Report of the Risk Assessment of Executive Branch Agency Internal Controls for Federal Pandemic Relief Funds

Summary

Memorandum dated November 1, 2023 from Stephen E. Cummings, Secretary of Finance, to Glenn Youngkin, Governor of Virginia and the chairs of the House Appropriations Committee and the Senate Finance and Appropriations Committee. It submits the Report of the Risk Assessment of Executive Branch Agency Internal Controls for Administering and Disbursing Federal Pandemic Relief Funds under Item 257.B, Chapter 1, 2023 Virginia Acts of Assembly Special Session I. The memo states that the assessment was limited to Coronavirus Relief Funds and State and Local Fiscal Recovery Funds, and that the review indicates the Commonwealth has generally developed and implemented adequate internal controls. It also identifies potential opportunities for improvement on record retention.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Cite this document

“Report of the Risk Assessment of Executive Branch Agency Internal Controls for Federal Pandemic Relief Funds.” Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2023-rd579-dd51294a58/, SHA-256 2399fec8b9d0b0c52550b9c2ae159acadc4868f168726dc5f2f160f4bea3786b.

Full text

COMMONWEALTH of VIRGINIA
Stephen E. Cummings P.O. Box 1475
Secretary of Finance Richmond, Virginia 23218

November 1, 2023

MEMORANDUM

TO: The Honorable Glenn Youngkin, Governor of Virginia
The Honorable Barry D. Knight, Chair, House Appropriations Committee
The Honorable Janet D. Howell, Co-Chair, Senate Finance and Appropriations
Committee
The Honorable George L. Barker, Co-Chair, Senate Finance and Appropriations
Committee
FROM: Stephen E. Cummings

SUBJECT: Report of the Risk Assessment of Executive Branch Agency Internal Controls for
Administering and Disbursing Federal Pandemic Relief Funds

Pursuant to Item 257.B, Chapter 1, 2023 Virginia Acts of Assembly Special Session I, I am
submitting the risk assessment for executive branch agencies receiving federal pandemic funding.
This risk assessment was limited in scope to the Coronavirus Relief Funds (CRF) from the
Coronavirus Aid, Relief, and Economic Security Act (CARES Act), and the State and Local Fiscal
Recovery Funds (SLFRF) from the American Rescue Plan Act (ARPA).

This high-level review indicates that the Commonwealth has generally developed and
implemented adequate internal controls over the appropriate use and reporting of federal funds.
While this provides a sound basis for managing federal assets and ensuring compliance with
federal regulations, the risk assessment also identifies potential opportunities for improvement.
Such opportunities pertain to ensuring agency fiscal officers are aware of federal record retention
requirements and discussing the modification of Library of Virgina records retention requirements
to comply with federal requirements. The Department of Accounts will coordinate efforts to
address these opportunities.

Additionally, as noted in the report, the Commonwealth’s decentralized reporting structure leads
to inherent challenges regarding central oversight. Within available resources, the Department of
Accounts is using a risk-based approach to perform Quality Assurance Reviews to evaluate
individual agency processes and compliance with the applicable policies and procedures. I look
forward to working with you to strengthen the internal control structure over all Commonwealth
financial assets.

Please let me know if you have any questions.
Report of the Risk Assessment of Executive Branch Agency
Internal Controls for Administering and Disbursing Federal
Pandemic Relief Funds

Pursuant to Item 257B, Chapter 1, 2023 Special Session I Virginia Acts of
Assembly

TO:
The Honorable Glenn Youngkin, Governor of Virginia
The Honorable Barry D. Knight, Chair
House Appropriations Committee

The Honorable Janet D. Howell, Co-Chair
Senate Finance and Appropriations Committee
The Honorable George L. Barker, Co-Chair
Senate Finance and Appropriations Committee

COMMONWEALTH OF VIRGINIA
RICHMOND
2023
Table of Contents
I. Executive Summary ......................................................................................................... 3
II. Updates Since the 2022 Report ........................................................................................ 4
III. Background ...................................................................................................................... 5
IV. Scope of Risk Assessment ............................................................................................... 8
V. Assessment Results .......................................................................................................... 8
VI. Risk Assessment Process ............................................................................................... 11
A. Overview of Current Internal Control Activities ........................................................... 11
B. Quantitative Risk Analysis ............................................................................................. 14
C. Agency Review .............................................................................................................. 17
D. OMB/ARMICS Comparison .......................................................................................... 20
E. Review of Other States Compliance Practices ............................................................... 22
VII. Conclusion...................................................................................................................... 24

2
I. Executive Summary
In 2023, the Department of Accounts (DOA), with the assistance of a third-party, conducted a
second-year risk assessment of executive branch agency internal controls for federal funds. The
risk assessment relied upon existing data and documentation and was limited in scope to the
Coronavirus Relief Funds (CRF) from the Coronavirus Aid, Relief, and Economic Security Act
(CARES Act), and the State and Local Fiscal Recovery Funds (SLFRF) from the American Rescue
Plan Act (ARPA).1 While there are additional federal regulations for other pandemic funding that
are not applicable to the CFR and SLFRF, this risk assessment does not address all federal
compliance requirements.
Through this high-level review, the assessment concluded that executive branch agencies have
adequate internal control over federal funds. Such practices include: the ARMICS self-assessment
process that evaluates agency internal control, aided by DOA's standardized guidance and tools;
the Department of Planning and Budget’s (DPB’s) review of project eligibility and agency
attestations of compliance; and DOA-hosted SLFRF trainings and ARPA reporting system,
facilitating compliance with Treasury requirements. Additionally, agencies generally rely on
comprehensive grant management systems to ensure compliance and maintain transparent project
documentation.
However, a lack of portfolio-level oversight and centralized data systems leads to inherent
challenges of managing and tracking the funds at a Commonwealth-wide level. The current
decentralized system makes a review of agency-level controls difficult due to the lack of real-time
visibility into agency activities.
Specific potential gaps in the Commonwealth’s current state of internal control over federal funds
are:
• Inherent risks arise from Virginia's decentralized federal funds management approach.
These include a lack of real-time visibility into agency internal control activities for federal
funds, reliance on self-assessments, reliance on self-reported data, and dependence on
agencies to respond to audit and/or other requests appropriately and in a timely manner;
• Lack of knowledge transfer and cross-training can impact agency-level control over funds
and can impact accuracy and timeliness of reporting;
• Consistent implementation and validation of IT-related control activities by agency
management are essential for safeguarding sensitive information;2 and

