Revised Subrecipient Monitoring Policies and Procedures

1. Revised Subrecipient Monitoring Policies and Procedures

2. JHU’s ResponsibilityUnder Federal Regulation • Per OMB Circular A-133, a prime recipient of federal funding who passes-through a portion of that funding to another entity shall: • Advise subrecipients of requirements imposed by Federal laws, regulations, and the provisions of contracts or grant agreements • Monitor to ensure that Federal awards are used for authorized purposes in compliance with laws, regulations, and grant terms • Ensure that subrecipients meet A-133 audit requirements

3. Subrecipient Taskforce Update • Working group developed proposed changes and circulated amongst the university for feedback • Changes are meant to protect both JHU and faculty interests • Changes are meant to enhance overall risk management, both regulatory and financial • Proposed changes agreed upon: • Classification of subrecipient vs. contractor • Revised risk assessment procedures and risk ratings for all subrecipients • Monitoring procedures for high-risk subrecipients • New risk assessment complete and posted on Financial Research Compliance website • New procedures are effective as of July 1, 2014

4. New Procedure 1: Contractor vs. Subrecipient Classification • Classifying organizations as subrecipients presents additional compliance burden • Enhanced guidance on classification developed • Sub vs. contractor Quick Guide

5. New Procedure 1: Contractor vs. Subrecipient Classification Contractor vs. Subrecipient Detailed Guidance • Contractor if the entity: • Is providing services in support of the research program • Has not participated significantly in the design of the work • Is not directly responsible for project results • Provides goods and services in the normal operations and markets these to a variety of customers • Has little or no independent decision making in the design or conduct of the work being completed • Performs work that involves routine or repeated activities • Would not seek to publish or co-author results • Subrecipient if the entity: • Is engaged in substantive programmatic work • Participates in designing or conducting the work • Is granted some level of programmatic control • May seek to publish or co-author results • Provides cost sharing • Has key personnel

6. New Procedure 1: Contractor vs. Subrecipient Classification • OMB Uniform Guidance will require classification decisions to be documented • During proposal phase or as prospective subrecipients are identified, departments will complete the Subrecipient Determination Form • Form must be signed by Principal Investigator • Form will be submitted to the Office of Research Administration (ORA) with the Proposal • ORA must explicitly approve classification

7. New Procedure 2: Subrecipient Risk Rating • Subrecipients will now be classified as high or low risk • High-risk entities are defined as: • Foreign • Domestic subrecipients without formal compliance audit (A-133) • Entities with no prior JHU work history • Entities who received less than $1M in Federal funding in either of the last two years • The Office of Research Administration will be responsible for risk rating • A subrecipient committee has been established to consider changes to risk rating

8. New Procedure 2: Subrecipient Risk Rating • A risk rating database of all JHU subrecipients has been established here: http://finance.jhu.edu/depts/frc/data_files_frc/subrecipientriskrating.xls • Risk ratings are consistent across JHU • Excerpt from the database:

9. New Procedure 2: Subrecipient Risk Rating • Once a subrecipient classification has been approved by the Office of Research Administration (ORA), ORA will perform a risk rating • In doing so, Research Administration may do the following: • For current subs, consult the initial Subaward Risk Assessment Database • For new subs, require completion of the "Subrecipient Financial Information Questionnaire” including submission of recent A-133 reports • ORA will document and communicate the subrecipient's risk rating to FRC • Using the risk rating, ORA will negotiate specific terms and conditions into the agreement consistent with the revised post-award monitoring procedures • ORA will notify the department and Principal Investigator of the risk rating

10. New Procedure 2: Changes to Subrecipient Risk Rating • Changes to subrecipient risk rating will be considered by an Institutional Subrecipient Committee who will meet on a quarterly basis to discuss current subrecipient issues • Members of the Committee include: • JHU Finance • Internal Audit • Chief Risk Officer • Divisional Research Administration and Business Office Personnel • Divisional Departmental Representation • A form will be developed for requests to change subrecipient risk ratings • The form must accompany copies of the most recent subrecipient A-133 report and the latest summary and detailed invoice reviews, and must be presented in person to the Subrecipient Committee • The Committee will base their decision on the information provided, taking into account: • Nature and size of subrecipient • Recent work history • Recent A-133 Audit results • Results of last summary and detailed invoice reviews

11. New Procedure 3: Enhanced Invoice Review Guidance Enhanced Invoice Review Guidance • All invoices (high and low risk) • Review for standard invoice elements as required by current policy (e.g., cumulative costs, certification etc.) • Review for financial accuracy • Expense in line with budget category amounts • Amounts aren’t round dollars solely based on a percentage of budget • Previous expense + Current expense = Cumulative expense for each budget category • Column totals equal the amount of individual column amounts in total • Fringe cost are in line with salary expense for the agreed upon fringe rate • Facilities and Administrative (F&A) costs are in line with applicable costs for the agreed upon F&A rate • Certification for Payment and Performance form required for all invoices

