Deeper Than the Headlines: Federal Grants Compliance

The Federal government awards many grants every year.  One of the main agencies involved in grants for healthcare entities is the National Institutes of Health (NIH).  In Federal fiscal year (FY) 2015, NIH awarded more than $16 billion in grants and contracts to domestic institutions of higher education, and in FY 2016, NIH awarded more than $18 billion.

One of those institutions was Northwestern University which the NIH awarded more than $268 million in FY 2015 and more than $307 million in FY 2016.  The OIG recently released a report on how well Northwestern complied with certain compliance requirements for institutions receiving federal grants. The report is very useful for compliance programs that play a role in grants compliance at any institution.

The regulations at 45 CFR part 75 describe subrecipient monitoring and management requirements applicable to all non-Federal entities that provide a subaward to carry out part of a Federal program. Northwestern, as a prime recipient and subrecipient, is required to comply with applicable Federal requirements and ensure that grant costs submitted for Federal reimbursement are reasonable, allocable, and otherwise allowable. The regulations state that pass-through entities must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward to determine the appropriate subrecipient monitoring.

This risk assessment may consider such factors as:

• the subrecipient’s prior experience with the same or similar subawards;
• the results of previous audits, including whether the subrecipient receives an A133 audit, and the extent to which the same or similar subawards have been audited as a major program;
• whether the subrecipient has new personnel or new or substantially changed systems; and
• the extent and results of HHS awarding agency monitoring (e.g., whether the subrecipient also receives Federal awards directly from a Federal awarding agency).

Federal criteria require that costs:

• be necessary and reasonable for the performance of the Federal award and be allocable under these principles,
• conform to any limitations or exclusions set forth in these principles or in the Federal award,
• be consistent with policies and procedures that apply uniformly to both federally financed activities and other activities of the non-Federal entity,
• be determined in accordance with Generally Accepted Accounting Principles, and
• be adequately documented.

In its review of Northwestern, the OIG learned that Northwestern uses a risk-based approach to subrecipient monitoring, focusing on those subrecipients deemed at greatest risk for non-compliance. Criteria for assigning a level of risk include:

• size of the subrecipient award,
• award size relative to the subrecipient's sponsored research portfolio,
• award complexity
• prior experience with the subrecipient,
• percentage of award passed through to subrecipient,
• subrecipient location or for-profit status,
• degree of external oversight by auditors or sponsoring agencies, and
• sophistication of the subrecipient's administrative systems and operations.

Northwestern’s risk analysis process included a check of the U.S. General Services Administration’s System for Award Management website to determine whether the subrecipient:

1. had active registration,
2. had an active exclusion prohibiting it from receiving Federal funding, or
3. had any Federal debt subject to offset.

Northwestern also reviewed Financial Conflict of Interest (FCOI) Institutional Clearinghouse to determine whether the subrecipient followed Public Health Service (PHS) FCOI Requirements. Northwestern implements a level of departmental monitoring that reflects the risk or exposure that results from subcontracting the funds. If the subrecipient was subject to an A-133 audit, Northwestern used the summary of the auditor’s results as another tool in determining the level of risk. If the subrecipient did not have an A-133 audit, Northwestern sent a subrecipient monitoring questionnaire to the subrecipient. Northwestern used the completed questionnaire to fill out a risk analysis spreadsheet. The answers are scored and totaled to arrive at a low, medium, or high-risk assessment. If Northwestern determined that the subrecipient was a medium risk, Northwestern issued the award. Northwestern continued the risk analysis if the A-133 audit report identified high-risk areas and included findings.

What the OIG found:

Although Northwestern claimed allowable expenditures on subawards it awarded and received, it did not always perform required subaward risk assessments. For 24 of the 30 grants to subrecipients, Northwestern did not perform a risk assessment on 1 or more of the subrecipients. Federal funds of approximately $9,744,000 were awarded to subrecipients without performing the required risk assessment.

The 30 grants had subawards to 61 subrecipients, 48 of which should have had a risk assessment, but did not. The remaining 13 subrecipients either had a risk assessment or were not required to have a risk assessment.

Northwestern did not always conduct a risk assessment on its affiliates and FDP member organizations.  In FYs 2015 and 2016, Northwestern categorized the affiliates and FDP member organizations as low risk solely because Northwestern’s institutional experience with these organizations was positive, and Federal awarding agencies had made awards to the organizations. Additionally, although required under 45 CFR part 75, Northwestern did not always perform risk assessments of subrecipients that were issued initial subawards before December 26, 2014, but received incremental funding after December 26, 2014. Neither Federal statutes, regulations, nor the terms and conditions of subawards permit prime Federal award recipients to exempt affiliates, FDP members, or subrecipients from a risk assessment. Because Northwestern classified some of its subrecipients as low risk, it did not perform a risk assessment on associated Federal funds of approximately $9,744,000.

Of the $1.8 million in subaward costs reviewed as part of our judgmental sample, Northwestern claimed allowable costs on subawards awarded and received. Northwestern followed NIH grant policies and Federal regulations for these subaward expenditures for each selected grant. In addition, Northwestern claimed allowable F&A costs at the appropriate F&A rate.

OIG recommended that Northwestern:

• establish policies to perform subrecipient risk assessments for affiliates, FDP members, and non-Federal subrecipients subject to 45 CFR part 75, and
• ensure that subrecipient risk assessments are performed on all non-Federal subrecipients subject to 45 CFR part 75.

If your organization is involved in federal grants make sure your compliance program professionals consider reviewing this report and applying guidelines as appropriate for your organization.