oversight

The Florida Department of Economic Opportunity, Tallahassee, FL, Should Strengthen Its Capacity To Administer Its Disaster Grants

Published by the Department of Housing and Urban Development, Office of Inspector General on 2018-09-21.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

   The Florida Department of Economic
      Opportunity, Tallahassee, FL

      Office of Community Planning and Development,
       Community Development Block Grant Disaster
                    Recovery Program



Office of Audit, Region 4     Audit Report Number: 2018-AT-1010
Atlanta, GA                                   September 21, 2018
To:            Stanley Gimont, Deputy Assistant Secretary, Office of Deputy Assistant Secretary
               for Grant Programs, DG

                    //Signed//
From:          Nikita N. Irons, Regional Inspector General for Audit, 4AGA
Subject:       The Florida Department of Economic Opportunity, Tallahassee, FL, Should
               Strengthen Its Capacity To Administer Its Disaster Grants


Attached is the U.S. Department of Housing and Urban Development (HUD), Office of Inspector
General’s (OIG) final results of our review of the State of Florida’s Community Development
Block Grant Disaster Recovery program.
HUD Handbook 2000.06, REV-4, sets specific timeframes for management decisions on
recommended corrective actions. For each recommendation without a management decision,
please respond and provide status reports in accordance with the HUD Handbook. Please furnish
us copies of any correspondence or directives issued because of the audit.
The Inspector General Act, Title 5 United States Code, section 8M, requires that OIG post its
publicly available reports on the OIG website. Accordingly, this report will be posted at
http://www.hudoig.gov.
If you have any questions or comments about this report, please do not hesitate to call me at
404-331-3369.
                    Audit Report Number: 2018-AT-1010
                    Date: September 21, 2018

                    The Florida Department of Economic Opportunity, Tallahassee, FL, Should
                    Strengthen Its Capacity To Administer Its Disaster Grants



Highlights

What We Audited and Why
We reviewed the State of Florida’s Department of Economic Opportunity’s Community
Development Block Grant Disaster Recovery (CDBG-DR) program. We selected the State of
Florida in accordance with our goal to review disaster funding and based on a congressional
request for us to conduct disaster capacity reviews for recent disasters, including Hurricanes
Hermine, Matthew, and Irma. Our audit objective was to determine whether the State of
Florida’s Department of Economic Opportunity had the capacity to administer its CDBG-DR
grants in accordance with applicable regulations and requirements.

What We Found
The Department should strengthen its capacity to administer its CDBG-DR grants in accordance
with applicable regulations and requirements. Specifically, it could strengthen its capacity by (1)
finalizing its policies and procedures for its disaster program, (2) ensuring that subrecipient
agreements are not executed before its policies and procedures are finalized, (3) improving its
financial controls to address weaknesses, (4) improving its process for preventing duplication of
benefits, and (5) continuing to increase its staffing. These challenges existed because the
Department was in the planning stages of implementing its program for the 2016 and 2017
disasters and had weaknesses in its oversight of the program and financial controls related to its
expenditures. Strengthening its capacity to administer disaster grants would help ensure that the
Department properly spends more than $1.5 billion in CDBG-DR funding in accordance with
applicable requirements.

What We Recommend
We recommend that the Deputy Assistant Secretary for Grant Programs instruct the Department
to (1) obtain HUD approval of its disaster policies and procedures before executing its
subrecipient agreements and ensure that its finalized policies and procedures include financial
management, procurement, duplication of benefits, and monitoring; (2) establish and implement
adequate financial controls to ensure that its disaster funds are properly classified and allocated
to the correct grant; (3) continue establishing data sharing agreements to prevent the risk of
duplicated benefits; and (4) continue to fill its staffing vacancy and assess resources as it
prepares for additional disaster funds.
Table of Contents
Background and Objective......................................................................................3

Results of Audit ........................................................................................................5
         Finding 1: The Department Should Strengthen Its Capacity To Administer Its
         CDBG-DR Grants ............................................................................................................. 5

Scope and Methodology .........................................................................................11

Internal Controls ....................................................................................................13

Appendix .................................................................................................................14
         A. Auditee Comments and OIG’s Evaluation ............................................................. 14




                                                                  2
Background and Objective
On September 2, 2016, Hurricane Hermine made landfall as a category 1 1 hurricane east of St.
Marks, FL. Hermine was Florida’s first hurricane to make landfall since Hurricane Wilma in
2005. On October 7, 2016, Hurricane Matthew moved very close to the coast of Florida, with
flooding from the storm surge affecting parts of northern Florida. In response to these disasters,
on December 10, 2016, Congress passed Public Law 114-254, which appropriated $1.8 billion to
the U.S. Department of Housing and Urban Development, Office of Community Planning and
Development’s (HUD CPD) fund for activities related to major disasters declared in 2016. Of
this amount, the State of Florida was allocated $58.6 million. On May 5, 2017, Congress passed
Public Law 115-31, which appropriated an additional $400 million in disaster recovery funds for
remaining unmet needs, allocating to the State an additional $59.3 million for its 2016 disasters.