12. New Procedure 3: Enhanced Invoice Review Guidance Review for Standard Invoice Elements • Name of the subrecipient • JHU purchase order number • Date of the invoice • Invoice number and project title • Period of performance covered by the invoice • Breakdown of costs in accordance with expenditure categories • Current period costs and cumulative project costs • Cost sharing (if applicable) • Program income (if generated) • Contact person for invoice questions • Certification as to the truth and accuracy of the invoice 1 4 3 2 4 5 6 7 11 10

13. New Procedure 3: Enhanced Invoice Review Guidance Previous + Current = Cumulative Recalculate fringe Review for Financial Accuracy Review period of performance Recalculate totals Matching expenditure categories No round dollars Recalculate F&A

14. New Procedure 3: Enhanced Invoice Review Guidance • Certification for Payment and Performance must be completed for all invoices • Approval by both Financial Analyst and Principal Investigator is required • Form must be included with invoice in order to process payment in SAP • Form is located on JHU Finance website. Here is the link: https://apps.finance.jhu.edu/policy_procedures/policy/sub/cert_pymt_perf.docx

15. New Procedure 4: Additional Monitoring for High-Risk Subrecipients • High-risk subrecipients will be required to submit general ledger summary and detailed financial reports along with all invoices • Departmental personnel will be responsible for completing a summary comparison of the invoice to the financial reports • Every six months, departmental personnel will complete a more detailed review of a subrecipient financial report supporting one invoice, including obtaining supporting documentation for a selection of charges • The Certification for Payment and Performance form has been revised to evidence these reviews • Problems identified with billings must be resolved and the resolution documented

16. New Procedure 4: Additional Monitoring for High-Risk Subrecipients • Invoice Summary Review (every invoice) Ensure totals match

17. New Procedure 4: Enhanced Invoice Review Guidance • Certification for Payment and Performance must be completed for all invoices • Form must be uploaded with invoice and subrecipient ledger in order to process payment in SAP • If high-risk subrecipient: • A summary review is required to be performed and must be documented on the Certification for Payment and Performance • Date of last detailed review must also be documented

18. New Procedure 4: Additional Monitoring for High-Risk Subrecipients • Step 1: Invoice Detailed Review (every six months) Ensure totals match

19. New Procedure 4: Additional Monitoring for High-Risk Subrecipients • Step 2: Invoice Detailed Review (every six months) Review all transactions for allowability against subaward agreement and relevant OMB Circular

20. New Procedure 4: Additional Monitoring for High-Risk Subrecipients • Step 2: Invoice Detailed Review (every six months) • Ensure all amounts agree between ledger and invoices Sample transactions from ledger and obtain supporting documentation from subrecipient Jacque Rival Appointment Letter Labor Distribution Effort reporting (if available) Timesheets (if applicable) Fedex Invoice Airgas Invoice

21. New Procedure 4: Additional Monitoring for High-Risk Subrecipients • How to handle discrepancies identified during invoice reviews: • Must be resolved prior to payment • Partial payments of invoices are allowable (e.g., withholding questioned costs) • Significant discrepancies may indicate the need for a 100% desk audit of the specific invoice or all invoices depending on the nature of the concern • Resolutions must be formally documented on the invoice or payment certification form • At discretion of departments, results may dictate future invoicing requirements (e.g., submission of timesheets with every invoice)

22. New Procedure 4: Additional Monitoring for High-Risk Subrecipients • Certification for Payment and Performance must be completed for all invoices • This should not be completed until all questions about costs have been resolved • If high-risk subrecipient: • Document the summary review • Document that the detailed review has taken place on the Certification for Payment and Performance including the date performed • Upload all support into SAP

23. Conclusion • JHU has a different subrecipient risk-profile than our peers • JHU is required to advise subrecipients of their responsibilities under federal regulations and then to monitor to ensure they are being met • Subrecipients’ issues could have a significant financial impact on JHU and the reputations of its faculty members • New procedures around subrecipient classification, risk rating, and invoice review will go into effect on July 1, 2014 • More documentation will be required to validate expenditures from high-risk subrecipients

24. Resources This page contains links to the various resources mentioned throughout this presentation. You can click on the links or copy and paste the links into your web browser. contractor Vs. Subrecipient Guide: JHU Subrecipient Policies and Procedures http://finance.jhu.edu/policyapp/displayGuideContents.do?guideId=SUB JHU Subrecipients Risk Rating Database: http://finance.jhu.edu/depts/frc/data_files_frc/subrecipientriskrating.xls