1
The CRF and SLFRF were appropriated among agencies via Item 479.10, Chapter 56, 2020 Acts of Assembly Special
Session I, Item 479.20, Chapter 1, 2022 Acts of Assembly Special Session I, Item 486, Chapter 2, 2022 Acts of
Assembly Special Session I, Item 486.10, Chapter 769, 2023 Acts of Assembly, and Item 486, Chapter 1, 2023 Acts
of Assembly Special Session I.
2
IT controls are relevant for federally funded projects where agencies are upgrading or implementing new systems or
when they are collecting sensitive data.

3
• The current Library of Virginia’s records retention schedule notes that records relating to
federal grant money should be maintained for three years3 after project completion, while
SLFRF requirements are five years.
The remainder of this report details the analysis performed as part of this risk assessment.

II. Updates Since the 2022 Report
Below are relevant updates related to Virginia’s activities over the past year. Other updates were
made to the risk assessment methodology, which are covered in more detail in further sections of
the report.
1. Subrecipient monitoring questions incorporated in ARMICS certification questionnaire
To address a gap noted in last year’s report, DOA has integrated questions related to federal
grants management and subrecipient monitoring within the annual Agency Risk Management
and Internal Control Standards (ARMICS) certification questionnaire. The ARMICS
questionnaire addresses the need for effective subrecipient oversight by prompting agencies
with the question: "Did your agency receive Federal awards to disburse to non-Federal entities
for the purpose of carrying out Federal programs?" If answered affirmatively, agencies are
directed to review regulation 2 CFR § 200.332, which outlines pass-through entity
responsibilities. Subsequently, they must respond to a series of questions, evaluating their
compliance with these responsibilities. The ARMICS system helps create consistency in how
agencies are certifying that they complete their monitoring responsibilities.
2. Third-party monitoring corrective action completed
In last year’s report, one agency had a material weakness related to CRF with regards to
“Ensuring Proper Monitoring Over Outsourced Programmatic Functions.” This agency has
completed the corrective action developed in response to this finding.
3. CRF Funding
In June 2022, U.S. Department of the Treasury (U.S. Treasury) conducted a desk review to
evaluate the Commonwealth of Virginia's utilization of the CRF authorized by the CARES
Act.4 The review aimed to assess the documentation supporting CRF expenditure claims and
gauge the risk of unallowable fund use, covering the period from March 1, 2020, through June
30, 2022. Findings revealed that Virginia's documentation did not comply with CARES Act
and Treasury's guidance, resulting in questioned costs totaling $870,559,763.10. Report
recommendations included corrections to descriptions, obtaining additional documentation,
and proposing a focused audit for specific payment types. Ultimately, the review concluded
that Virginia’s risk of unallowable use of funds is high.

3
GS-102 (virginia.gov)
4
Commonwealth of Virginia CRF Final Desk Review Report (8.9.23) (oversight.gov)

4
DOA and state agencies receiving CRF should proactively prepare for an audit of CRF in
response to the recommendations provided in the desk review.

III. Background
The Secretary of Finance, via DOA, conducted this risk assessment as required by Item 257 B,
Chapter 1, 2023 Acts of Assembly Special Session I that states (in part):
The Secretary of Finance shall engage internal or third-party assistance to perform a risk
assessment of executive branch agency internal controls for administering and disbursing
federal pandemic relief funds, economic stimulus, or loan funds. Upon engaging internal
or third-party assistance, the Secretary of Finance shall consult with the Auditor of Public
Accounts and executive branch agencies conducting similar risk assessments or audits
regarding the scope of work performed by the Auditor of Public Accounts and such
executive branch agencies over federal funds. The Secretary of Finance shall provide
oversight over any resulting contracts and compile the findings and provide a report to the
Governor, the Chair of the House Appropriations Committee and the Chair of the Senate
Finance and Appropriations Committee by November 1 of each year.
DOA is well situated to conduct this assessment as they are responsible for reporting on two of
the largest and broadest pandemic relief funding packages, the CRF included in the CARES Act
and the SLFRF included in ARPA. Additionally, DOA oversees the ARMICS assessment
process.
Applicable Federal Guidance
Both the SLFRF and CRF funding comes with a wide variety of requirements on the use and
administration of the funding, as well as specifications under allowable and nonallowable uses. In
addition to the Uniform Administrative Requirements, Cost Principles, and Audit Requirements
for Federal Awards (2 CFR Part 200), U.S. Treasury has published specific guidance for both
funds (see example of various SLFRF regulations and guidance in Figure 1).5

5
As of October 2023, SLFRF eligible uses have been expanded per the 2023 Consolidated Appropriations Act, and
U.S. Treasury has released an updated Interim Rule regarding the expanded uses. The Commonwealth has not
appropriated funds towards these new uses at the time of this report. Additionally, the conclusion of the national public
health emergency related to the COVID-19 pandemic also marked the end of premium pay as an eligible use of SLFRF
after April 10, 2023.