On September 8, 2017, Congress passed Public Law 115-56, which appropriated $7.4 billion to
the HUD CPD fund for necessary expenses for activities related to disaster relief, long-term
recovery, restoration of infrastructure, and economic revitalization in the most impacted and
distressed areas resulting from major disasters declared in 2017. On September 10, 2017,
Hurricane Irma made landfall as a category 4 2 hurricane in Key West, FL. From this
appropriation, the State of Florida was allocated $615.9 million for its 2017 disasters. The law
stated that before making any grant, HUD was required to certify in advance that the grantee had
in place proficient financial controls and procurement processes and had established adequate
procedures to prevent any duplication of benefits; ensure the timely expenditure of funds;
maintain comprehensive websites regarding all disaster recovery activities; and detect and
prevent waste, fraud, and abuse of funds.

On February 9, 2018, Congress passed Public Law 115-123, which appropriated nearly $28
billion in Community Development Block Grant Disaster Recovery (CDBG-DR) funds to
support long-term disaster recovery in hard-hit areas with $15.9 billion available for mitigation
activities. From this appropriation, the State of Florida was allocated an additional $83.8 million
for 2016 disasters and $707 million for 2017 disasters.




1
  A category 1 hurricane has sustained winds in the range of 74-95 miles per hour, very dangerous, and will produce
    some damage.
2
  A category 4 hurricane has sustained winds in the range of 130-156 miles per hour, and will produce catastrophic
    damage.


                                                         3
                    State of Florida CDBG-DR funding status as of July 10, 2018
                                               Allocated          Drawn           Balance
                 Disaster event
                                               amounts           amounts   3
                                                                                remaining
    2016 disasters
                                              $201,738,000          $400,034     $201,337,966
    (Hurricanes Hermine and Matthew)
    2017 disaster                            1,323,282,000                   0  1,323,282,000
    (Hurricane Irma)
    Total 2016-2017 disaster events          1,525,020,000           400,034    1,524,619,966

The Florida Department of Economic Opportunity is responsible for administering the disaster
recovery funds in Florida. The agency’s Community Development Disaster Recovery division
manages its disaster program. The Department executed its grant agreement with HUD for the
$58.6 million allocation of funding related to 2016 disasters on September 22, 2017. The grant
agreement for the second allocation of funding totaling $59.3 million was executed on April 4,
2018. The action plan for the $616 million allocation for Hurricane Irma was approved by HUD
on June 29, 2018, and the Department anticipates an executed grant agreement by August 2018.
The Department will use HUD’s Disaster Recovery Grant Reporting (DRGR) system to access
grant funds, and HUD will use this system to monitor program compliance and complete
quarterly performance reporting to Congress.

On October 10, 2017, the U.S. Senate’s Committee on Homeland Security and Governmental
Affairs sent a letter to the Acting Inspector General of HUD, requesting immediate and intensive
oversight by the OIG to protect the interests of the taxpayers and ensure that hurricane relief
funds reached victims of Hurricanes Harvey, Irma, and Maria. The Committee wanted to ensure
that appropriate oversight mechanisms were in place and encouraged HUD OIG to conduct
capacity audits to evaluate grantees’ and subgrantees’ ability to properly manage CDBG funding
and follow Federal procurement regulations.

Our audit objective was to determine whether the State of Florida’s Department of Economic
Opportunity had the capacity to administer its CDBG-DR grants in accordance with applicable
regulations and requirements.




