Branch Agency Internal Controls for Administering and Disbursing Federal Pandemic Relief Funds. It states that under Item 257.B, the initial risk assessment was limited in scope to the Coronavirus Relief Funds and the State and Local Fiscal Recovery Funds, and that the review indicates adequate internal controls. The executive summary says the Department of Accounts, with a third party, conducted the assessment in October 2022. It then lists potential gaps, including inconsistent subrecipient monitoring.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Cite this document

“Risk Assessment of Executive Branch Internal Controls for Federal Pandemic Relief Funds (November 14, 2022).” Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2022-rd670-e6a78dfd57/, SHA-256 57a6de140836c1431401f83af7546053dad0f18fba14762a5435b83078bd91b2.

Full text

COMMONWEALTH of VIRGINIA
Stephen E. Cummings P.O. Box 1475
Secretary of Finance Richmond, Virginia 23218

November 14, 2022

MEMORANDUM

TO: The Honorable Glenn Youngkin, Governor of Virginia
The Honorable Barry D. Knight, Chair, House Appropriations Committee
The Honorable Janet D. Howell, Co-Chair, Senate Finance and Appropriations
Committee
The Honorable George L. Barker, Co-Chair, Senate Finance and Appropriations
Committee
FROM: Stephen E. Cummings

SUBJECT: Report of the Risk Assessment of Executive Branch Agency Internal Controls for
Administering and Disbursing Federal Pandemic Relief Funds

Pursuant to Item 257.B, Chapter 2, 2022 Virginia Acts of Assembly Special Session I, I am
submitting the risk assessment for executive branch agencies receiving federal pandemic funding.
This initial risk assessment was limited in scope to the Coronavirus Relief Funds (CRF) from the
Coronavirus Aid, Relief, and Economic Security Act (CARES Act), and the State and Local Fiscal
Recovery Funds (SLFRF) from the American Rescue Plan Act (ARPA).

This high level review indicates that the Commonwealth has developed and implemented adequate
internal controls over the appropriate use and reporting of federal funds. While this provides a
sound basis for managing federal assets and ensuring compliance with federal regulations, the risk
assessment also identifies potential opportunities for improvement. Such opportunities pertain to
expanding the Agency Risk Management Internal Control Standards (ARMICS) assessment
process, and we have developed a plan with the Department of Accounts to make the appropriate
modifications. I look forward to working with you to strengthen the internal control structure over
all Commonwealth financial assets.

Please let me know if you have any questions.
Report of the Risk Assessment of Executive Branch Agency
Internal Controls for Administering and Disbursing Federal
Pandemic Relief Funds

Pursuant to Item 257B, Chapter 2, 2022 Special Session I Virginia Acts of
Assembly

TO:
The Honorable Glenn Youngkin, Governor of Virginia
The Honorable Barry D. Knight, Chair
House Appropriations Committee

The Honorable Janet D. Howell, Co-Chair
Senate Finance and Appropriations Committee

The Honorable George L. Barker, Co-Chair
Senate Finance and Appropriations Committee

COMMONWEALTH OF VIRGINIA
RICHMOND
2022
Table of Contents
I. Executive Summary ......................................................................................................... 3
II. Background ...................................................................................................................... 4
III. Scope of Risk Assessment ............................................................................................... 6
IV. Assessment Results .......................................................................................................... 6
V. Risk Assessment Process ................................................................................................. 9
A. Overview of Current Internal Control Activities ........................................................... 10
B. Quantitative Risk Analysis ............................................................................................. 12
C. OMB/ARMICS Comparison .......................................................................................... 14
D. Desk Review .................................................................................................................. 17
E. Review of other states compliance practices.................................................................. 18
VI. Conclusion...................................................................................................................... 19