5
Figure 1 Laws and regulations governing use of SLFRF

For example, 2 CFR 200.303 addresses compliance in regard to internal controls for non-federal
entities receiving federal awards:
The non-Federal entity must:
(a) Establish and maintain effective internal control over the Federal award that provides
reasonable assurance that the non-Federal entity is managing the Federal award in
compliance with Federal statutes, regulations, and the terms and conditions of the Federal
award. These internal controls should be in compliance with guidance in “Standards for
Internal Control in the Federal Government” issued by the Comptroller General of the
United States or the “Internal Control Integrated Framework”, issued by the Committee
of Sponsoring Organizations of the Treadway Commission (COSO).
(b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and
conditions of the Federal awards.
(c) Evaluate and monitor the non-Federal entity's compliance with statutes, regulations
and the terms and conditions of Federal awards.
(d) Take prompt action when instances of noncompliance are identified including
noncompliance identified in audit findings.
(e) Take reasonable measures to safeguard protected personally identifiable information
and other information the Federal awarding agency or pass-through entity designates as
sensitive or the non-Federal entity considers sensitive consistent with applicable Federal,
State, local, and tribal laws regarding privacy and responsibility over confidentiality.
The Office of Management and Budget’s (OMB’s) 2023 Compliance Supplement
(whitehouse.gov) details which of the compliance requirements are subject to be reviewed upon
audit of CRF and SLFRF projects. This document specifies that agency management is generally
responsible for ensuring compliance with the following:
• Activities allowed or unallowed;
• Allowable costs/cost principles;
• Period of performance;

6
• Procurement, suspension, and debarment;
• Reporting; and
• Subrecipient monitoring.
U.S. Treasury’s SLFRF-Compliance-and-Reporting-Guidance.pdf (treasury.gov) provides
additional description of these areas of the Uniform Guidance that are applicable for the SLFRF
(and similarly, were applicable for CRF).
Potential Consequences of Insufficient Internal Control Over Federal Funds
As shown in Figure 2, there can be negative outcomes associated with insufficient internal control
over federal funds. These negative outcomes range from those with immediate impact like
misreporting of fund uses to U.S. Treasury, to those with short-term impact like requiring resources
to implement corrective action plans due to audit findings, to longer-term impacts like negative
reputational impact resulting in public mistrust and reducing competitiveness for future federal
funds. Due to these risks, an assessment of internal control is both necessary and beneficial to all
parties involved.

Figure 2:Outcomes associated with insufficient internal control over federal funds

7
IV. Scope of Risk Assessment
Per the appropriation language, this assessment was limited in scope to executive branch agencies.
Within the executive branch agencies, the assessment was further refined to only CRF and SLFRF
funds. The decision to narrow the scope was driven by the fact that CRF and SLFRF represent the
most substantial inflows of federal funds in recent history, posing a heightened level of risk due to
their unique allocation at the state level and the diverse range of potential fund utilization.
Information and documents reviewed as part of this assessment included CRF expenditures,
SLFRF appropriations, SLFRF detailed expenditure reporting data, SLFRF readiness assessments,
2021 and 2022 Statewide Single Audit reports, Statewide Financial Management and Compliance
Quarterly Report as of March 31, 2023 and June 30, 2023, the 2022 ARMICS assessment results
and associated ARMICS documents for select agencies, and information gathered in interviews
with select agencies.

Figure 3: Scope of risk assessment

V. Assessment Results
The risk assessment resulted in a determination that adequate controls were in place with several
potential areas to improve the state of internal control over federal funding across Commonwealth
executive branch agencies. The assessment outcomes recognized below are a result of both
agency-specific review and review of the overall oversight of the funds within the Commonwealth.
First, the assessment compared the Commonwealth against a maturity scale of internal control
activities, as detailed in Figure 4. Based on a high-level understanding of internal control activities
related to federal funds, the Commonwealth was determined to be at an “Operational, Approaching
Maturity” level. Generally, adequate controls and processes are in place, both at the
Commonwealth-wide level and within the agencies. There may be opportunities to improve the
efficiency and effectiveness of controls through greater oversight of the portfolio as a whole. The
assessment concludes that the Commonwealth of Virginia has an adequate level of control,
but risks and areas for enhancement have been identified and are included in this report.

8
Figure 4: Federal funds maturity scale for Commonwealth of Virginia agencies

Factors Contributing to Greater Maturity
Though the assessment revealed gaps, Virginia’s current approach does offer many benefits that
should be noted. The ARMICS self-assessment process requires agencies to evaluate their internal
control environment and activities across a number of areas. Additionally, DOA provides
standardized guidance and questionnaires for agencies to use during this process. Factors of the
SLFRF reporting process also demonstrate higher maturity in Virginia’s current approach. For
example, training webinars and tools are offered quarterly for agencies on Treasury requirements
regarding SLFRF reporting. Additionally, the ARPA reporting system implemented by DOA
provides for a centralized way to review information being reported to U.S. Treasury.
During the allocation and appropriation decision making process for uses of CRF and SLFRF
within the Commonwealth, DPB required agencies to attest to eligibility of proposed projects.
DPB evaluated the associated requests and made recommendations to the Governor and General
Assembly. Eligibility is a key area that will be reviewed upon audit of the funds.
Additionally, review of select agencies identified that most had controls in place for processes
related to operating SLFRF programs, specifically relevant to the OMB compliance areas.
However, agency documentation of these controls and backup documentation of relevant SLFRF
transactions varied agency to agency.
Factors Contributing to Lower Maturity
The assessment recognized the following potential gaps:
1. Inherent risks arise from Virginia's decentralized federal funds management
approach
• Real-Time Visibility Gap: Lack of real-time visibility into agency internal control
activities for federal funds creates inherent challenges to understanding existing,
ongoing compliance activities related to federal funds. Several higher-risk agencies are
exhibiting reporting challenges for various activities, including federal funds reporting.

