Subrecipient Monitoring Audit Harvard Medical School Research Administrators

Subrecipient Monitoring Audit Harvard Medical School Research Administrators Open Forum Friday, October 13, 2017 Goda Sekmokaite, Senior Auditor Risk Management & Audit Services

Agenda ¢ ¢ Provide overview of key audit elements l Background l Objectives & Risks l Scope & Approach Share outcomes l Strengths l Opportunities l Additional considerations UNIVERSITY CONFIDENTIAL

Background ¢ University-wide audit ¢ Included in RMAS internal audit plan ¢ Key drivers include: ¢ l Regulatory, financial, and reputational risks l FY 15 A-133 finding l Subrecipient Monitoring Policy and Toolkit revisions Co-sourced with Baker Tilly UNIVERSITY CONFIDENTIAL

FY 16 Subawards and Expenses by Tub 600 $70, 000 $60, 000 500 $50, 000 400 $40, 000 300 $30, 000 200 $20, 000 100 $10, 000 0 $0 SPH HMS FAS GSE Subawards UIFI SEAS HKS Subcontract Expenses UNIVERSITY CONFIDENTIAL Wyss Other

Objectives and Risks ¢ ¢ Key audit objectives: l Proper evaluation of a potential subrecipient l Sufficient oversight of subrecipient performance Key risks considered: l Insufficient oversight of subrecipient performance l Non-compliance with federal regulations and T&Cs UNIVERSITY CONFIDENTIAL

Scope ¢ Scope of audit included evaluation of: l l l ¢ In-scope units: l l ¢ Initial risk assessment Annual risk assessment Quarterly reviews – monitoring and assessments Project monitoring and oversight High-risk subrecipients OSP FAS and SEAS HMS and HSDM SPH Testing Period: FY 16 UNIVERSITY CONFIDENTIAL

Data Analysis Approach Identify Method Harvard Orgs with high risk subawards Pivot subaward listing: • Org • Subrecipient rating • Foreign subrecipients Subrecipients receiving the most $ from Harvard Pivot, sort & filter subaward listing: • Subrecipient organization • Total issued amount • Subrecipient rating • Foreign subrecipients Subawards with same as Search PI last name in Subrecipient / relative of Harvard PI PI name UNIVERSITY CONFIDENTIAL

Data Analysis Results High Risk Subawards by Tub Total % % Foreign Red % Yellow % SPH 535 39% 76 56% 9 43% 101 50% HMS 391 28% 30 22% 5 24% 34 17% FAS 217 16% 13 10% 6 29% 30 15% GSE 75 5% 1 1% 12 6% UIFI 73 5% 6 4% 8 4% HKS 41 3% 9 7% 15 7% Wyss 36 3% 4 2% Other 8 1% Total 1, 376 100% 135 1 5% 100% UNIVERSITY CONFIDENTIAL 21 100% 204 100%

Approach ¢ Review documentation of current processes and draft Subrecipient Monitoring Toolkit ¢ Data analysis to understand population and select sample l l ¢ Sample testing to determine if: l l ¢ 35 subawards across 5 Tubs and 9 Orgs Focus on high-risk subrecipients (international, red/yellow rating) Subrecipient allowed in award T&C Subrecipient was appropriately assessed Invoices are appropriately approved prior to payment Subrecipient expenses in line with SOW and budget Interviews with central, school, and departmental personnel for testing follow-up and to understand risks and challenges UNIVERSITY CONFIDENTIAL

Strengths Central ¢ Initial and annual risk assessments ¢ Collection of quarterly monitoring updates ¢ Subrecipient Monitoring Toolkit ¢ System support: l l l GMAS Subrecipient Monitoring Database OBI Schools and Departments ¢ No compliance concerns identified during sample testing ¢ Research administration infrastructure ¢ Informal additional monitoring of high risk subrecipients ¢ Frequent interaction between PIs and administrators UNIVERSITY CONFIDENTIAL

Strengths & Best Practices High Risk Subrecipient Monitoring At Harvard: ¢ Project managers onsite at overseas location of subrecipient ¢ Periodic site visits of subrecipient ¢ Additional scrutiny of invoice/financial report review ¢ Periodic requests for additional detail and/or support l l l New subrecipient Unexpected items on invoice Travel expenses Other best practice examples: ¢ Additional approvals and documented reason for subaward ¢ Adjusted terms and conditions of subaward agreement ¢ Templates for invoicing with additional detail ¢ Invoices tied to specific milestones/deliverables ¢ Evidence of progress or mandatory teleconferencing UNIVERSITY CONFIDENTIAL

Opportunities ¢ Communication l l ¢ Quarterly monitoring process l l l ¢ Risk level determined during risk assessments Quarterly monitoring results Time intensive Manual Static subaward data Subaward agreement terms & conditions l Additions/modifications for high risk subrecipients UNIVERSITY CONFIDENTIAL

Additional Considerations ¢ Late subrecipient invoices l 11 of 35 were late l Reminder to check date and follow up and note as part of quarterly review ¢ High risk subrecipient monitoring l Performed by some departments but not documented UNIVERSITY CONFIDENTIAL

Thank you! Questions? Comments? Contact Us Risk Management & Audit Services website: https: //rmas. fad. harvard. edu/ Goda Sekmokaite 617 -496 -0427 goda_sekmokaite@harvard. edu UNIVERSITY CONFIDENTIAL