2
I. Executive Summary
In October 2022, the Department of Accounts (DOA), with the assistance of a third-party,
conducted a risk assessment of executive branch agency internal controls for federal funds. The
risk assessment relied upon existing data and documentation and was limited in scope to the
Coronavirus Relief Funds (CRF) from the Coronavirus Aid, Relief, and Economic Security Act
(CARES Act), and the State and Local Fiscal Recovery Funds (SLFRF) from the American
Rescue Plan Act (ARPA).1 While there are additional federal regulations for other pandemic
funding that are not applicable to the CFR and SLFRF, this risk assessment does not address all
federal compliance requirements.
Through this high-level review, the assessment concluded that executive branch agencies have
adequate internal control over federal funds. However, a lack of portfolio-level oversight and
centralized data systems leads to inherent challenges of managing and tracking the funds at a
Commonwealth-wide level. The current decentralized system makes a review of agency-level
controls difficult due to the lack of real-time visibility into agency activities.
Specific potential gaps in the Commonwealth’s current state of internal control over federal funds
are:
• Lack of real-time visibility into agency internal control activities for federal funds which
can lead to reactive responses to issues versus proactive prevention;
• Reliance on self-assessments is inherently less reliable than independent, verified reviews
of agencies’ risk management activities and give less insight into agency internal control
activities;
• Reliance on manual, self-reported data can lead to reported results that are less reliable than
verified data and reporting discrepancies can invite additional scrutiny;
• Subrecipient monitoring activities are conducted and validated inconsistently by agency
management, and an opportunity exists to more explicitly prompt agencies to review these
policies;
• Third-party provider monitoring activities are conducted and validated inconsistently by
agency management and can lead to improper distributions of funds;
• Lack of knowledge transfer and cross-training can impact agency-level control over funds
and can impact accuracy and timeliness of reporting; and
• Information technology (IT) related control activities are conducted and validated
inconsistently by agency management and can lead to breaches of sensitive information.2
The remainder of this report details the analysis performed as part of this risk assessment.

1
The CRF and SLFRF were appropriated among agencies via Item 479.10, Chapter 56, 2020 Acts of Assembly Special
Session I, Item 479.20, Chapter 1, 2022 Acts of Assembly Special Session I, and Item 486, Chapter 2, 2022 Acts of
Assembly Special Session I.
2
IT controls are relevant for federally funded projects where agencies are upgrading or implementing new systems or
when they are collecting sensitive data.

3
II. Background
The Secretary of Finance, via DOA, conducted this risk assessment as required by Item 257 B,
Chapter 2, 2022 Acts of Assembly Special Session I that states (in part):
The Secretary of Finance shall engage internal or third-party assistance to perform a risk
assessment of executive branch agency internal controls for administering and disbursing
federal pandemic relief funds, economic stimulus, or loan funds. Upon engaging internal
or third-party assistance, the Secretary of Finance shall consult with the Auditor of Public
Accounts and executive branch agencies conducting similar risk assessments or audits
regarding the scope of work performed by the Auditor of Public Accounts and such
executive branch agencies over federal funds. The Secretary of Finance shall provide
oversight over any resulting contracts and compile the findings and provide a report to the
Governor, the Chair of the House Appropriations Committee and the Chair of the Senate
Finance and Appropriations Committee by November 1 of each year.
DOA is well situated to conduct this assessment as they are responsible for reporting on two of
the largest and broadest pandemic relief funding packages, the CRF included in the CARES Act
and the SLFRF included in ARPA. Additionally, DOA oversees the Commonwealth’s Agency
Risk Management and Internal Controls Standards (ARMICS) assessment process.
Applicable Federal Guidance
Both the SLFRF and CRF funding comes with a wide variety of requirements on the use and
administration of the funding, as well as specifications under allowable and nonallowable uses. In
addition to the Uniform Administrative Requirements, Cost Principles, and Audit Requirements
for Federal Awards (2 CFR Part 200), the U.S. Department of the Treasury (U.S. Treasury) has
published specific guidance for both funds (see example of various SLFRF regulations and
guidance in Figure 1).

Figure 1: Laws and regulations governing use of SLFRF

4
For example, 2 CFR 200.303 addresses compliance in regard to internal controls for non-federal
entities receiving federal awards:
The non-Federal entity must:
(a) Establish and maintain effective internal control over the Federal award that provides
reasonable assurance that the non-Federal entity is managing the Federal award in
compliance with Federal statutes, regulations, and the terms and conditions of the Federal
award. These internal controls should be in compliance with guidance in “Standards for
Internal Control in the Federal Government” issued by the Comptroller General of the
United States or the “Internal Control Integrated Framework”, issued by the Committee
of Sponsoring Organizations of the Treadway Commission (COSO).
(b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and
conditions of the Federal awards.
(c) Evaluate and monitor the non-Federal entity's compliance with statutes, regulations
and the terms and conditions of Federal awards.
(d) Take prompt action when instances of noncompliance are identified including
noncompliance identified in audit findings.
(e) Take reasonable measures to safeguard protected personally identifiable information
and other information the Federal awarding agency or pass-through entity designates as
sensitive or the non-Federal entity considers sensitive consistent with applicable Federal,
State, local, and tribal laws regarding privacy and responsibility over confidentiality.
The Office of Management and Budget’s (OMB’s) 2022 Compliance Supplement
(whitehouse.gov) details which of the compliance requirements are subject to be reviewed upon
audit of CRF and SLFRF projects. This document specifies that agency management is generally
responsible for ensuring compliance with the following:
• Activities allowed or unallowed;
• Allowable costs/cost principles;
• Period of performance;
• Procurement, suspension, and debarment;
• Reporting; and
• Subrecipient monitoring.
U.S. Treasury’s SLFRF-Compliance-and-Reporting-Guidance.pdf (treasury.gov) provides
additional description of these areas of the Uniform Guidance that are applicable for the SLFRF
(and similarly, were applicable for CRF).
Potential Consequences of Insufficient Internal Control Over Federal Funds
As shown in Figure 2, there can be negative outcomes associated with insufficient internal control
over federal funds. These negative outcomes range from those with immediate impact like
misreporting of fund uses to U.S. Treasury, to those with short term impact like requiring resources
to implement corrective action plans due to audit findings, to longer-term impacts like negative