9
Another state examined during the assessment requires compliance plans to be provided
in advance of receiving funds which provides more timely insight into planned
activities. This challenge in oversight of the funds could have impacts across various
compliance areas.
• Dependency on Self-Assessments: Self-assessments are inherently less reliable than
independent, verified reviews of agencies’ risk management activities. ARMICS
assessments are self-reported by agencies and not as reliable as independent reviews of
agency policies, processes, and controls. Related to the gap mentioned above, this could
have impacts across various compliance areas should agencies not fully understand
federal guidance associated with the funds. Additionally, the quality and content of
attachments varies across agencies.
• Reliance on Agencies for Accurate Reporting and Transaction Documentation:
Generally, self-reported data can result in less reliable reported results compared to
verified data. The DOA collects and aggregates detailed expenditure and performance
data from agencies, including the CRF and SLFRF related expenses. While expenditures
can mostly be verified in Cardinal, other detailed obligation information cannot be
independently verified against a centralized system, and DOA depends on the accuracy
of agency reporting. While DOA conducts data reviews and applies various logic checks
before submitting data to the U.S. Treasury, there are certain aspects that DOA cannot
fully verify. Moreover, some higher-risk agencies with higher-dollar-value transactions
may require additional assistance to ensure that their reporting passes these initial
reviews. Any discrepancies in the reported data may invite additional scrutiny during
desk reviews and/or audits. Additionally, several agencies utilize their own financial
management systems and/or grants management systems, meaning DOA is reliant on
agency personnel to provide transaction detail documents when requested upon audit
and/or other review. As evidenced in the CRF desk review, not all agencies are prepared
to respond to such requests adequately or in a timely manner.
2. Insufficient staffing and a lack of knowledge transfer and cross-training can impact
agency-level control over funds and can impact accuracy and timeliness of reporting.
In the 2022 Single Audit, one agency was found to have a repeated material weakness
related to controls over financial reporting. Turnover was cited as a contributing factor for
this finding, and cross-training was identified as part of a potential solution. Another
agency also had several findings related to other federal requirements where insufficient
staffing was cited as a contributing factor to the deficiencies. Lack of knowledge transfer
is frequently encountered during quarterly reporting for the SLFRF, and newer reporting
points-of-contact (POCs) generally require assistance to clear reporting errors.
3. IT-related control activities are conducted and validated inconsistently by agency
management. While likely only relevant for a subset of federally funded projects, IT
controls can play an essential role in safeguarding sensitive data. One agency had numerous
instances of systems access and other IT-related control findings in the 2022 Single Audit.
There are several agencies working on implementing corrective action plans related to
systems access and other IT controls. Protecting sensitive data is specifically highlighted
in the Uniform Guidance’s section on internal control.

10
Additionally, the CRF and SLFRF funding is concentrated among a few agencies. Across the 113
agencies within the executive branch receiving these funds, funding at the top 13 agencies accounts
for 90% of the funds. This concentration of funding also means that through targeted work with a
minimal number of agencies, the Commonwealth may be able to realize great improvement with
a lower level of effort.

VI. Risk Assessment Process
As shown in Figure 5, the risk assessment was conducted in five steps and relied upon existing
data and documentation.

Figure 5: Steps taken for risk assessment.

Findings from document reviews and analyses have been summarized in this report, along with
identified strengths and weaknesses of the current state of agencies’ internal controls related to
federal pandemic relief funds.

A. Overview of Current Internal Control Activities
The assessment first included a review of existing risk management and internal control activities
to gain an understanding of the current state.
ARMICS Assessment Process
ARMICS is in place “to ensure fiscal accountability and safeguard the Commonwealth’s assets.”
ARMICS outlines the policies and processes agencies must follow to maintain sufficient internal
control. DOA has mapped the ARMICS and the Internal Control Policy (CAPP Topic No. 10305)
to the Committee on Sponsoring Organizations (COSO) principles and maintains that mapping on
their website.6
Agencies are required to assess internal control and supporting control activities to provide
reasonable assurance of the ongoing efficiency and effectiveness of internal control within the

