Chapter 20 — Audits and Corrective Actions

CIAO and IOAI — different mandates, both binding

The chapter sets expectations for: when an audit is conducted by CIAO and IOAI; potential findings and sanctions; common deficiencies; recommended internal controls. Compliance is inclusive of state and federal regulations, the Master Agreement, LAPM, LAPG, CTC grant requirements, and all other applicable regulations.

To reduce the risk of audit findings, the LAPM strongly recommends LPAs develop, update, and maintain written policies and procedures in:

• Adoption of LAPM Chapter 10 as required in Section 10.1.10 for A&E consultant procurement — this is a hard requirement, not a recommendation. LPAs must formally adopt Ch 10.
• Grant or contract management
• Direct and indirect cost development and charging procedures
• Financial management systems for invoicing and labor
• Construction administration

Caltrans Internal Audits Office (CIAO)

"CIAO was established to evaluate and improve the effectiveness of governance, risk management, and internal control processes. CIAO tracks single audit report compliance, reviews and accepts Indirect Cost Allocation Plans, and conducts Pre-Award and incurred cost (project) audits."

Independent Office of Audits and Investigations (IOAI)

Authority: Senate Bill 1 of 2017 and the Stewardship and Oversight Agreement between FHWA and Caltrans require IOAI to ensure LPAs spend Caltrans funds in compliance. "IOAI reviews the LPA's policies and procedures, and conducts audits and investigations of activities involving funds passed-through from Caltrans to LPAs."

IOAI is structurally independent — it reports directly to the Inspector General, not through Caltrans management. From Ch 10: IOAI performs the A&E consultant Financial Document Reviews for the $1M ICR threshold and contracts the Caltrans Reference Sample Program for lab quality.

The 5-business-day response window

The audit process is "the on-site review and examination of a process or quality system to ensure compliance to requirements." Audits ensure accountability in managing transportation funds administered by LPAs.

Audits Performed

Audit Activities sequence:

1. Contact the LPA to schedule the audit
2. Send a formal engagement letter outlining the objective of the audit. If specific documentation is required in advance of fieldwork, auditors will correspond with the LPA accordingly
3. Entrance conference on the first day of fieldwork — scope, objectives, schedules, documents to be reviewed
4. Fieldwork — auditors keep auditee informed of any deficiencies identified
5. Exit conference once fieldwork is completed — discuss potential audit findings

Audit Report

• Auditors develop a Draft Audit Report providing clear and sufficient evidence justifying findings and recommendations
• The auditee will have five (5) business days to formally respond to the draft audit findings
• Based on the LPA's response, draft findings are sustained, modified, or deleted
• The audit report is finalized and issued to Caltrans, with a copy to the LPA

IOAI may contract out audits to another state agency (e.g., California Department of Finance); each agency's audit procedures may slightly vary.

Common areas, common citations

Findings are the results of an audit based on evidence about how the LPA's operations, administration of funding, processes, and/or control systems do not comply with required regulations and agreed-upon policies.

Two types of findings:

• Qualitative findings contend with an LPA's procedures and capability to comply with regulations and policies
• Quantitative findings determine an LPA had misappropriated funds that will be recommended for reimbursement to Caltrans

Common Finding Areas

• Procurement of consultant contracts — Ch 10 deficiencies (lack of QBS, cost in evaluation, missing 10-T COI, missing 10-U CMSR review, rotational task orders)
• Contract and grant management administration — invoicing every 6 months per Master Agreement, contract amendments without proper approvals, missing performance evaluations
• ICAP/ICRP direct and indirect cost pools — improper cost pool development, mixing of direct and indirect costs, ICAP/ICRP not approved by CIAO
• Unallowable costs reimbursed — costs reimbursed that don't meet 2 CFR 200 allowability tests; alcohol; lobbying; bad debts; entertainment
• Invoice and labor costing — invoices not supported by adequate documentation; billing % of contract complete vs actual incurred costs; consultant labor billed without verified rates

The complete list of common deficiencies is at https://dot.ca.gov/-/media/dot-media/programs/local-assistance/documents/audit/common-deficiencies-and-best-practices.pdf.

9-month deadline, three destinations, two-month Management Decision

SAR Submission — Three Destinations

The SAR is submitted to:

• Federal Audit Clearinghouse — https://secure.login.gov/
• State Controller's Office — https://dep.sco.ca.gov/
• Caltrans — [email protected]

CIAO's website maintains a Single Audit Determination List allowing organizations to check their SAR status by fiscal year. This list may be used to certify the SAR or Exemption Letter was received by Caltrans.