5
reputational impact resulting in public mistrust and reducing competitiveness for future federal
funds. Due to these risks, an assessment of internal controls is both necessary and beneficial to all
parties involved.

Figure 2:Outcomes associated with insufficient internal controls over federal funds

III. Scope of Risk Assessment
Per the appropriation language, this assessment was limited in scope
to executive branch agencies. Within the executive branch agencies,
the assessment was further refined to only CRF and SLFRF agencies
as DOA has centrally reported on these two types of funds.
Information and documents reviewed as part of this assessment
included CRF expenditures, SLFRF appropriations, SLFRF detailed
expenditure reporting data, SLFRF readiness assessments, 2021 Figure 3: Scope of risk assessment
Single Audit Results, the Statewide Financial Management and
Compliance Quarterly Report as of December 31, 2021, 2022 ARMICS assessment results and
attachments for select agencies, and agency provided documents for select agencies.

IV. Assessment Results
The risk assessment resulted in a determination that adequate controls were in place with several
potential areas to improve the state of internal control over federal funding across Commonwealth
executive branch agencies. The assessment outcomes recognized below are a result of both
agency-specific review and review of the overall oversight of the funds within the Commonwealth.
First, the assessment compared the Commonwealth against a maturity scale of internal control
activities, as detailed in Figure 4. Based on a high-level understanding of internal control activities
related to federal funds, the Commonwealth was determined to be at an “Operational, Approaching
Maturity” level. Generally, adequate controls and processes are in place, both at the
Commonwealth-wide level and then within the agencies. Within agencies, however, the internal
control standards appear to be applied inconsistently. The following instances illustrate
inconsistent reporting procedures (e.g., responses and attachments provided in ARMICS
6
assessment vary in quality and content; some self-assessment responses are more thorough than
others). Additionally, there may be opportunities to improve the efficiency and effectiveness of
controls through greater oversight of the portfolio as a whole and analysis of reported data. The
assessment concludes that the Commonwealth of Virginia has an adequate level of control, but
risks and areas for enhancement have been identified and are included in this report.

Figure 4: Federal funds maturity scale for Commonwealth of Virginia agencies

Factors Contributing to Greater Maturity
Though the assessment revealed gaps, Virginia’s current approach does offer many benefits that
should be noted as well. The ARMICS self-assessment process requires agencies to evaluate their
internal control environment and activities across a number of areas. Additionally, DOA provides
standardized guidance and questionnaires for agencies to use during this process. Factors of the
SLFRF reporting process also demonstrate higher maturity in Virginia’s current approach. For
example, training webinars and tools are offered for agencies on Treasury requirements regarding
SLFRF reporting. Additionally, the ARPA reporting system implemented by the DOA provides
for a centralized way to review information being reported to U.S. Treasury.
During the allocation and appropriation decision making process for uses of CRF and SLFRF
within the Commonwealth, the Department of Planning and Budget (DPB) required agencies to
attest to eligibility of proposed projects. DPB evaluated the associated requests and made