6
ARMICS COSO Crosswalk (virginia.gov)

11
agency and report annually to DOA its compliance via the ARMICS Certification Process. This is
done through a system that provides a secure and accurate means of submitting the information to
DOA. Each section of ARMICS addresses one of the five key components of internal control –
meaning there is a section on 1) control environment, 2) risk assessment, 3) control activities, 4)
information and communication, as well as 5) monitoring activities. ARMICS requires agencies
to assess their control environment, complete an agency level risk assessment, and assess control
activities, information and communication, and monitoring efforts. For each component, agencies
answer a series of “yes” or “no” questions and upload documentation when necessary. Questions
require a corrective action plan for each answer that is not within compliance. Many questions also
ask for the agency to upload a document of proof when the answer does indicate compliance. At
the end of the questionnaire, a report summary is prepared for agencies to have a final opportunity
to view or make corrections to any previous answers. Additionally, DOA provides several tools
and templates for agencies to follow with regards to ARMICS and assessing their internal control.
New for 2023, the ARMICS certification questionnaire now specifically asks questions regarding
federal grants management and subrecipient monitoring.
DPB Key Control
Agencies receiving CRF and/or SLFRF were required to complete an attestation process involving
DPB. Agency heads were required to complete certification forms and submit funding requests
outlining their use of the funds. For CRF funds, agencies committed to using them for necessary
COVID-19-related expenditures, retaining proper records, and following specific usage
restrictions. DPB reviewed and made recommendations to the Governor for approval. For SLFRF
funds, agencies were required to certify compliance with usage guidance, including addressing
public health and economic impacts. Agencies needed to adhere to criteria set by ARPA, ensuring
timely expenditure and returning unused funds by a specified deadline. The DPB played a similar
role in reviewing proposals and recommending allocations to the Governor for approval, with the
General Assembly appropriating the funds accordingly. Nuances exist in the eligibility criteria,
permissible uses, and reporting requirements for each funding type.
1. CRF Funding
During the initial allocations of CRF funding among Commonwealth agencies, agency heads were
required to complete a form called a “Certification for Use of Coronavirus Relief Funds”, along
with their request for funding, and submit this form to DPB. In these certifications, the agency
head agreed to assume responsibility in assuring that, if granted, the CRF funds would be used to
cover costs that were necessary expenditures incurred due to the public health emergency with
respect to COVID-19; were not accounted for in the budget approved as of March 27, 2020; and
were incurred during the period beginning on March 1, 2020 through December 30, 2021.
Additional requirements of receiving CRF funds included retaining documentation and upholding
proper accounting records. Agency heads had to acknowledge their understanding that CRF funds
could not be used as a revenue replacement for lower-than-expected non-general fund revenue
collections or to replace any activities currently funded from the general fund or non-general fund
revenues. Additionally, CRF funds provided could not be used to offset future budget reductions.

12
For each certification completed, the agency had to agree to use the funding only for the purpose
at which they were requesting. It was also not permissible for CRF funds to be used for purposes
of matching other federal funds unless specifically authorized by federal statute, regulation, or
guideline. These certifications were then reviewed by DPB, who made recommendations to the
Governor, who ultimately approved or denied these funding requests. Following initial
administrative allocations, the General Assembly appropriated remaining CRF funds.
2. SLFRF Funding
For the SLFRF appropriated in August 2021, agencies completed the State and Local Fiscal
Recovery Funds Certification Form7 to certify that they understand the requirements for using the
funds and that they will comply with all use, documentation, and reporting requirements
established in state and federal guidelines and laws. The agency head signed the State and Local
Fiscal Recovery Funds Certification Form to assume responsibility for ensuring that the funds will
be used for necessary expenditures incurred due to the public health emergency with respect to
COVID-19, to address negative economic impacts caused by the public health emergency, to
provide premium pay for essential workers, or to invest in water, sewer, and broadband
infrastructure as described in the Interim Final Rule and the guidance issued by the U.S.
Department of Treasury.8
This form also noted that agencies must also ensure that the intended action qualifies for the use
of the funds under the ARPA criteria and that they will not rely on the provisions for replacing lost
public sector revenue as a qualifying criterion without receiving prior written approval from the
Governor. The funds must be expended to cover necessary obligations incurred within the statutory
period between March 3, 2021, and December 31, 2024, and any funds that are not obligated on
or before December 31, 2024, by the agency or its grantee(s), must be returned to the
Commonwealth of Virginia no later than December 31, 2024.
Webinars and Office Hours
The DOA has partnered with a third-party to host webinar trainings and office hours for the
agencies to help ensure reporting compliance for the SLFRF. Webinars are conducted each quarter
to keep the agencies up to date on U.S. Treasury requirements. These webinars have covered a
wide range of information including reporting requirements, key performance indicators,
expenditure categories, capital expenditure written justifications, labor practice requirements,
DOA reporting and compliance processes, and subrecipient monitoring. Additionally, office hours
serve as a forum for agencies to ask general and topic-specific questions. Agency project contacts,
fiscal/budget officers, and compliance staff were encouraged to attend these sessions. Attendees
were also provided with the materials after each session for reference.
SLFRF Reporting Process Overview
DOA has facilitated reporting among 150 projects and provided support for more than 40 agencies.
DOA has implemented an ARPA reporting system to gather data that is reported by agencies on a

7
ARPA Execution Instructions For Agencies (virginia.gov). Agencies are required to complete this form when they
first receive SLFRF, and are not required to complete it for subsequent appropriations of SLFRF.
8
Treasury’s Final Rule was issued later on January 27, 2022.

13
quarterly basis. DOA has also developed a reporting template to capture detailed obligation and
expenditure information. Additionally, agencies are provided with several tools, including a user
guide and reporting checklist to assist with their reporting.
The DOA reporting system has a number of system checks to review agency reported data against
several logic checks. For example, the system displays errors when reported expenditures exceed
obligations. The team also reviews reported data against a checklist and follows up with agencies
to resolve any remaining issues or reconcile any data anomalies. Finally, DOA reviews the
complete reporting submission prior to uploading to the U.S. Treasury reporting system.

B. Quantitative Risk Analysis
Approach
The Figure 6 below illustrates the overarching approach employed during the quantitative risk
analysis.