3
    This amount is based on the funds drawn down in HUD’s Disaster Recovery Grant Reporting (DRGR) system.


                                                       4
Results of Audit

Finding: The Department Should Strengthen Its Capacity To
Administer Its CDBG-DR Grants
The Department should strengthen its capacity to administer its CDBG-DR grants in accordance
with applicable regulations and requirements. Specifically, it could improve its capacity by (1)
finalizing its policies and procedures for its disaster program, (2) ensuring that subrecipient
agreements are not executed before its policies and procedures are finalized, (3) improving its
financial controls to address weaknesses, (4) improving its process for preventing duplication of
benefits, and (5) continuing to increase its staffing. These challenges existed because the
Department was in the planning stages of implementing its program for the 2016 and 2017
disasters and had weaknesses in its oversight of the program and financial controls related to its
expenditures. Although, the Department’s action plans were approved by HUD for Hurricanes
Hermine, Matthew, and Irma and it also maintained a comprehensive disaster recovery website,
improvements are needed in its oversight and administration of the program, including its
internal and financial controls.

The Department Must Ensure That Its Policies and Procedures for Its Disaster Program
Are Finalized and Implemented
As part of the certification process for its 2016 disasters, the Department provided its
agencywide policies and procedures with its implementation plan, dated March 23, 2017, which
stated that the Department had the financial management systems, policies, procedures, and
practices necessary to uphold fiscal responsibility in relation to its disaster program. 81 FR
(Federal Register) 83255 (November 21,2016) 4 states that HUD shall certify in advance that the
grantee has in place proficient financial controls and has established adequate procedures to
administer the disaster program. More than a year later, in June 2018, the Department submitted
its draft disaster recovery policies and procedures to HUD for review; however, as of July 2018,
it had not finalized its policies and procedures specific to its disaster program. This condition
occurred because the Department experienced difficulties in procuring a contractor to assist with
policy development. The Department stated that its policy updates were needed to follow recent
Federal Registers applicable to the 2016 and 2017 disasters. However, its lack of controls
hindered its ability to provide uniform guidance and hold its subrecipients accountable and
delayed the subrecipients’ access to program funds.

In addition, as of July 2018, the Department had not finalized its monitoring policies and
procedures for its disaster recovery program. A contractor was hired on May 14, 2018, to
perform comprehensive administrative services related to the Department’s disaster program and


4
    81 FR 83255 (November 21, 2016) states that HUD shall certify in advance that the grantee has in place proficient
    financial controls and procurement processes and has established adequate procedures to prevent any duplication
    of benefits; ensure the timely expenditure of funds; maintain comprehensive websites regarding all disaster
    recovery activities; and detect and prevent waste, fraud, and abuse of funds.


                                                          5
assist with grant administration tasks, including but not limited to establishing monitoring
controls, providing support for program oversight, monitoring the performance of each grant,
and providing accurate and timely information to the Department. The Department must ensure
that its policies and procedures explain that the Department remains responsible for ensuring that
the CDBG-DR program is administered in accordance with all program requirements, including
its monitoring. The use of designated public agencies, subrecipients, or contractors does not
relieve the recipient of its responsibilities as stated in 24 CFR (Code of Federal Regulations)
570.501(b). The Department must also ensure that its use of contractors does not violate
regulations. 81 FR 83268 (November 21, 2016) states that grantees may contract for
administrative support but may not delegate or contract to any other party any inherently
governmental responsibilities related to management of the funds, such as oversight, policy
development, and financial management. In addition 83 FR 5860 (February 9, 2018) includes
monitoring in the responsibilities that should not be contracted out.

The Department should also consider adding to its procedures the inclusion of false statement
and false claim warnings on its contract forms to improve its ability to hold responsible parties
accountable for providing false claims and ensuring that eligible applicants benefit from the
disaster resources allocated for the State of Florida. 5 As discussed in the contractor agreement
with the Department, any false certifications submitted by the contractor may be subject to fines
and debarment. The Department is also required to have beneficiaries repay any assistance later
received for the same purpose from CDBG-DR funds and must also include language stating that
any person who knowingly makes a false claim or statement to HUD may be subject to civil or
criminal penalties. 6 Since the Department already requires certain certifications, including the
warning language would make the certifications more effective and enforceable.

The Department Must Ensure That Subrecipient Agreements Are Not Executed Before
Policies and Procedures Are Finalized
On March 1, 2018, the Department executed a subrecipient agreement 7 with St. John’s County
for more than $45.8 million in CDBG-DR funds for the 2016 disasters, Hurricanes Hermine and
Matthew. However based on section 12 of the terms of the grant agreement 8 between HUD and
the Department, it should not have entered into a subrecipient agreement until its policies and
procedures were approved by HUD. Department staff stated that this issue occurred due to an
oversight of the grant terms and conditions. As discussed above, the Department was finalizing
its policies and procedures, and the lack of these controls hindered its ability to provide uniform
guidance to its subrecipients. In addition, HUD’s disaster recovery staff stated that the



