copyright © 2008 ncura subrecipient risk assessments – or judging our friends pamela webb...

Copyright © 2008 NCURA

Subrecipient Risk Assessments – or Judging

our Friends

Pamela WebbAssociate Vice President for Research AdministrationUniversity of Minnesota

Andy HornerDirector, Health and Education GroupHuron Consulting Group

Csilla CsaplárContract and Grant Officer, Office of Sponsored ResearchStanford University


Objectives

What do we need to understand about federal regulations to assess subaward risk?

What tools are institutions using to meet A-133 risk assessment obligations?

How do different risk profiles impact the subaward instrument, language, or monitoring?

When, if ever, is a subaward too risky?


Background, Definitions & Federal Regulations


Federal Regulations

The following regulations guide Subawards and Subrecipient Monitoring:

OMB Circular A-133 OMB Circular A-110 Federal Acquisition Regulations (FAR)

Primarily for contract as funding mechanism


Definitions

Subrecipient Monitoring is the process of providing oversight on subawards throughout their lifecycle including:

Obtaining the appropriate information prior to submitting the proposal (statement of intent, accurate budget, statement of work)

Reviewing appropriateness of subawardee

Executing an agreement consistent with A-133 requirements

Acquiring signed A-133 certification statements (from other A-133 institutions)


OMB Circular A-133

Pass-through Entity Responsibilities: Ensure that federal funds are used for authorized purposes in

accordance with laws, regulations and provisions of the prime award.

Ensure that performance goals are met. Monitor the activities of the subrecipient to ensure compliance. Ensure that subrecipients expending $500K or more annually have

met the audit requirements for that fiscal year. Issue a management decision on audit findings, if necessary, and

ensure that the subrecipient takes appropriate and timely corrective action.

Provide prime award information to subrecipients. Conduct on-going review and oversight of subrecipient progress and

compliance


Compliance Environment


Compliance Environment In the last several years the Office of Inspector General (OIG) has

pursued a number of issues related to accounting for and substantiating the appropriate and compliant use of Federal funds for research.

DHHS OIG 2006 Workplan: Subrecipient Costs and Monitoring:

“We will determine whether college and universities are complying with applicable Federal regulations to monitor subrecipient costs. OMB Circulars A-110 and A-133 require that grantees monitor subawards and ensure subrecipients have met audit requirements. Grantee monitoring should take place during and after the award, and should include site visits, review of performance and financial reports, and development of risk assessments based on relevant factors to ensure a proper level of monitoring. Our reviews at three institutions show that grantees are not adequately complying with Federal requirements.”


Recent Settlements and AuditsSubrecipient Monitoring

• University of Massachusetts Medical School (UMMS) and Yale University Key elements of complaint

NIH Award to UMMS UMMS issued subaward to Yale University Audit report alleges that Yale claimed $193,779 in costs that did not

comply with OMB Circular A-21 and the terms of the subgrant. Because Yale received its funds through a subgrant from UMMS

rather than directly from NIH, audit recommended under separate cover that UMMS reimburse NIH for unallowable subgrant costs totaling $193,779.

Yale currently under federal investigation• George Washington University

Payments made to fake subcontractors GWU agreed to $1.8 million settlement with DOJ Former PI stole nearly $1 million was sentenced to prison


Recent Settlements and AuditsSubrecipient Monitoring

• University of Puerto Rico (UPR) Key elements of the complaint

The audit found $16,000 in questioned subawardee costs and that UPR’s internal controls for subawardee costs are lacking.

Two subawardees were unable to provide adequate supporting documentation and one subawardee duplicated billing for indirect costs.

Subawards were not adequately monitored because UPR’s policies and procedures did not include a risk-based system for monitoring and reporting subaward costs.

UPR agreed with the findings and is launching a new subrecipient monitoring system.


Risk Management


Risk ManagementMethods to Evaluate Institutional Exposure

Review policies and procedures for subrecipient monitoring. Ensure 100% completion of A-133 audit certifications. Confirm subcontract template meets A-133 requirements. Review process to pre-qualify subrecipients. Determine if roles and responsibilities for pre-award, post-award

and department levels are clearly defined.