Figure 6: Quantitative risk analysis

Available data points for a given agency were grouped into three core categories—Funding Data,
Internal Control Risk, and Other Risk Factors—to evaluate the agency's risk profile.
The first category, 'Funding Data,' involved calculating the SLFRF appropriation amount and CRF
expenditure amount. Funding amount is used as an approximation of the impact of a risk event
occurring – i.e., if a risk event occurs within an agency with a greater amount of funding, the
overall impact to the Commonwealth will be larger.
In the second category, 'Internal Control Risk,' four specific parameters were assessed: 1) audit
findings highlighted in the Single Audit Report for 2022, 2) ARMICS compliance status during
2022, 3) the status of corrective actions noted in quarterly reports, and 4) the recurrence of findings
observed in the 2022 and 2021 Single Audit reports.
The 'Other Risk Factors' category considered various data points related to agencies with SLFRF
funding. These factors included the number of subrecipients, beneficiaries, and contractors

14
reported by agencies, program maturity, and agency readiness scores. Program maturity was
assessed from appropriation language and other program knowledge, while agency readiness
scores considered inherent risk, compliance and control risk, program risk, and detection risk. The
analysis of other risk factors aimed to provide insights into each agency's capacity and readiness
to manage SLFRF projects. By categorizing available data points into these three distinct
categories, the analysis facilitated a clearer understanding of risk distribution and funding
allocation among the agencies, supporting more informed decision making.

Figure 7: Internal control risk, other risk factors, and funding data

This information was then used to create a quadrant mapping of agencies from lower to higher risk
and from lower to higher levels of funding to identify the higher-risk agencies with the greatest
amounts of funding.
Detailed Analysis
To incorporate qualitative risk factors, a weighted grading scale was assigned to assess agencies
for risk differentiation, and specific thresholds were established for two categories of risk scores
to differentiate agencies. The 'Internal Control Score' categorized agencies with scores of 8 or
higher as high risk, determined through an outlier analysis. Similarly, the 'Other Risk Factor Score'
identified agencies with scores of 3 or higher as high risk, aligning with insights from agency
readiness surveys. For the 'High Dollar Value' classification, agencies receiving $100 million or
more in funding were considered.
Following the calculation of these scores, agencies were categorized into four distinct clusters
based on their Risk Scores and the combined SLFRF and CRF allocations. This categorization is
graphically depicted in a four-quadrant risk matrix, serving as a visual aid to pinpoint agencies that
may warrant more comprehensive analysis.

15
Figure 8: Risk mapping of agencies

Results Summary
Ultimately, ten agencies with funding greater than $100 million were identified as higher risk,
representing an increase of one agency compared to the previous year. These ten agencies have a
combined total of $4.7 billion in allocated SLFRF and CRF funds as shown in Figure 9. Due to
the higher dollar allocation, these higher risk agencies have potential to produce the greatest
negative financial impact. Given the magnitude of impact, these agencies should have resources
prioritized to further assess, mitigate, and control risk.

Figure 9: List of ten agencies designated as high risk, high dollar value

16
C. Agency Review
The risk analysis identified ten agencies as high-risk with significant dollar values. Of these, five
agencies and projects were chosen for an in-depth analysis, based on factors including existence
of subrecipients and spending levels.
Agency Review Approach

Figure 10: Agency review approach overview

The agency review process had four components for assessment.
1. Agencye conducted interviews and collected
Understanding: Interviewsdocuments
werefrom the and
held stakeholders of the selected
documents agencies
collected to understand
from the
stakeholders
processes associated with managing the identified SLFRF pro ects.
of chosen agencies to grasp the management processes of identified SLFRF projects.

Conducted five interviews with stakeholders from the selected agencies to Analy ed relevant documents, which included ARM ICS documents and others
gain insight into their current processes provided by the agencies upon request

Statewide Single Audit Reports Agency Specific P rocess
ARMICS Documentation
from and Documentation

Figure 11: Agency information reviewed

2. Internal Control Maturity Assessment: Using the Internal Control Maturity Assessment
Framework (as shown in Figure 4 earlier in this report), the agency's process maturity was
gauged, ranging from foundational to high performing. The criteria for assessment
encompassed people, process, technology, governance, and framework.

17
Figure 12: Internal control maturity assessment summary

3. OMB Compliance Assessment: The aim was to discern how these agencies aligned with
OMB compliance areas relevant for SLFRF. This analysis assessed the presence of control
documentation and its alignment with compliance standards.

Figure 13: OMB compliance assessment

The results of this assessment were systematically organized using risk charters:

18
Figure 14: Agency risk charters

The document universe for the agency review is noted in the table below:
No. Area
1 ARMICS certification questionnaire responses & attachments
2 Statewide Single Audit Report for 2021 and 2022
3 Comptroller's Report on Statewide Financial Management and Compliance
4 OMB Compliance Supplement related evidence and responses from
Agency POCs
Table 1: Agency review document list

Limitations/Assumptions of Agency Reviews
The analysis was based on certain assumptions/limitations:
• Findings were derived from interviews with agency and project POCs, documentation from
these POCs, ARMICS documents, and audit findings up to 9/30/2023.
• The analysis assesses whether described processes and controls, based on documentation
or interviews, appear to mitigate risk. Control effectiveness was not tested.
• Future documentation or information might alter the conclusions presented.
• Some conclusions, drawn from ARMICS or audit findings, might reflect agency-wide
challenges rather than project-specific ones.
• The conclusions presented do not ensure that agencies will avoid related findings in the
future.
Conclusions of Agency Reviews
In the evaluation, several key factors, including ARMICS documentation, adherence to OMB
regulations, past audit findings, data provided by specific agencies, as well as new insights, have
solidified the assessment conclusions and reiterated earlier discoveries. The analysis identified
common weaknesses shared across agencies. These encompass concerns related to record
retention, post-funding project eligibility verification, and a necessary reliance on agencies to
produce transaction documentation upon audit and/or other requests. Additionally, we noted

19
opportunities to standardize grants management system requirements and to share best practices
across agencies managing federally funded grant programs. It is noteworthy that most agencies
have established robust grants management systems governing grant-related processes. These
factors contribute to their overall compliance with federal regulations. However, there remains an
opportunity for agencies to enhance documentation practices and invest in cross-training
initiatives.

