Subrecipient Monitoring Audit

1. Subrecipient Monitoring Audit Harvard Medical School Research Administrators Open Forum Friday, October 13, 2017 Goda Sekmokaite, Senior Auditor Risk Management & Audit Services

2. Agenda • Provide overview of key audit elements • Background • Objectives & Risks • Scope & Approach • Share outcomes • Strengths • Opportunities • Additional considerations UNIVERSITY CONFIDENTIAL

3. Background • University-wide audit • Included in RMAS internal audit plan • Key drivers include: • Regulatory, financial, and reputational risks • FY15 A-133 finding • Subrecipient Monitoring Policy and Toolkit revisions • Co-sourced with Baker Tilly UNIVERSITY CONFIDENTIAL

4. FY16 Subawards and Expenses by Tub UNIVERSITY CONFIDENTIAL

5. Objectives and Risks • Key audit objectives: • Proper evaluation of a potential subrecipient • Sufficient oversight of subrecipient performance • Key risks considered: • Insufficient oversight of subrecipient performance • Non-compliance with federal regulations and T&Cs UNIVERSITY CONFIDENTIAL

6. Scope • Scope of audit included evaluation of: • Initial risk assessment • Annual risk assessment • Quarterly reviews – monitoring and assessments • Project monitoring and oversight • High-risk subrecipients • In-scope units: • OSP • FAS and SEAS • HMS and HSDM • SPH • Testing Period: FY16 UNIVERSITY CONFIDENTIAL

7. Data Analysis Approach UNIVERSITY CONFIDENTIAL

8. Data Analysis ResultsHigh Risk Subawards by Tub UNIVERSITY CONFIDENTIAL

9. Approach • Review documentation of current processes and draft Subrecipient Monitoring Toolkit • Data analysis to understand population and select sample • 35 subawards across 5 Tubs and 9 Orgs • Focus on high-risk subrecipients (international, red/yellow rating) • Sample testing to determine if: • Subrecipient allowed in award T&C • Subrecipient was appropriately assessed • Invoices are appropriately approved prior to payment • Subrecipient expenses in line with SOW and budget • Interviews with central, school, and departmental personnel for testing follow-up and to understand risks and challenges UNIVERSITY CONFIDENTIAL

10. Strengths Central • Initial and annual risk assessments • Collection of quarterly monitoring updates • Subrecipient Monitoring Toolkit • System support: • GMAS • Subrecipient Monitoring Database • OBI Schools and Departments • No compliance concerns identified during sample testing • Research administration infrastructure • Informal additional monitoring of high risk subrecipients • Frequent interaction between PIs and administrators UNIVERSITY CONFIDENTIAL

11. Strengths & Best Practices High Risk Subrecipient Monitoring At Harvard: • Project managers onsite at overseas location of subrecipient • Periodic site visits of subrecipient • Additional scrutiny of invoice/financial report review • Periodic requests for additional detail and/or support • New subrecipient • Unexpected items on invoice • Travel expenses Other best practice examples: • Additional approvals and documented reason for subaward • Adjusted terms and conditions of subaward agreement • Templates for invoicing with additional detail • Invoices tied to specific milestones/deliverables • Evidence of progress or mandatory teleconferencing UNIVERSITY CONFIDENTIAL

12. Opportunities • Communication • Risk level determined during risk assessments • Quarterly monitoring results • Quarterly monitoring process • Time intensive • Manual • Static subaward data • Subaward agreement terms & conditions • Additions/modifications for high risk subrecipients UNIVERSITY CONFIDENTIAL

13. Additional Considerations • Late subrecipient invoices • 11 of 35 were late • Reminder to check date and follow up and note as part of quarterly review • High risk subrecipient monitoring • Performed by some departments but not documented UNIVERSITY CONFIDENTIAL

14. Thank you!Questions? Comments? Contact Us Risk Management & Audit Services website: https://rmas.fad.harvard.edu/ Goda Sekmokaite 617-496-0427 goda_sekmokaite@harvard.edu UNIVERSITY CONFIDENTIAL