7
recommendations to the Governor and General Assembly. Eligibility is a key area that will be
reviewed upon audit of the funds.
Factors Contributing to Lower Maturity
The assessment recognized the following potential gaps:
1. Lack of real-time visibility into agency internal control activities for federal funds
creates inherent challenges to understanding existing, ongoing compliance activities
related to federal funds. Several higher-risk agencies are exhibiting reporting challenges
for various activities, including federal funds reporting. Another state examined during the
assessment requires compliance plans to be provided in advance of receiving funds which
provides more timely insight into planned activities. This challenge in oversight of the
funds could have impacts across various compliance areas.
2. Reliance on self-assessments is inherently less reliable than independent, verified
reviews of agencies’ risk management activities. ARMICS assessments are self-reported
by agencies and not as reliable as independent reviews of agency policies, processes, and
controls. Related to the gap mentioned above, this could have impacts across various
compliance areas should agencies not fully understand federal guidance associated with
the funds. Additionally, the quality and content of attachments varies across agencies.
3. Reliance on manual, self-reported data can lead to reported results that are less
reliable than verified data. DOA collects and aggregates CRF and SLFRF detailed
expenditure and performance data from agencies. This detailed information cannot be
verified against a central system, and DOA is reliant on the accuracy of agency reporting.
DOA conducts reviews of data and applies numerous logic checks prior to submitting data
to U.S. Treasury, but there are many aspects that DOA is unable to verify. Additionally,
several higher risk, higher dollar value agencies require additional assistance to submit
reporting that passes these initial levels of review. Reporting will be reviewed upon audit
and data discrepancies can invite additional scrutiny.
4. Subrecipient monitoring activities are conducted and validated inconsistently by
agency management. Three agencies had findings related to subrecipient risk assessments
and/or monitoring in the 2021 Single Audit. Additionally, while implicitly covered in the
federal grants management ARMICS questionnaire, there is no question specifically
addressing an agency’s subrecipient monitoring controls. Subrecipient risk assessments
and monitoring will be reviewed upon audit, and this topic is specifically addressed in 2
CFR 200.331 – 2 CFR 200.333. Insufficient subrecipient risk assessments and monitoring
could result in audit findings and improper uses of funds.
5. Third-party provider monitoring activities are conducted and validated
inconsistently by agency management. In the 2021 Single Audit, one agency was found
to have a material weakness related to monitoring outsourced programmatic functions for
the Rebuild VA program, which is funded by CRF and SLFRF, which resulted in improper
payments. One agency was also found to have a material weakness related to obtaining
assurance over third-party providers’ internal controls. Other agencies received less severe
findings related to oversight of third-party providers. Agencies are responsible for
oversight of their service providers and for ensuring that services meet the terms outlined

8
via the procurement (i.e., contract). This gap could have impacts across a variety of areas,
most notably improper financial transactions.
6. Insufficient staffing and a lack of knowledge transfer and cross-training can impact
agency-level control over funds and can impact accuracy and timeliness of reporting.
In the 2021 Single Audit, one agency was found to have a material weakness related to
controls over financial reporting. Turnover was cited as a contributing factor for this
finding, and cross-training was identified as part of a potential solution. Another agency
also had several findings related to other federal requirements where insufficient staffing
was cited as a contributing factor to the deficiencies. Lack of knowledge transfer is
frequently encountered during quarterly reporting for the SLFRF, and newer reporting
points-of-contact (POCs) generally require assistance to clear reporting errors. While this
gap has the most immediate impact on reporting, it may also impact various other areas of
administering federally funded programs.
7. IT-related control activities are conducted and validated inconsistently by agency
management. While likely only relevant for a subset of federally funded projects, IT
controls can play an essential role in safeguarding sensitive data. One agency had numerous
instances of systems access and other IT-related control findings in the 2021 Single Audit.
There are several agencies working on implementing corrective action plans related to
systems access and other IT controls. Protecting sensitive data is specifically highlighted
in the Uniform Guidance’s section on internal control.

Additionally, the CRF and SLFRF funding is concentrated among a few agencies. Across the 113
agencies within the executive branch receiving these funds, funding at the top 13 agencies accounts
for 90% of the funds. This concentration of funding also means that through targeted work with a
minimal number of agencies, the Commonwealth may be able to realize great improvement with
a lower level of effort.

V. Risk Assessment Process
As shown in Figure 5, the risk assessment was conducted in four steps and relied upon existing
data and documentation.

Figure 5: Steps taken for risk assessment

9
Findings from document reviews and analyses have been summarized in this report, along with
identified strengths and weaknesses of the current state of agencies’ internal controls related to
federal pandemic relief funds.