D. OMB/ARMICS Comparison
The OMB Compliance Supplement contains six compliance requirements for SLFRF. These are
outlined in the table below with their brief descriptions.
No. Area Description
1 Activities • Lists eligible uses for fund payments
allowed/unallowed • Lists prohibited uses for fund payments
2 Allowable cost/cost • Addresses cost principles associated with funds (i.e.,
principles compliance with 2 CFR Part 200, Subpart E)
3 Period of performance • Addresses timeliness of incurred costs by agencies and
limits them to a specified time (e.g., funds must be
obligated by December 31, 2024)
• Program obligations or costs must be incurred from the
period beginning March 3, 2021 and ending on December
31, 2024. Recipients must liquidate all obligations
incurred by December 31, 2026
4 Procurement, suspension • Lists that recipients, subrecipients, and contractors need to
& debarment follow procurement standards as identified in the Uniform
Guidance
• Lists the verification obligation of agencies regarding
suspended and debarred vendors/subrecipients before
entering into contracts
5 Reporting • Lists the various types of expenditure and performance
reports associated with the funds
• Notes requirements regarding capital expenditure written
justifications
6 Subrecipient monitoring • Lists monitoring requirements for subawards
Table 2: Applicable uniform guidance areas subject to audit for SLFRF

As part of the assessment, ARMICS assessment control areas and the Commonwealth Policies and
Procedures Manual were mapped to the OMB Compliance supplement outlined in the table below.
OMB Compliance CAPP
No. No. ARMICS
Supplement Area Identifier
1 Activities 1.1 Appropriations 20105
Allowed/Unallowed Appropriations, Allotments, and Transfer
1.2 Appropriations 20110
Operating Expenditure Plan
1.3 Federal Grants Management 20605
2 Allowable Cost/Cost 2.1 Indirect Cost Recovery 20705
Principles

20
OMB Compliance CAPP
No. No. ARMICS
Supplement Area Identifier
3 Period of Performance 3.1 Cash Disbursement 20340
Capital Outlay
3.2 Cash Disbursement 20325
Revenue Refund
3.3 Cash Disbursement 20330
Petty Cash
3.4 Cash Disbursements 20350
Non-state funds
3.5 Cash Disbursements 20345
Moving & Relocation
3.6 Cash Receipts Deposits 20205
3.7 Federal Grants Management 20605
3.8 Cash Disbursements 20305
Receiving Reports
3.9 Cash Disbursements 20310
Expenditures
3.10 Cash Disbursements 20315
Prompt Payments
3.11 Cash Disbursements 20355
Purchase Charge Cards
4 Procurement, 4.1 Cash Disbursements 20305
Suspension & Receiving Reports
Debarment 4.2 Cash Disbursements 20310
Expenditures
4.3 Cash Disbursements 20315
Prompt Payments
4.4 Cash Disbursements 20355
Purchase Charge Cards
4.5 Cash Disbursements 20350
Non-state funds
4.6 Fixed Assets - Fixed Assets Acquisition 30205
Method
5 Reporting 5.1 Cash Disbursement 20340
Capital Outlay
5.2 Cash Disbursement 20325
Revenue Refund
5.3 Cash Disbursement 20330
Petty Cash
5.4 Cash Disbursements 20350
Non-state funds
5.5 Cash Disbursements 20345
Moving & Relocation

21
OMB Compliance CAPP
No. No. ARMICS
Supplement Area Identifier
5.6 Cash Receipts Deposits 20205
5.7 Federal Grants Management 20605
5.8 Cash Disbursements 20305
Receiving Reports
5.9 Cash Disbursements 20310
Expenditures
5.10 Cash Disbursements 20315
Prompt Payments
5.11 Cash Disbursements 20355
Purchase Charge Cards
6 Subrecipient 6.1 Federal Grants Management 20605
Monitoring
Table 3: ARMICS, CAPP & OMB compliance supplement areas mapping

Federal grants management is a key ARMICS assessment area which addresses monitoring of
federal funding. For this year, DOA updated the ARMICS certification questionnaire to
specifically incorporate federal grants management, subrecipient monitoring-related questions.
This helps ensure more consistent and specific certification from agencies operating federally
funded grant programs.
Additionally, the agency review included an assessment to verify the existence of contractor
suspension and debarment checks. This was noted as a gap last year, and the agency analysis
confirmed that agencies are implementing controls in this area.
Alongside monitoring of federal funding, ARMICS encompasses various other essential controls
such as those related to appropriations, cash disbursements, and inter-agency transactions.