5
  The provisions of 18 U.S.C. (United States Code) 1001 include false statement criminal penalties. The provisions
  of 31 U.S.C. 3729 include false claim civil penalties.
6
  83 FR 5848 (February 9, 2018)
7
  As of July 2018, the Department had executed only one subrecipient agreement, which was with St. Johns County.
8
  Section 12 of the grant agreement between HUD and the Department states that the grantee shall develop and
  maintain policies and procedures that outline each program and eligible activities and require records management,
  subrecipient oversight, technical assistance, and monitoring procedures. The policies and procedures shall be
  submitted and approved by HUD before funds are awarded to subrecipients. This requirement refers to the grant
  agreement for the first allocation of Hurricanes Hermine and Matthew funds totaling $58 million.


                                                         6
subrecipient would not have access to draw down disaster funds in the DRGR system until the
Department’s disaster recovery policies and procedures were approved.

The Department Needs To Improve Its Financial Controls To Address Weaknesses
We identified weaknesses in the Department's financial controls over its DRGR drawdowns and
classification of costs. Specifically, according to HUD’s DRGR system, the Department drew
down more administrative and planning costs than it spent. For example, on March 15, 2018, the
Department drew down $401,752 in the DRGR system, but according to the general ledger, it
spent only $373,404. 9 This error resulted in an excess draw in the DRGR system of $28,348
because the Department spent funds using its general funds and then reimbursed itself with
DRGR drawdowns without adequate controls to prevent excess draws. As of May 16, 2018, the
Department had completed an adjustment in HUD’s DRGR system to address this error.

Additionally, some costs were misclassified between administration and planning. For example,
the Department misclassified several of its expenditures as administration costs rather than
planning costs but later resolved these issues with adjustments to the DRGR system and its
general ledger. According to the grant agreement, the Department was allocated specific
amounts for its administrative and planning costs. The Department also misclassified costs in its
general ledger using incorrect disaster grant numbers. For example, it incorrectly charged a
$30,000 expenditure used for a Hurricane Irma activity10 to the Hurricanes Hermine and
Matthew grant. This amount was also included in the DRGR drawdown for Hurricanes Hermine
and Matthew. However, after our review, the Department provided documentation to support
that the expenditure was reclassified to the Hurricane Irma grant and adjusted in the DRGR
system.

This condition occurred because the Department did not have adequate training to ensure that
CDBG-DR funds were properly classified and lacked controls to ensure that costs were allocated
to the appropriate grant. The lack of financial controls hindered the Department's ability to
ensure that all expenditures charged to grants were eligible and fully supported. During
interviews, the Department demonstrated its segregation of duties and provided its financial
process, which included monthly reconciliations and processes for drawing funds down in
DRGR.

The Department Needs To Improve Its Processes for Preventing Duplication of Benefits
The Department needs to improve its processes for preventing duplication of benefits to ensure
that data sharing agreements are established and allow it adequate time to use the information.
Regulations at 44 CFR 206.191(d) state that a duplication of benefits occurs when an agency


9
  The provisions of 24 CFR 570.489(b) and 570.200(h) permit a State to reimburse itself for otherwise allowable
   costs incurred by itself or its recipients’ subgrantees or subrecipients on or after the incident of the covered
   disaster.
10
   Specifically, HUD regulations pertaining to CDBG funds at 24 CFR 570.205(a) list costs that are eligible for
   planning activities, and 24 CFR 570.205 lists costs that are eligible for administrative expenses. 81 FR 83259
   (November 21, 2016) states that all CDBG-DR-funded activities must clearly address an impact of the disaster for
   which funding was allocated.



                                                         7
provides assistance, which was the primary responsibility of another agency, and the agency with
primary responsibility later provides assistance. The Robert T. Stafford Disaster Relief and
Emergency Assistance Act (42 U.S.C. 5155) authorizes agencies to ensure that assistance
provided by each is not duplicated by another source. A HUD monitoring review conducted in
2011 for prior disasters 11 in 2005 reported that the Department did not have controls to prevent
the risk of duplication of benefits. 12

The Department did not establish a data sharing agreement with the Federal Emergency
Management Agency (FEMA) for its 2016 disasters. This condition occurred because the
Department was unable to identify the appropriate FEMA contact to establish this agreement.
For its 2017 disasters, the Department provided an amended data-sharing agreement with FEMA,
signed on September 14, 2017, but the term of the agreement was not identified. The
Department had not provided the signed copy of the initial agreement, which should have
included the terms and effective dates. The lack of an established data-sharing agreement with
FEMA increased the risk of a duplication of benefits, which could result in a violation of Federal
regulations. 13 As of July 31, 2018, the Department was still in the process of trying to establish a
data sharing agreement with FEMA for its 2016 disasters.