A. Overview of Current Internal Control Activities
The assessment first included a review of existing risk management and internal control activities
to gain an understanding of the current state.
ARMICS Assessment Process
ARMICS is in place “to ensure fiscal accountability and safeguard the Commonwealth’s assets.”
ARMICS outlines the policies and processes agencies must follow to maintain sufficient internal
control. DOA has mapped the ARMICS and the Internal Control Policy (CAPP Topic No. 10305)
to the Committee on Sponsoring Organizations (COSO) principles and maintains that mapping on
their website.3
Agencies are required to assess internal control and supporting control activities to provide
reasonable assurance of the ongoing efficiency and effectiveness of internal control within the
agency and report annually to DOA its compliance via the ARMICS Certification Process. This is
done through a system that provides a secure and accurate means of submitting the information to
DOA. Each section of ARMICS addresses one of the five key components of internal control –
meaning there is a section on control environment, risk assessment, control activities, information
and communication, as well as monitoring activities. For each component, agencies answer a series
of yes or no questions and upload documentation when necessary. Questions require a corrective
action plan for each answer that is not within compliance. Many questions also ask for the agency
to upload a document of proof when the answer does indicate compliance. At the end of the
questionnaire, a report summary is prepared for agencies to have a final opportunity to view or
make corrections to any previous answers. Additionally, ARMICS requires agencies to quantify
on a scale from 1-5 how strongly they agree or disagree with statements regarding specific controls.
These include a control environment section, agency level risk assessment, agency level control
activity assessment, agency level information and communication assessment, and an agency level
monitoring assessment in Stage 1. In Stage 2, agencies must perform a risk assessment of each
fiscal process and then test the effectiveness of control activities and document the results. Any
weakness found during these self-assessments requires a corrective action plan that the agency
must remediate to maintain proper controls over the Commonwealth’s assets.
DPB Key Control
During the initial allocations of CRF funding among Commonwealth agencies, agency heads were
required to complete a form called a “Certification for Use of Coronavirus Relief Funds”, along
with their request for funding, and submit this form to DPB. In these certifications, the agency
head agreed to assume responsibility in assuring that, if granted, the CRF funds would be used to
cover costs that were necessary expenditures incurred due to the public health emergency with

3
ARMICS COSO Crosswalk (virginia.gov)

10
respect to COVID-19; were not accounted for in the budget approved as of March 27, 2020; and
were incurred during the period beginning on March 1, 2020 through December 30, 2020.
Additional requirements of receiving CRF funds included retaining documentation and upholding
proper accounting records. Agency heads had to acknowledge their understanding that CRF funds
could not be used as a revenue replacement for lower-than-expected non-general fund revenue
collections or to replace any activities currently funded from the general fund or non-general fund
revenues. Additionally, CRF funds provided could not be used to offset future budget reductions.
For each certification completed, the agency had to agree to use the funding only for the purpose
at which they were requesting. It was also not permissible for CRF funds to be used for purposes
of matching other federal funds unless specifically authorized by federal statute, regulation, or
guideline. These certifications were then reviewed by DPB, who made recommendations to the
Governor, who ultimately approved or denied these funding requests. Following initial
administrative allocations, the General Assembly appropriated remaining CRF funds.
DPB played a similar role in the distribution of SLFRF funds. Cabinet secretaries submitted
proposal requests for funding that were then collected by DPB. In these funding proposals,
agencies provided a description of their proposed use of funds and an explanation of why the
proposal would be an eligible use of SLFRF according to federal guidelines, excluding the revenue
replacement use. DPB then reviewed the proposals and made a recommendation for the allocation
of funding. Proposals recommended by the Governor were included in the introduced
appropriations bill for 2021 Special Session II and in the 2022-2024 biennial budget. Ultimately,
the General Assembly appropriated funding for specific uses, which included proposals from the
introduced budget, modified proposals, or new proposals identified by the General Assembly, in
the 2021 Special Session and the 2022-2024 biennial budget.
Webinars and Office Hours
The DOA has partnered with a third-party to host webinar trainings and office hours for the
agencies to help ensure reporting compliance for the SLFRF. Six webinars have been conducted
over the course of 2022 in order to keep the agencies up to date on U.S. Treasury requirements.
These webinars have covered a wide range of information including reporting requirements, key
performance indicators, expenditure categories, capital expenditure written justifications, labor
practice requirements, DOA reporting and compliance processes, and subrecipient monitoring.
Additionally, office hours serve as a forum for agencies to ask general and topic-specific questions.
Agency project contacts, fiscal/budget officers, and compliance staff were encouraged to attend
these sessions. Attendees were also provided with the materials after each session for later
reference.
SLFRF Reporting Process Overview
DOA has facilitated reporting among more than 140 projects and provided support for nearly 40
agencies. DOA has implemented an ARPA reporting system to gather data that is reported by
agencies on a quarterly basis. DOA has also developed a reporting template to capture detailed
obligation and expenditure information. Additionally, agencies are provided with several tools,
including a user guide and reporting checklist to assist with their reporting.