Risk ManagementMethods to Evaluate Institutional Exposure

Determine if subrecipient monitoring approach is risk-based (which is a preferred industry practice): A-133 institutions may need less overall monitoring. Desk audits for some sites. Smaller, less savvy institutions might merit increased

oversight. Review the process used to monitor subrecipient performance:

Review of audit reports. Approval of invoices by the PI. Review of invoices and reports by research accounting.


Managing Risk: Review Audit Reports

A-133 entities Federal Audit Clearinghouse for A-133 (aka Harvester at

http://harvester.census.gov/sac/) or review of institution’s A-133 audit report or certification

Non-A-133 entities Consider requesting completion of an Audit questionnaire

For-profit entities DCAA-cognizant or ONR Resident Representative can

review for you


Potential Indications of High-Risk

Significant audit findings relative to research and development, or failure to have a current audit report

History of non-compliance History of non-performance or failure to use funds for their authorized

purposes New subrecipient (or new to this type of project) New personnel or systems Large subaward/large percentage pass-through Award size relative to subrecipient’s sponsored research portfolio Criticality to overall success of pass-through entity’s project Program complexity Type of subrecipient (is the subrecipient already subject to A-

133?)

Factors that may affect the extent of monitoring Factors that may affect the extent of monitoring required:required:


Implement Corrective Action Plan for audit findings or yet-to-be developed internal controls

Write a more detailed Statement of Work with explicit understandings about methodology, procedures, and deliverables - and consequences for not meeting them

Authorize more limited allotments of time and money Require more frequent technical reporting, additional correspondence with PI Engage in “agreed-upon procedures engagements” or other external audit Add more detailed or frequent invoicing requirements

Add requirement for expenditure backup materials* Tie payments to receipt of satisfactory technical progress reports Require on-site monitoring (technical and financial) Add more stringent termination or stop-work language for failure to comply with

requirements Include obligation to promptly notify you of changes in audit status, compliance

approvals, conflict of interest, or management plan

Potential Responses to High Risk Subrecipients

*Be careful of what you ask for! You have to review it, and theymay ask you for the same in a reverse situation!


Understanding Risk

Low Medium High

Simple Program

e.g., R03

Basic Program e

e.g., R01

Complex Program

e.g., Center Grant

Low % of Awards Passed Through Subrecipient

Standard % of Awards Passed Through Subrecipient

High % of Awards Passed Through Subrecipient

Small Award Standard Award Large Award

Long History with Subrecipient Some History with Subrecipient No History with Subrecipient

No Compliance Problems Responsive to Minor Compliance Issues

Known History of Compliance Problems


Risk Assessment Exercise

Evaluate each case study and complete a risk analysis matrix for each one to determine if the subrecipient

might be considered low, medium or high risk.

Are there any special considerations needed?What controls might you put in place?


Choose the Right Instrument

Low Risk

http://www.thefdp.org/Subawards_Forms.html

High Risk

•Full agreement with explicit flow down clauses, in full text if subrecipient is inexperienced•Extra language inserted to address perceived risk areas or deficiencies


Fixed Price versus Cost-Reimbursement

Cost-Reimbursement (Pass-through assumes greatest risk) Work cannot be precisely defined or cost precisely

estimated (much of what we do!) Allows greatest flexibility (add $$ or time as mutually agreed

and perform work within scope until funds/time are exhausted)

Common for other educational institutions, hospitals, and non-profits

Fixed Price (Subrecipient assumes greatest risk) Appropriate if there can be a clear work scope, solid cost

estimate and well-articulated deliverables Lower administrative burden for prime Common for foreign entities and for-profits May be appropriate for small entities


How Can you Tell if You have Managed Your Risk Satisfactorily?

Technical progress is being made according to schedule Acceptable deliverables or progress reports are received on-

time Adequate communication is happening between PI and

Subrecipient PI Award modifications occur as needed Subrecipient has proper control of property Subrecipient is continuing to meet compliance requirements Subrecipient is submitting acceptable invoices on time Required prior approvals are obtained Annual review of audit status or fulfillment of corrective action plan

is satisfactory


Questions?

Pamela [email protected]

Andy [email protected]

Csilla Csaplá[email protected]

Contact Information:Contact Information:

copyright © 2008 ncura subrecipient risk assessments – or judging our friends pamela webb...

Documents

ncura federal regulations

compliance slide

federal requirements

subrecipient costs

ncura omb circular

applicable federal regulations

ncura background

ncura objectives