In March and December 2017, the Department established data sharing agreements with the
Small Business Administration (SBA) for its 2016 and 2017 disasters; however, the terms of the
agreements were effective for only 18 months. As of June 2018, the Department still had the
majority of its 2016 disaster funds to spend and had not received its 2017 funding, these
agreements would expire before it could provide useful information to prevent a duplication of
benefits. The Department’s disaster chief for its disaster recovery division stated that the
Department had begun negotiating with SBA on May 22, 2018, to extend its agreement.

The Department Needs To Continue Increasing Its Staff To Ensure That There Are
Adequate Resources To Administer the Program
Based on the Department’s staffing plan, it was increasing the number of staff members to
ensure that it had adequate staffing resources to administer the program. According to its
organizational chart, dated April 13, 2018, the Department had six disaster recovery staff
members onboard and four vacancies in addition to its consultants. Staffing vacancies impacted
the Department’s ability to efficiently administer its program. As of July 31, 2018, the
Department hired an additional 5 staff members totaling 11 onboard and has one vacancy. The
Department should continue assessing its staffing resources to ensure that it has sufficient
capacity to adequately administer its program and prepare for the additional funding that has




11
    The prior disasters included Hurricane Wilma and Katrina in 2005.
12
    Due to this review, the State of Florida had to repay funds through a voluntary grant reduction and update its
   policies and procedures. These disaster policies had not been reviewed because the Department was revising its
   disaster policies and procedures for the current disasters.
13
    83 FR 5848 (February 9, 2018) states that grantee procedures shall provide that before award of assistance, the
   grantee will use the best, most recent available data from FEMA, the SBA, insurers, and other sources of funding
   to prevent duplication of benefits.


                                                         8
been allocated as required. 14 As discussed above, the Department had also hired a contractor to
assist with its disaster recovery program.

Conclusion
Although the Department was in the planning stages of implementing its program for the 2016
and 2017 disasters, it needs to strengthen its capacity to administer these funds. The Department
certified that it would have the financial management systems, policies, procedures, and
practices necessary to administer the program. However, improvements are necessary in its
oversight of the program, staffing capacity, and financial controls to address weaknesses. These
conditions occurred because the Department was in the planning stages of implementing its
program for the 2016 and 2017 disasters and had weaknesses in its oversight of the program and
financial controls related to its expenditures. Proper oversight by the Department would provide
greater assurance that disaster funds would be administered and spent appropriately and
protected against fraud, waste, and abuse and ensure that hurricane relief funds would be used
for their intended purposes as required.

Recommendations
We recommend that the Deputy Assistant Secretary for Grant Programs instruct the Department
to:

           1A.      Obtain HUD approval of policies and procedures before executing its subrecipient
                    agreements and ensure that its finalized policies and procedures include but not
                    limited to financial management, procurement, duplication of benefits, and
                    monitoring.

           1B.      Establish adequate financial controls to ensure that its disaster funds are properly
                    classified and allocated to the correct grant and ensure that DRGR drawdowns are
                    conducted in a timely manner.

           1C.      Provide adequate training to staff on the appropriate classification of disaster
                    recovery activities to ensure costs are accurately allocated and recorded.

           1D.      Continue to establish a data sharing agreement with FEMA for Hurricanes
                    Hermine and Matthew to ensure that all sources of funding are included in its
                    disaster policies and procedures to prevent duplication of benefits and ensure that
                    the term of the agreement is sufficient.

           1E.      Continue to negotiate with SBA to extend its data-sharing agreements for the term
                    of the expenditure requirements set forth in public laws or the Federal Register.


14
     81 FR 83257 (November 21, 2016) discusses grantee requirements for showing that it has sufficient capacity to
     manage its funds. The requirements include having sufficient management capacity and staffing and state that its
     implementation plan should show that the grantee has assessed staff capacity and identified personnel for the
     purpose of case management; program managers; and staff responsible for procurement and contract management,
     environmental compliance, monitoring and quality assurance, and financial management.


                                                           9
1F.   Continue to fill its vacancy and assess staffing resources as it prepares for
      additional disaster funds.




