1. Copyright © 2008 NCURA Subrecipient Risk Assessments – or Judging our Friends Pamela Webb Associate Vice President for Research Administration University of Minnesota Andy Horner Director, Health and Education Group Huron Consulting Group Csilla Csaplár Contract and Grant Officer, Office of Sponsored Research Stanford University

2. Copyright © 2008 NCURA Objectives What do we need to understand about federal regulations to assess subaward risk? What tools are institutions using to meet A-133 risk assessment obligations? How do different risk profiles impact the subaward instrument, language, or monitoring? When, if ever, is a subaward too risky?

3. Copyright © 2008 NCURA Background, Definitions & Federal Regulations

4. Copyright © 2008 NCURA Federal Regulations The following regulations guide Subawards and Subrecipient Monitoring: OMB Circular A-133 OMB Circular A-110 Federal Acquisition Regulations (FAR) Primarily for contract as funding mechanism

5. Copyright © 2008 NCURA Definitions Subrecipient Monitoring is the process of providing oversight on subawards throughout their lifecycle including: Obtaining the appropriate information prior to submitting the proposal (statement of intent, accurate budget, statement of work) Reviewing appropriateness of subawardee Executing an agreement consistent with A-133 requirements Acquiring signed A-133 certification statements (from other A-133 institutions)

6. Copyright © 2008 NCURA OMB Circular A-133 Pass-through Entity Responsibilities: Ensure that federal funds are used for authorized purposes in accordance with laws, regulations and provisions of the prime award. Ensure that performance goals are met. Monitor the activities of the subrecipient to ensure compliance. Ensure that subrecipients expending $500K or more annually have met the audit requirements for that fiscal year. Issue a management decision on audit findings, if necessary, and ensure that the subrecipient takes appropriate and timely corrective action. Provide prime award information to subrecipients. Conduct on-going review and oversight of subrecipient progress and compliance

7. Copyright © 2008 NCURA Compliance Environment

8. Copyright © 2008 NCURA Compliance Environment In the last several years the Office of Inspector General (OIG) has pursued a number of issues related to accounting for and substantiating the appropriate and compliant use of Federal funds for research. DHHS OIG 2006 Workplan: Subrecipient Costs and Monitoring: “We will determine whether college and universities are complying with applicable Federal regulations to monitor subrecipient costs. OMB Circulars A-110 and A-133 require that grantees monitor subawards and ensure subrecipients have met audit requirements. Grantee monitoring should take place during and after the award, and should include site visits, review of performance and financial reports, and development of risk assessments based on relevant factors to ensure a proper level of monitoring. Our reviews at three institutions show that grantees are not adequately complying with Federal requirements.”

9. Copyright © 2008 NCURA Recent Settlements and Audits Subrecipient Monitoring University of Massachusetts Medical School (UMMS) and Yale University Key elements of complaint  NIH Award to UMMS  UMMS issued subaward to Yale University  Audit report alleges that Yale claimed $193,779 in costs that did not comply with OMB Circular A-21 and the terms of the subgrant. Because Yale received its funds through a subgrant from UMMS rather than directly from NIH, audit recommended under separate cover that UMMS reimburse NIH for unallowable subgrant costs totaling $193,779. Yale currently under federal investigation George Washington University Payments made to fake subcontractors GWU agreed to $1.8 million settlement with DOJ Former PI stole nearly $1 million was sentenced to prison

10. Copyright © 2008 NCURA Recent Settlements and Audits Subrecipient Monitoring University of Puerto Rico (UPR) Key elements of the complaint  The audit found $16,000 in questioned subawardee costs and that UPR’s internal controls for subawardee costs are lacking.  Two subawardees were unable to provide adequate supporting documentation and one subawardee duplicated billing for indirect costs.  Subawards were not adequately monitored because UPR’s policies and procedures did not include a risk-based system for monitoring and reporting subaward costs. UPR agreed with the findings and is launching a new subrecipient monitoring system.

11. Copyright © 2008 NCURA Risk Management

12. Copyright © 2008 NCURA Risk Management Methods to Evaluate Institutional Exposure Review policies and procedures for subrecipient monitoring. Ensure 100% completion of A-133 audit certifications. Confirm subcontract template meets A-133 requirements. Review process to pre-qualify subrecipients. Determine if roles and responsibilities for pre-award, post-award and department levels are clearly defined.

