1. Subrecipient Monitoring Audit
Harvard Medical School
Research Administrators Open Forum
Friday, October 13, 2017
Goda Sekmokaite, Senior Auditor
Risk Management & Audit Services

2. UNIVERSITY CONFIDENTIAL
Agenda
Provide overview of key audit elements
Background
Objectives & Risks
Scope & Approach
Share outcomes
Strengths
Opportunities
Additional considerations
UNIVERSITY CONFIDENTIAL

3. UNIVERSITY CONFIDENTIAL
Background
University-wide audit
Included in RMAS internal audit plan
Key drivers include:
Regulatory, financial, and reputational risks
FY15 A-133 finding
Subrecipient Monitoring Policy and Toolkit revisions
Co-sourced with Baker Tilly
UNIVERSITY CONFIDENTIAL

4. FY16 Subawards and Expenses by Tub
UNIVERSITY CONFIDENTIAL

5. UNIVERSITY CONFIDENTIAL
Objectives and Risks
Key audit objectives:
Proper evaluation of a potential subrecipient
Sufficient oversight of subrecipient performance
Key risks considered:
Insufficient oversight of subrecipient performance
Non-compliance with federal regulations and T&Cs
UNIVERSITY CONFIDENTIAL

6. UNIVERSITY CONFIDENTIAL
Scope
Scope of audit included evaluation of:
Initial risk assessment
Annual risk assessment
Quarterly reviews – monitoring and assessments
Project monitoring and oversight
High-risk subrecipients
In-scope units:
OSP
FAS and SEAS
HMS and HSDM
SPH
Testing Period: FY16
UNIVERSITY CONFIDENTIAL

7. Data Analysis Approach
Identify
Method
Harvard Orgs with high risk subawards
Pivot subaward listing:
Org
Subrecipient rating
Foreign subrecipients
Subrecipients receiving the most $ from Harvard
Pivot, sort & filter subaward listing:
Subrecipient organization
Total issued amount
Subawards with same as / relative of Harvard PI
Search PI last name in Subrecipient PI name
UNIVERSITY CONFIDENTIAL

8. Data Analysis Results High Risk Subawards by Tub
Total %
Foreign
Red
Yellow  %
SPH
535
39% 76
56% 9
43%
101
50%
HMS
391
28% 30
22% 5
24% 34
17%
FAS
217
16% 13
10% 6
29%
15%
GSE 75 5% 1 1% 12 6%
UIFI 73 4% 8
HKS 41 3% 7% 15
Wyss 36 4 2%
Other
1,376
100%
135 21
204
UNIVERSITY CONFIDENTIAL

9. UNIVERSITY CONFIDENTIAL
Approach
Review documentation of current processes and draft Subrecipient Monitoring Toolkit
Data analysis to understand population and select sample
35 subawards across 5 Tubs and 9 Orgs
Focus on high-risk subrecipients (international, red/yellow rating)
Sample testing to determine if:
Subrecipient allowed in award T&C
Subrecipient was appropriately assessed
Invoices are appropriately approved prior to payment
Subrecipient expenses in line with SOW and budget
Interviews with central, school, and departmental personnel for testing follow-up and to understand risks and challenges
UNIVERSITY CONFIDENTIAL

10. UNIVERSITY CONFIDENTIAL
Strengths
Central
Initial and annual risk assessments
Collection of quarterly monitoring updates
Subrecipient Monitoring Toolkit
System support:
GMAS
Subrecipient Monitoring Database
OBI
Schools and Departments
No compliance concerns identified during sample testing
Research administration infrastructure
Informal additional monitoring of high risk subrecipients
Frequent interaction between PIs and administrators
UNIVERSITY CONFIDENTIAL

11. Strengths & Best Practices High Risk Subrecipient Monitoring
At Harvard:
Project managers onsite at overseas location of subrecipient
Periodic site visits of subrecipient
Additional scrutiny of invoice/financial report review
Periodic requests for additional detail and/or support
New subrecipient
Unexpected items on invoice
Travel expenses
Other best practice examples:
Additional approvals and documented reason for subaward
Adjusted terms and conditions of subaward agreement
Templates for invoicing with additional detail
Invoices tied to specific milestones/deliverables
Evidence of progress or mandatory teleconferencing
UNIVERSITY CONFIDENTIAL

12. UNIVERSITY CONFIDENTIAL
Opportunities
Communication
Risk level determined during risk assessments
Quarterly monitoring results
Quarterly monitoring process
Time intensive
Manual
Static subaward data
Subaward agreement terms & conditions
Additions/modifications for high risk subrecipients
UNIVERSITY CONFIDENTIAL

13. Additional Considerations
Late subrecipient invoices
11 of 35 were late
Reminder to check date and follow up and note as part of quarterly review
High risk subrecipient monitoring
Performed by some departments but not documented
UNIVERSITY CONFIDENTIAL

14. Thank you! Questions? Comments?
Contact Us
Risk Management & Audit Services website:
Goda Sekmokaite
UNIVERSITY CONFIDENTIAL