                                        10
Scope and Methodology
We performed our audit work between February and July 2018 at the Florida Department of
Economic Opportunity located at 107 East Madison Street, Tallahassee, FL, and in our OIG
office in Miami, FL. Our audit period was September 1, 2016, through February 28, 2018; was
expanded as necessary to July 31, 2018; and covered funds allocated to the State of Florida under
Public Laws 114-254, 115-31, 115-56, and 115-123.

To accomplish our audit objective, we

       •   Reviewed relevant criteria, including public laws that affected Hurricanes Hermine,
           Matthew, and Irma funding and Federal Register notices.

       •   Interviewed program staff at HUD and the Department to determine the Department’s
           capacity and plans to administer its program.

       •   Reviewed the Department’s implementation and action plans submitted to HUD, its
           agencywide policies and procedures, its organizational chart, and its disaster recovery
           staffing plans.

       •   Reviewed the grant agreements between HUD and the Department for Hurricanes
           Hermine and Matthew.

       •   Reviewed the most recent HUD OIG audit report of the Department’s previous CDBG-
           DR funding and the State of Florida’s single audit reports.

       •   Reviewed data-sharing agreements among the Department, FEMA, and SBA.

       •   Reviewed HUD’s monitoring report and risk assessment.

       •   Reviewed financial reports from HUD’s DRGR system to obtain grant drawdown
           information for the audit period.

Based on the Department’s general ledger, as of March 30, 2018, the Department had spent only
$446,475 15 for administrative and planning costs related to Hurricanes Hermine and Matthew.
Therefore, we conducted sample testing of these expenditures to determine whether the costs
were allowable, fully supported, and appropriately recorded. Using the general ledger, we
selected a nonstatistical sample from the three categories with the highest dollar amount of


15
     The Department’s general ledger included additional costs related to the disaster that had not been drawn down in
     DRGR as of the date of our sample testing. The Department used its funds for disaster activities and then drew
     down funds in DRGR for reimbursement.


                                                           11
transactions, including salary expenses, contractual expenses, and direct cost expenses. We
selected the eight largest transactions from these categories with expenditures totaling $102,000,
or 23 percent of the total expenditures. We did not perform a 100 percent selection, and the
results of this audit apply only to the items reviewed and cannot be projected to the universe of
expenditures.

Computer-processed data generated by the Department were not used to materially support our
audit findings, conclusions, and recommendations. Thus, we did not assess the reliability of
these computer-processed data.

We were unable to test the Department’s financial system controls because the subrecipients had
not drawn down any funds and the Department was integrating a disaster module within its
enterprisewide system. The Department previously used the Electronic Community
Development Block Grant system as a subrecipient management tool for its prior disaster grants.
For the current disaster grants, the Department planned to use its enterprisewide system, the
subrecipient’s Enterprise Resource Application (SERA), which is used for all of its divisions.
On June 6, 2018, a disaster module was created within the SERA system and will be used as a
subrecipient management tool with the functionality to process payments.

We conducted the audit in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions based on our audit
objective(s). We believe that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objective.




                                                12
Internal Controls
Internal control is a process adopted by those charged with governance and management,
designed to provide reasonable assurance about the achievement of the organization’s mission,
goals, and objectives with regard to

•   effectiveness and efficiency of operations,
•   reliability of financial reporting, and
•   compliance with applicable laws and regulations.
Internal controls comprise the plans, policies, methods, and procedures used to meet the
organization’s mission, goals, and objectives. Internal controls include the processes and
procedures for planning, organizing, directing, and controlling program operations as well as the
systems for measuring, reporting, and monitoring program performance.

Relevant Internal Controls
We determined that the following internal controls were relevant to our audit objective:

•   Effectiveness and efficiency of program operations – Policies and procedures that the audited
    entity has implemented to provide reasonable assurance that a program meets its objectives.

•   Relevance and reliability of information – Policies and procedures that management has
    implemented to provide reasonable assurance that operational and financial information used
    for decision making and reporting externally is relevant, reliable, and fairly disclosed in
    reports.

•   Compliance with applicable laws, regulations, contracts, and grant agreements.


We assessed the relevant controls identified above.
A deficiency in internal control exists when the design or operation of a control does not allow
management or employees, in the normal course of performing their assigned functions, the
reasonable opportunity to prevent, detect, or correct (1) impairments to effectiveness or
efficiency of operations, (2) misstatements in financial or performance information, or (3)
violations of laws and regulations on a timely basis.
Significant Deficiency
Based on our review, we believe that the following item is a significant deficiency:

•   The Department should strengthen its capacity to administer its CDBG-DR funds in
    accordance with applicable regulations and requirements.