11
The DOA reporting system has a number of system checks to review agency reported data against
several logic checks. For example, the system displays errors when reported expenditures exceed
obligations. The team also reviews reported data against a checklist and follows up with agencies
to resolve any remaining issues or reconcile any data anomalies. Finally, the DOA reviews the
complete reporting submission prior to uploading to the U.S. Treasury reporting system.

B. Quantitative Risk Analysis
Approach
As shown in Figure 6, the available data points for a given agency were grouped into two categories
of risk: internal control risk and other risk factors. The available data on funding amounts were
grouped into the category “funding data” for which the internal control risk and other risk factors
were mapped against.

Figure 6: Internal control risk, other risk factors, and funding data

This information was then used to create a quadrant mapping of agencies from lower to higher risk
and from lower to higher levels of funding to identify the higher-risk agencies with the greatest
amount of funding.
The internal control risk category was comprised of audit findings and ARMICS compliance
status. The other risk factors analysis was performed for agencies with SLFRF and was comprised
of available data points primarily relating to an agency's number of subrecipients, contractors, and
beneficiaries, agency readiness, and program maturity (assessed from appropriation language
and/or other knowledge of programs).

12
Detailed Analysis
To incorporate qualitative risk factors such as compliance status, numeric values that were
consistent with previous risk assessment grading scales were assigned. For example, a weighted
grading scale for the material weaknesses versus significant deficiencies. Next, this weighted audit
sum was added to the ARMICS compliance status score to give an overall risk score. This overall
internal control risk score (x-axis) was measured against the total sum of CRF and SLFRF funds
allocated to the agency (y-axis). For the category of other risk factors, it was concluded that having
a higher number of subrecipients, contactors or beneficiaries introduces more risk to an agency,
thus the numbers for each category were grouped into ranges and the range is assigned a score.
For program maturity, a simple yes or no criteria was applied. The assigned risk value of
subrecipients, beneficiaries, contractors, agency risk score and program maturity were added to
give the final overall other risk factors value (x-axis) for a given agency. This overall risk value is
measured against the total sum of SLFRF and CRF funding allocated (y-axis) for the agency.
For a given agency, when their overall risk score is plotted against their allocated funding, it
provides a clear visual picture into the distribution of agencies and their level of risk against four
quadrants: higher risk and higher dollar value, higher risk and lower dollar value, lower risk and
higher dollar value and lower risk and lower dollar value. For the 113 agencies studied, the
majority fall below $100 million allocated funding dollars, which was used as the threshold to
define lower dollar value. Higher dollar value was defined as funding greater than $100 million,
and while only 12 agencies fell within this range, combined they hold nearly $6.5 billion in
allocated funding. Increased scrutiny should be assigned to agencies that hold more funding, due
to greater impact of adverse outcomes. Additionally, the assessment determined the threshold
between higher and lower risk to be nine for the internal control risk and three for the other risk
factors. Figure 7 shows the distribution of agencies among the four quadrants.

Figure 7: Risk mapping of agencies

Results Summary
A combination of multiple audit findings, prior agency risk scores, limited experience in
administering funds and high numbers of subrecipients placed nine agencies into the higher risk,
higher dollar category as shown in Figure 8. These nine agencies have a combined total of $4.6

13
billion in allocated funds. Due to the higher dollar allocation, these higher risk agencies have
potential to produce the greatest negative financial impact. Given the magnitude of impact, these
agencies should have resources prioritized to further assess, mitigate, and control risk.

Figure 8: Nine agencies in the higher risk, higher dollar value category

C. OMB/ARMICS Comparison
The OMB Compliance supplement contains six compliance requirements for SLFRF. These are
outlined in the table below with their brief descriptions.
No. Area Description
1 Activities • Lists eligible uses for fund payments
allowed/unallowed • Lists prohibited uses for fund payments
2 Allowable cost/cost • Addresses cost principles associated with funds
principles
3 Period of performance • Addresses timeliness of incurred costs by agencies and
limits them to a specified time (e.g., funds must be
obligated by December 31, 2024)
4 Procurement, suspension • Lists that recipients, subrecipients, and contractors need to
& debarment follow procurement standards as identified in the Uniform
Guidance
• Lists the verification obligation of agencies regarding
suspended and debarred vendors/subrecipients before
entering into contracts
5 Reporting • Lists the various types of reports aimed at expenditure,
performance, and recovery that Agencies must prepare
6 Subrecipient monitoring • Lists audit and risk assessment of subrecipients as
mandatory
Table 1: Applicable Uniform Guidance areas subject to audit for SLFRF/CRF

As part of the assessment, ARMICS assessment control areas and the Commonwealth Policies and
Procedures Manual were mapped to the OMB Compliance supplement outlined in the table below.