SAR Package Contents

• Financial statements (such as those in a Consolidated Annual Financial Report)
• Schedule of Expenditures of Federal Awards (SEFA)
• Schedule of findings and questioned costs
• Summary schedule of prior year findings
• Corrective action plan in response to all findings and questioned costs
• Reports including:
  • Opinion on financial statements
  • Internal control over financial reporting and compliance
  • Compliance for each major program

Caltrans Management Decision per 2 CFR 200.513(c)

If the SAR has a finding involving federal funds passed through Caltrans to the LPA, CIAO will issue a Management Decision pursuant to 2 CFR 200.513(c) to determine if the finding has been resolved.

If the finding has not been resolved within about two months, Caltrans will issue a Corrective Action Plan (CAP) letter requiring the LPA to implement actions to reduce the risk of the finding from recurring. Corrective actions typically due within three months from the CAP letter date (depending on complexity and number of unresolved findings).

PDF on letterhead, fiscal manager signature

If the LPA expends less than $1M for all types of federal funds in a fiscal year, the LPA needs to submit an exemption letter to:

• State Controller's Office — [email protected]
• Caltrans Federal Funds Award inbox — [email protected]

Exemption letter requirements:

• PDF format
• On LPA letterhead
• Identifies the exempt Fiscal Year
• Certifies exemption reason
• Contains a fiscal manager/officer signature

Example exemption letter at https://dot.ca.gov/-/media/dot-media/programs/local-assistance/documents/audit/Exemption-Letter-Example.docx.

Failure to submit a SAR package or exemption letter will result in a sanction (per §20.7). The under-$1M LPA can't simply ignore the obligation — silence is treated as non-compliance.

120 days to CAP letter, 5 months to comply, 1 year to close

Depending on audit type, CIAO or IOAI sends the final audit report to Caltrans and copies the LPA. As part of its oversight responsibilities, Caltrans develops corrective actions and ensures implementation by the LPA.

Within approximately 120 days from receipt of the final audit report, DLA endeavors to send the LPA a Corrective Action Plan (CAP) letter. DLA staff will introduce themselves, discuss corrective actions in greater detail, and advise LPA staff of deadlines.

The CAP letter identifies specific actions the LPA must perform to mitigate audit findings from recurring in order to close out the audit. These corrective actions will strengthen LPA internal controls and improve the ability to comply with State and federal regulations, and contract provisions.

Corrective actions are typically due within five months from the date of the CAP letter. "It is the LPA's responsibility to take initiative and perform the corrective actions to ensure the LPA can meet the deadlines within the CAP letter."

Common CAP Corrective Actions

• Develop or update procedures — these must be reviewed by DLA prior to implementation and adoption
• Training — if required, training must be taken and performed. Attendee list or training certification must be submitted to DLA
• Reimburse funds to Caltrans — if the LPA must reimburse funds, Caltrans initiates an invoice to the LPA and the LPA must make repayment
• Substantiate disallowed costs — on a case-by-case basis, DLA may consider new documentation submitted by the LPA that will substantiate questioned and disallowed costs in the final audit report as eligible for reimbursement

If the LPA does not make a good faith effort to submit corrective actions as required within the CAP letter, Caltrans may invoke sanctions as prescribed in §20.7.

Once all corrective actions and deficiencies have been corrected and implemented, a Final Determination Letter is sent to the LPA, sanctions (if applicable) will be removed, and the audit is closed. DLA endeavors to have the audits closed out within one year.

Five sanctions, 2 CFR 200.339 framework, NO APPEALS

"The auditee is responsible to develop and implement corrective actions to mitigate all deficiencies identified in the CAP letter. Failure to implement required corrective actions by the deadline stated in the CAP letter may result in Caltrans imposing a sanction. Failure to submit a SAR package or exemption letter will also result in a sanction."

Caltrans is responsible for notifying the LPA of sanctions imposed in writing and the steps for removing these sanctions.

The Five Sanctions

Sanctions may consist of those available within 2 CFR 200.339 and the following examples, including but not limited to:

2 CFR 200.339 — the federal sanction framework — adds: temporary withholding of payments pending correction; disallowance of all or part of the cost of the activity not in compliance; whole or partial suspension or termination of the federal award; recommending federal-wide debarment from receiving federal awards; withholding further federal awards for the project or program; and any other remedies legally available.

Removal of sanctions: Once all corrective actions and deficiencies have been corrected and implemented, a Final Determination Letter is sent to the LPA, sanctions are removed, and the audit is closed.