                                                  13
Appendix A
             Auditee Comments and OIG’s Evaluation



Ref to OIG
Evaluation    Auditee Comments




                                             September 7, 2018

              Ms. Nikita N. Irons, Regional Inspector General
              Office of Audit (Region 4)
              Richard B. Russell Federal Building
              75 Ted Turner Drive, SW, Room 330
              Atlanta, GA 30303-3388

              RE: Community Development Block Grant-Disaster Recovery Draft Audit
              Report

              Dear Ms. Irons,

              The Florida Department of Economic Opportunity (DEO) received the U.S.
              Department of Housing and Urban Development (HUD) Office of the Inspector
              General’s (OIG) draft audit report detailing the review of Community Development
              Block Grant-Disaster Recovery (CDBG-DR) program funding for Hurricanes
              Hermine, Matthew and Irma. DEO would like to thank HUD OIG staff for their
              thoughtful consideration of our ongoing efforts to strengthen DEO’s disaster
              recovery program.

              The start of the HUD OIG audit coincided with the beginning of DEO’s efforts to
              develop an action plan for the largest CDBG-DR allocation in the state’s history.
              We understood that with this new allocation the agency would need to strengthen
              its capacity to ensure that the unmet needs of Florida’s residents and business
              owners were addressed as quickly as possible. We appreciated HUD OIG staff
              feedback, which helped us shape our programs and staff so they are better equipped
              to put in place controls and processes to safeguard taxpayer dollars. We also
              appreciate that HUD OIG recognized our team’s rapid growth during the
              six-month program evaluation period. To demonstrate our ongoing efforts
              to improve the program, we would like to provide a response and update for
              each recommendation provided in the audit report.

              1A. Obtain HUD-approved policies and procedures before executing DEO’s
              sub-recipient agreements and ensure that its finalized policies and procedures
              include but are not limited to financial management, procurement, duplication
Comment 1     of benefits and monitoring.




                                     14
             Auditee Comments and OIG’s Evaluation




Ref to OIG    Auditee Comments
Evaluation
              DEO accepts this recommendation and will ensure that moving forward policies
              and procedures are submitted to HUD and approved prior to awarding funding to
Comment 1     sub-recipients. On July 17, 2018, DEO received HUD approval of its current
              policies and procedures for programs associated with the Hermine and Matthew
              allocation. DEO continues to work with its current sub-recipient, St. Johns County,
              to provide feedback to strengthen the county’s policies and procedures and will
              work with future sub-recipients to develop policies and procedures as well. In
              addition, DEO is currently working to refine its policies and procedures to address
              the programs outlined in the state’s HUD-approved action plan for Hurricane Irma.

              1B. Establish adequate financial controls to ensure that its disaster recovery
              funds are properly classified and allocated to the correct grant and ensure that
              Disaster Recovery Grant Reporting System drawdowns are conducted in a
              timely manner.
Comment 2
              DEO accepts this recommendation and as documented in the HUD OIG’s draft
              report, DEO corrected the discrepancy prior to the completion of HUD OIG’s field
              work. DEO will continue to address controls to ensure that disaster recovery funds
              are properly classified and allocated to the correct grant and ensure that Disaster
              Recovery Grant Reporting drawdowns are conducted in a timely manner.

              1C. Provide adequate training to staff on the appropriate classification of
              disaster recovery activities to ensure costs are accurately allocated and
              recorded.
Comment 3
              DEO accepts this recommendation and has worked with HUD staff to ensure that
              DEO financial and programmatic staff are trained to correctly classify costs and
              verify they are accurately allocated and recorded.

              1D. Continue to establish a data sharing agreement with the Federal
              Emergency Management Agency (FEMA) for Hurricanes Hermine and
              Matthew to ensure that all sources of funding are included in its disaster
              policies and procedures to prevent duplication of benefits and ensure that the
Comment 4     term of the agreement is sufficient.

              DEO accepts this recommendation and is working to finalize all data sharing
              agreements. Currently, we have established data sharing agreements with FEMA
              for Hurricanes Hermine and Matthew and are receiving data on a regular basis. Our
              agreement with the FEMA National Flood Insurance Program (NFIP) for
              Hurricanes Hermine and Matthew data is currently under review by FEMA. In
              addition, we have established a data sharing agreement with FEMA NFIP for
              Hurricane Irma and are receiving information regularly. Our overall data sharing
              agreement with FEMA is established and we are working with their staff to obtain
              datasets.




