Subrecipient Monitoring Audit Harvard Medical School Research Administrators Open Forum Friday, October 13, 2017 Goda Sekmokaite, Senior Auditor Risk Management & Audit Services

UNIVERSITY CONFIDENTIAL Agenda Provide overview of key audit elements Background Objectives & Risks Scope & Approach Share outcomes Strengths Opportunities Additional considerations UNIVERSITY CONFIDENTIAL

UNIVERSITY CONFIDENTIAL Background University-wide audit Included in RMAS internal audit plan Key drivers include: Regulatory, financial, and reputational risks FY15 A-133 finding Subrecipient Monitoring Policy and Toolkit revisions Co-sourced with Baker Tilly UNIVERSITY CONFIDENTIAL

FY16 Subawards and Expenses by Tub UNIVERSITY CONFIDENTIAL

UNIVERSITY CONFIDENTIAL Objectives and Risks Key audit objectives: Proper evaluation of a potential subrecipient Sufficient oversight of subrecipient performance Key risks considered: Insufficient oversight of subrecipient performance Non-compliance with federal regulations and T&Cs UNIVERSITY CONFIDENTIAL

UNIVERSITY CONFIDENTIAL Scope Scope of audit included evaluation of: Initial risk assessment Annual risk assessment Quarterly reviews – monitoring and assessments Project monitoring and oversight High-risk subrecipients In-scope units: OSP FAS and SEAS HMS and HSDM SPH Testing Period: FY16 UNIVERSITY CONFIDENTIAL

Data Analysis Approach Identify Method Harvard Orgs with high risk subawards Pivot subaward listing: Org Subrecipient rating Foreign subrecipients Subrecipients receiving the most $ from Harvard Pivot, sort & filter subaward listing: Subrecipient organization Total issued amount Subawards with same as / relative of Harvard PI Search PI last name in Subrecipient PI name UNIVERSITY CONFIDENTIAL

Data Analysis Results High Risk Subawards by Tub Total % Foreign Red Yellow  % SPH 535 39% 76 56% 9 43% 101 50% HMS 391 28% 30 22% 5 24% 34 17% FAS 217 16% 13 10% 6 29% 15% GSE 75 5% 1 1%   12 6% UIFI 73 4% 8 HKS 41 3% 7% 15 Wyss 36 4 2% Other 1,376 100% 135 21 204 UNIVERSITY CONFIDENTIAL

UNIVERSITY CONFIDENTIAL Approach Review documentation of current processes and draft Subrecipient Monitoring Toolkit Data analysis to understand population and select sample 35 subawards across 5 Tubs and 9 Orgs Focus on high-risk subrecipients (international, red/yellow rating) Sample testing to determine if: Subrecipient allowed in award T&C Subrecipient was appropriately assessed Invoices are appropriately approved prior to payment Subrecipient expenses in line with SOW and budget Interviews with central, school, and departmental personnel for testing follow-up and to understand risks and challenges UNIVERSITY CONFIDENTIAL

UNIVERSITY CONFIDENTIAL Strengths Central Initial and annual risk assessments Collection of quarterly monitoring updates Subrecipient Monitoring Toolkit System support: GMAS Subrecipient Monitoring Database OBI Schools and Departments No compliance concerns identified during sample testing Research administration infrastructure Informal additional monitoring of high risk subrecipients Frequent interaction between PIs and administrators UNIVERSITY CONFIDENTIAL

Strengths & Best Practices High Risk Subrecipient Monitoring At Harvard: Project managers onsite at overseas location of subrecipient Periodic site visits of subrecipient Additional scrutiny of invoice/financial report review Periodic requests for additional detail and/or support New subrecipient Unexpected items on invoice Travel expenses Other best practice examples: Additional approvals and documented reason for subaward Adjusted terms and conditions of subaward agreement Templates for invoicing with additional detail Invoices tied to specific milestones/deliverables Evidence of progress or mandatory teleconferencing UNIVERSITY CONFIDENTIAL

UNIVERSITY CONFIDENTIAL Opportunities Communication Risk level determined during risk assessments Quarterly monitoring results Quarterly monitoring process Time intensive Manual Static subaward data Subaward agreement terms & conditions Additions/modifications for high risk subrecipients UNIVERSITY CONFIDENTIAL

Additional Considerations Late subrecipient invoices 11 of 35 were late Reminder to check date and follow up and note as part of quarterly review High risk subrecipient monitoring Performed by some departments but not documented UNIVERSITY CONFIDENTIAL

Thank you! Questions? Comments? Contact Us Risk Management & Audit Services website: https://rmas.fad.harvard.edu/ Goda Sekmokaite 617-496-0427 goda_sekmokaite@harvard.edu UNIVERSITY CONFIDENTIAL