14
OMB Compliance CAPP
No. No. ARMICS
Supplement Area Identifier
1 Activities 1.1 Appropriations 20105
Allowed/Unallowed Appropriations, Allotments, and Transfer
1.2 Appropriations 20110
Operating Expenditure Plan
1.3 Federal Grants Management 20605
2 Allowable Cost/Cost 2.1 Indirect Cost Recovery 20705
Principles
3 Period of Performance 3.1 Cash Disbursement 20340
Capital Outlay
3.2 Cash Disbursement 20325
Revenue Refund
3.3 Cash Disbursement 20330
Petty Cash
3.4 Cash Disbursements 20350
Non-state funds
3.5 Cash Disbursements 20345
Moving & Relocation
3.6 Cash Receipts Deposits 20205
3.7 Federal Grants Management 20605
3.8 Cash Disbursements 20305
Receiving Reports
3.9 Cash Disbursements 20310
Expenditures
3.10 Cash Disbursements 20315
Prompt Payments
3.11 Cash Disbursements 20355
Purchase Charge Cards
4 Procurement, 4.1 Cash Disbursements 20305
Suspension & Receiving Reports
Debarment 4.2 Cash Disbursements 20310
(Procurement) Expenditures
4.3 Cash Disbursements 20315
Prompt Payments
4.4 Cash Disbursements 20355
Purchase Charge Cards
4.5 Cash Disbursements 20350
Non-state funds
4.6 Fixed Assets - Fixed Assets Acquisition 30205
Method
5 Reporting 5.1 Cash Disbursement 20340
Capital Outlay

15
OMB Compliance CAPP
No. No. ARMICS
Supplement Area Identifier
5.2 Cash Disbursement 20325
Revenue Refund
5.3 Cash Disbursement 20330
Petty Cash
5.4 Cash Disbursements 20350
Non-state funds
5.5 Cash Disbursements 20345
Moving & Relocation
5.6 Cash Receipts Deposits 20205
5.7 Federal Grants Management 20605
5.8 Cash Disbursements 20305
Receiving Reports
5.9 Cash Disbursements 20310
Expenditures
5.10 Cash Disbursements 20315
Prompt Payments
5.11 Cash Disbursements 20355
Purchase Charge Cards
6 SubRecipient 6.1 Federal Grants Management 20605
Monitoring
Table 2: ARMICS, CAPP & OMB Compliance Supplement areas mapping

Federal grants management is a key ARMICS assessment area which addresses monitoring of
federal funding. Various other controls related to appropriations, cash disbursements, and inter-
agency transactions also act as controls for federal grants management.
Two key findings arise from the mapping of OMB Compliance supplement area to ARMICS
assessment:
1. Contractor/vendor suspension & debarment screening process
The OMB Compliance Supplement area mentions that recipients must verify the status of
contractors/vendors before entering contracts as well as that of subrecipients before granting funds.
Preventive control markers pertaining to policy documents mentioning how to treat
suspended/debarred vendors, checks done before transacting with such vendors and detective
control markers such as the transactional interaction of the agencies with suspended/debarred
vendors are not observed in the ARMICS assessment area.
2. Subrecipient risk assessment & monitoring process
In the federal grants management area of the ARMICS assessment there is no explicit mention of
an agency’s subrecipient risk assessment process or monitoring procedures. Although implicitly
covered under the federal grants management questionnaire as part of “Federal grant acquisition
and management policies and procedures are in accordance with federal and State requirements,
clearly stated and systematically communicated through manuals, handbooks, or other media”,

16
there may be benefits to explicitly including it due to its inclusion as a specific compliance
requirement to be examined upon audit. This area is divided into two sub-areas:
2.1 Risk Assessment of subrecipients
A post-grant risk assessment of subrecipients should be done to understand whether they
should be given the awards and to better inform the level of monitoring to be performed.
2.2 Monitoring of subrecipients
A monitoring process involving post grant audits, reviews, and other concurrent monitoring to
check compliance with federal regulations and other programmatic policies.