                                      15
             Auditee Comments and OIG’s Evaluation




Ref to OIG    Auditee Comments
Evaluation
              1E. Continue to negotiate with the Small Business Administration (SBA) to
              extend its data sharing agreements for the term of the expenditure
              requirements set forth in public laws or the Federal Register.
Comment 5     DEO accepts this recommendation and has extended our data sharing agreements
              for Hurricane Irma with SBA until September 1, 2019. The extended data sharing
              agreement for Hurricanes Hermine and Matthew is being routed for execution and
              has an effective date of September 1, 2018, extending until September 1, 2019.
              DEO is receiving information on a regular basis.

              1F. Continue to fill its vacancies and assess staffing resources as it prepares for
              additional disaster funds.
Comment 6
              DEO accepts this recommendation. In addition to filling vacancies since the
              completion of HUD OIG’s fieldwork, DEO is providing wrap around support from
              the entire agency. Our team has been augmented to include additional contract
              managers, operations support, as well as procurement and vendor management
              support. The agency added certified project management professionals and an
              executive level steering group that guides risk management and decision making
              for the implementation of the recovery programs associated with the Hurricane
              Irma allocation. DEO also procured contractors that specialize in CDBG-DR to
              assist the state with the implementation of the action plans associated with
              Hurricanes Hermine, Matthew and Irma. DEO recently hired a consulting firm to
              conduct an organizational study to help improve staff efficiency in administering
              CDBG-DR funds. The consultant will also provide recommendations on additional
              staffing needs. DEO will soon procure third-party monitoring services and
              additional support to meet internal audit requirements. These efforts collectively
              have helped set DEO up for success in administering the CDBG-DR program.

              Again, DEO appreciates the feedback from HUD OIG and looks forward to
              continuing our work with the HUD Office of Community Planning and
              Development staff to address the unmet needs of Florida residents and improve the
              resiliency of our state. If you have any questions, please contact DEO Director of
              Community Development, Julie Dennis at (850) 717-8477 or
              Julie.Dennis@deo.myflorida.com.




                                                          Cissy Proctor
                                                          Executive Director




                                     16
                         OIG Evaluation of Auditee Comments


Comment 1   The Department accepted recommendation 1A and indicated that its policies and
            procedures for Hurricanes Hermine and Matthew were approved by HUD on July
            17, 2018. However, the finalized policies and procedures were not provided to
            the OIG during the review. The Department will also ensure policies and
            procedures are approved prior to awarding funds to its sub recipients.
            We acknowledge that the Department is revising its policies and procedures to
            include programs associated with Hurricane Irma and is working with its sub
            recipients to strengthen its policies and procedures. The Department should work
            with HUD during audit resolution to ensure the recommendation is fully
            implemented.
Comment 2   We acknowledge that the Department corrected financial control weaknesses that
            we identified during our audit. However, the Department should ensure it
            continues to have adequate financial controls to ensure its program funds are
            properly classified, allocated to the correct grant, and ensure that Disaster
            Recovery Grant Reporting System drawdowns are conducted in a timely manner.
            The Department should work with HUD during audit resolution to ensure the
            recommendation is fully implemented.
Comment 3   We acknowledge that the Department has worked with HUD to ensure that its
            program and financial staff are trained to ensure cost are accurately allocated and
            recorded. The Department should continue to provide regular training and work
            with HUD during audit resolution to ensure the recommendation is fully
            implemented.
Comment 4   We acknowledge the Department’s effort in establishing data sharing agreements
            with FEMA for Hurricanes Hermine, Matthew, and Irma. The Department should
            ensure that the term of the sharing agreements are valid for the term of the
            expenditure requirements in the public laws and the Federal Register. The
            Department should provide supporting documentation to HUD to ensure the
            recommendation is fully implemented.
Comment 5   We acknowledge that the Department extended its SBA data sharing agreement
            for Hurricane Irma and is in the process of executing an extended SBA data
            sharing agreement for Hurricanes Hermine and Matthew. The Department should
            ensure its data sharing agreements are valid for the term of the expenditure
            requirements in the public laws and the Federal Register. Supporting
            documentation should be provided to HUD to ensure the recommendation is fully
            implemented.
Comment 6   We acknowledge the Department’s staffing efforts, improvements, and
            continuous assessments of its staffing capacity. The Department should continue



                                             17
to assess staffing resources as it prepares for additional disaster funds and provide
updates to HUD to ensure the recommendation is fully implemented.




                                 18