E. Review of Other States Compliance Practices
The analysis also included a review of other states’ compliance practices related to federal funds.
Highlights of this review included the following:
• Agency Internal Control Officers (ICOs) - The Mid-Atlantic state requires each agency
to complete a self-assessment on their internal controls like the ARMICS certification
process conducted in Virginia. A feature of this self-assessment is that it requires each
agency to appoint an Internal Control Officer (ICO). The ICO reports to the agency head,
and they are required to implement and review the internal control responsibilities
established by the state. The ICO completes the yearly internal control certification, and
one section of this self-assessment relates entirely to their role. It is expected that the ICO
evaluates compliance to standards of conduct and the internal control plan, addresses any
digressions with timeliness, adjusts the scope and regularity of internal control reviews as
needed, and routinely revises policies and procedures. Establishing a position such as an
ICO in each agency has potential benefits as it would allow increased awareness of
deficiencies in their internal controls before the ARMICS assessment takes place. An ICO
ensures ongoing monitoring that could unlock continuous improvement in overall

22
compliance, whereas it is currently common to see agencies have reoccurring deficiencies
in the same areas. hile Virginia’s agency heads and fiscal officers complete the
ARMICS, this role differs in its increased focus on the internal control environment and
control activities.
• Federal Compliance Officers - Like the Mid-Atlantic state, the Northeastern state
requires the head of each department receiving SLFRF funds to designate a person as the
Department Federal Compliance Officer. The Department Federal Compliance Officer is
responsible for creating a compliance plan and must understand federal compliance and
reporting requirements. Additionally, in the Northeastern state, agencies must provide a
compliance plan before the state distributes SLFRF funding to them. While Virginia
agencies are required to explain how their request is an eligible use of funding, they are not
required to submit compliance plans to DOA, or any other overseeing agency, that detail
how they plan to administer funds in accordance with the guidance.
• Risk-based Project Monitoring – A Midwestern state has instated a risk-based
monitoring approach for its SLFRF projects. After projects are appropriated, but before
funds are expended, projects are instructed to complete a risk assessment form. Based on
their risk score from this assessment, the state determines if agency monitoring is
appropriate, or, in the case of high-risk projects, if a third-party monitor should be engaged.
This third-party assists with monitoring compliance activities. Additionally, the state has
setup an “accountability office” for COVID-relief dollars to assist with management and
oversight of these funds. Among other activities, the accountability office helps mobilize
programs and reviews grant documentation prior to grants being issued to help ensure
compliance with SLFRF guidance.
In addition to the compliance reviews above, the analysis also identified examples of states
implementing structures similar to a grants management “community of practice” in an effort to
streamline grants management practices across the state. Both initiatives demonstrate a proactive
approach to grant management, emphasizing collaboration, training, and centralized resources to
achieve effective resource utilization. Highlights of these examples are below:
• Midwestern State Grants Partnership - In a Midwestern state, the Office of Budget and
Management (OBM) has established the Midwestern State Grants Partnership, aimed at
enhancing the capabilities of grant seekers and recipients while optimizing the utilization
of federal resources. This partnership extends its support not only to state agencies, boards,
and commissions but also to local governments, non-profit organizations, and other grant
recipients. It fosters collaboration through forums like the Enterprise Grants Forum and an
Advisory Committee, offering training, centralized grant-related resources, and striving to
become the single point of contact for federal grant applications. OBM's role includes
providing guidance on federal funding management and facilitating collaboration among
state partners, emphasizing a commitment to streamlining and standardizing grant
processes.
• Statewide Grant Managers Group - In a Western state, the Grants Unit, within the Office
of the State Comptroller, oversees a grant management function that provides strategic
direction and best practices to state agencies managing both state and federal grant funds.

23
The Statewide Grant Managers Group, organized by the Grants Unit, plays a crucial role
by offering regular training sessions for grant managers, enabling collaboration and
knowledge sharing among financial and program grant managers. The introduction of
Grant Manager 101 live training in 2023, along with resources for managing state-funded
grants in collaboration with the State Grant Cohort group, reflects their commitment to
strong grants management practices. Additionally, they provide specialized guidance
related to CRF and SLFRF.

VII. Conclusion
The risk assessment identified several potential gaps for improvement in internal control over
federal funding. These areas were identified through analysis of agency documents and
information, review of policies, and quantitative analysis, while also looking at the best practices
from other states. Agencies were also classified by their potential for risk through evaluating
potential risk factors such as total funding, audit findings, and ARMICS compliance.
In summary, internal control over federal funds among executive branch agencies was
b “Op l, pp h u ” l l. Essentially, while
Commonwealth-wide internal control policies and activities appear to be adequate, they are
applied inconsistently among and within specific agencies. Specific activities that strengthened the
result of the assessment included the DOA-run ARMICS self-assessment process, DOA facilitated
reporting trainings and reporting reviews, and the initial eligibility review provided by DPB.
Specific gaps identified are listed below:
Specific potential gaps in the Commonwealth’s current state of internal control over federal funds
are:
• Inherent risks arise from Virginia's decentralized federal funds management approach
which include a lack of real-time visibility into agency internal control activities for federal
funds, reliance on self-assessments, reliance on self-reported data, and dependence on
agencies to respond to audit and/or other requests appropriately and in a timely manner;
• Lack of knowledge transfer and cross-training can impact agency-level control over funds
and can impact accuracy and timeliness of reporting;
• Consistent implementation and validation of IT-related control activities by agency
management are essential for safeguarding sensitive information; and
• The current Library of Virginia’s records retention schedule notes that records relating to
federal grant money should be maintained for three years after project completion, while
SLFRF requirements are five years.

File and source

File: 2023-RD579.pdf
Size: 1,298,584 bytes
SHA-256: 2399fec8b9d0b0c52550b9c2ae159acadc4868f168726dc5f2f160f4bea3786b
Our copy: 2023-RD579.pdf
Original: No public link identified.