D. Desk Review
Pursuant to the agency risk analysis conducted, nine agencies were marked as higher risk, higher
dollar value agencies. Desk reviews were conducted for select agencies.
Desk Review Approach
The desk review process had three components:
1. Understanding the significant fiscal processes related to federal funds for each agency and
reviewing the process maps;
2. Identifying the risk and controls, policies, and procedures aligned to various process areas;
and
3. Documenting the process gaps and observations pertaining to missing controls.

17
The document universe for the desk review is noted in the table below:
No. Area
1 ARMICS Assessment Questionnaire Responses &
Attachments
2 Past Audit Findings
3 OMB Compliance Supplement related evidence and
responses from Agency POCs
Limitations/Assumptions of Desk Reviews
Key assumptions/limitations while conducting desk reviews:
• The conclusions below are based on the documents provided by the agencies pertaining to
process flows, contracts, and key controls mentioned in the ARMICS assessment.
• Controls identified by agencies are assumed to be effective both in design and operation.
Conclusions of Desk Reviews
ARMICS documentation, past audit findings, and information presented by selected agencies
support the previous observations. Agencies are generally compliant with federal regulations.
However, they have opportunities to improve documentation and cross-training.

E. Review of other states compliance practices
The assessment also included a review of compliance-specific documents from a Mid-Atlantic
state and a Northeastern state to help identify best practices in other states’ federal funds
compliance practices.
The Mid-Atlantic state requires each agency to complete a self-assessment on their internal
controls like the ARMICS assessment process conducted in Virginia. A feature of this self-
assessment is that it requires each agency to appoint an Internal Control Officer (ICO). The ICO
reports to the agency head, and they are required to implement and review the internal control
responsibilities established by the state. The ICO completes the yearly internal control
certification, and one section of this self-assessment relates entirely to their role. It is expected that
the ICO evaluates compliance to standards of conduct and the internal control plan, addresses any
digressions with timeliness, adjusts the scope and regularity of internal control reviews as needed,
and routinely revises policies and procedures. Establishing a position such as an ICO in each
agency has potential benefits as it would allow increased awareness of deficiencies in their internal
controls before the ARMICS assessment takes place. An ICO ensures ongoing monitoring that
could unlock continuous improvement in overall compliance, whereas it is currently common to
see agencies have reoccurring deficiencies in the same areas. While Virginia’s agency heads and
fiscal officers complete the ARMICS, this role differs in its increased focus on the internal control
environment and control activities.
Like the Mid-Atlantic state, the Northeastern state requires the head of each department receiving
SLFRF funds to designate a person as the Department Federal Compliance Officer. The
Department Federal Compliance Officer is responsible for creating a compliance plan and must
understand federal compliance and reporting requirements. Additionally, in the Northeastern state,
agencies must provide a compliance plan before the state distributes SLFRF funding to them.
18
While Virginia agencies are required to explain how their request is an eligible use of funding,
they are not required to submit compliance plans to DOA, or any other overseeing agency, that
detail how they plan to administer funds in accordance with the guidance.

VI. Conclusion
The risk assessment identified several potential gaps for improvement to internal controls of
federal funding. These areas were identified through analysis of existing documents, review of
policies, and quantitative analysis, while also looking at the best practices from other states.
Agencies were also classified by their potential for risk through evaluating potential risk factors
such as total funding, audit findings, and ARMICS compliance.
In summary, internal control over federal funds among executive branch agencies was assessed to
be at an “Operational, Approaching Maturity” level. Essentially, while Commonwealth-wide
internal control policies and activities appear to be adequate, they are applied inconsistently among
and within specific agencies. Specific activities that strengthened the result of the assessment
included the DOA-run ARMICS self-assessment process, DOA facilitated reporting trainings and
reporting reviews, and the initial eligibility review provided by DPB. Specific gaps identified are
listed below:
• Lack of real-time visibility into agency internal control activities for federal funds;
• Reliance on self-assessments is inherently less reliable than independent, verified reviews
of agencies’ risk management activities;
• Reliance on manual, self-reported data can lead to reported results that are less reliable than
verified data;
• Subrecipient monitoring activities are conducted and validated inconsistently by agency
management;
• Third-party provider monitoring activities are conducted and validated inconsistently by
agency management;
• Lack of knowledge transfer and cross-training can impact agency-level control over funds
and can impact accuracy and timeliness of reporting; and
• IT-related control activities are conducted and validated inconsistently by agency
management.

File and source

File: 2022-RD670.pdf
Size: 1,404,724 bytes
SHA-256: 57a6de140836c1431401f83af7546053dad0f18fba14762a5435b83078bd91b2
Our copy: 2022-RD670.pdf
Original: No public link identified.