13. Copyright © 2008 NCURA Risk Management Methods to Evaluate Institutional Exposure Determine if subrecipient monitoring approach is risk-based (which is a preferred industry practice): A-133 institutions may need less overall monitoring. Desk audits for some sites. Smaller, less savvy institutions might merit increased oversight. Review the process used to monitor subrecipient performance: Review of audit reports. Approval of invoices by the PI. Review of invoices and reports by research accounting.

14. Copyright © 2008 NCURA Managing Risk: Review Audit Reports A-133 entities Federal Audit Clearinghouse for A-133 (aka Harvester at http://harvester.census.gov/sac/) or review of institution’s A- 133 audit report or certification http://harvester.census.gov/sac/ Non-A-133 entities Consider requesting completion of an Audit questionnaire For-profit entities DCAA-cognizant or ONR Resident Representative can review for you

15. Copyright © 2008 NCURA Potential Indications of High-Risk Significant audit findings relative to research and development, or failure to have a current audit report History of non-compliance History of non-performance or failure to use funds for their authorized purposes New subrecipient (or new to this type of project) New personnel or systems Large subaward/large percentage pass-through Award size relative to subrecipient’s sponsored research portfolio Criticality to overall success of pass-through entity’s project Program complexity Type of subrecipient (is the subrecipient already subject to A- 133?) Factors that may affect the extent of monitoring required:

16. Copyright © 2008 NCURA Implement Corrective Action Plan for audit findings or yet-to-be developed internal controls Write a more detailed Statement of Work with explicit understandings about methodology, procedures, and deliverables - and consequences for not meeting them Authorize more limited allotments of time and money Require more frequent technical reporting, additional correspondence with PI Engage in “agreed-upon procedures engagements” or other external audit Add more detailed or frequent invoicing requirements Add requirement for expenditure backup materials* Tie payments to receipt of satisfactory technical progress reports Require on-site monitoring (technical and financial) Add more stringent termination or stop-work language for failure to comply with requirements Include obligation to promptly notify you of changes in audit status, compliance approvals, conflict of interest, or management plan Potential Responses to High Risk Subrecipients *Be careful of what you ask for! You have to review it, and they may ask you for the same in a reverse situation!

17. Copyright © 2008 NCURA Understanding Risk LowMediumHigh Simple Program e.g., R03 Basic Program e e.g., R01 Complex Program e.g., Center Grant Low % of Awards Passed Through Subrecipient Standard % of Awards Passed Through Subrecipient High % of Awards Passed Through Subrecipient Small AwardStandard AwardLarge Award Long History with SubrecipientSome History with SubrecipientNo History with Subrecipient No Compliance ProblemsResponsive to Minor Compliance Issues Known History of Compliance Problems

18. Copyright © 2008 NCURA Risk Assessment Exercise Evaluate each case study and complete a risk analysis matrix for each one to determine if the subrecipient might be considered low, medium or high risk. Are there any special considerations needed? What controls might you put in place?

19. Copyright © 2008 NCURA Choose the Right Instrument Low Risk http://www.thefdp.org/Subawards_Forms.html High Risk Full agreement with explicit flow down clauses, in full text if subrecipient is inexperienced Extra language inserted to address perceived risk areas or deficiencies

20. Copyright © 2008 NCURA Fixed Price versus Cost- Reimbursement Cost-Reimbursement (Pass-through assumes greatest risk) Work cannot be precisely defined or cost precisely estimated (much of what we do!) Allows greatest flexibility (add $$ or time as mutually agreed and perform work within scope until funds/time are exhausted) Common for other educational institutions, hospitals, and non-profits Fixed Price (Subrecipient assumes greatest risk) Appropriate if there can be a clear work scope, solid cost estimate and well-articulated deliverables Lower administrative burden for prime Common for foreign entities and for-profits May be appropriate for small entities

21. Copyright © 2008 NCURA How Can you Tell if You have Managed Your Risk Satisfactorily? Technical progress is being made according to schedule Acceptable deliverables or progress reports are received on-time Adequate communication is happening between PI and Subrecipient PI Award modifications occur as needed Subrecipient has proper control of property Subrecipient is continuing to meet compliance requirements Subrecipient is submitting acceptable invoices on time Required prior approvals are obtained Annual review of audit status or fulfillment of corrective action plan is satisfactory

22. Copyright © 2008 NCURA Questions? Pamela Webb 612.624.1648 pwebb@umn.edu Andy Horner 312.583.8749 ahorner@huronconsultinggroup.com Csilla Csaplár 650.498.6877 csaplar@stanford.edu Contact Information: