Post-Production FILE

DAY1AFTERNOONSESSION.MOV

10/04/2020

Transcription PROVIDED BY:
PostCAP, LLC
www.CaptionFamily.com

* * * * *
Transcription is provided in order to facilitate communication accessibility and may not be a totally verbatim record of the proceedings.
* * * * *

>> Okay. Welcome back, everybody. Thanks for joining us again. This is Tim Fuchs, I just wanted to welcome you all back and acknowledge this slide 33 here, which says, "Interrupt us, please," and has a picture of an adorable little girl holding her thumbs up. It says, "Really, we mean it." We have been covering a lot of material and we need to make sure we're on track with what you need to know. We need to know if this is making sense to you. Feel free to interrupt us post your questions when you think of them.
Now, this is a slide that we always include when we are in person, it's going to look a little bit different here. The way that we'll handle this is please do enter your questions and comments throughout the presentation. Again, for those things like quick clarifications, spelling out acronyms, or anything that we can handle on the fly, we will absolutely address. I'll have my eyes out for those to let John and Paula know. Then for the more involved questions, we will wait for our Q&A breaks. Please do let us know.
We want to make sure that this is working for you and just quickly, you've got the Q&A, Ask a Question box right there in Mediasite on your webinar screen. You can email your questions to me at tim@ncil.org. If you're only on the phone, you can press star pound, and finally, for those of you that are using that stream text link, there's a chatbox there. If you log in on the right-hand side, you're welcome to submit your questions and I'll be happy to voice them for you. Then one last comment just about this morning, I want to thank you all again, for your patience.
I sent out a note during the break to the few people who had contacted me when my email was down. I think everyone's set. Again, if you have a colleague that is still not in please do let us know right away. I also talked to Joey and he's going to actually put the transcripts up on the training page so you'll be able to access them there. We'll do that in the evening after each day. The few of you that requested those directly I did forward this morning's transcript to you, especially since some people had missed some of the early content, but we'll begin to upload each day's transcripts in the evening and you'll be able to access them on the training webpage.
That's all I wanted to say to kick us off. I'm going to turn it over to Paula to continue with the content. Paula?
>> Thanks, Tim. Well, we're going to go down drilling a little deeper on some of the things that we touched on as policies and procedures that you need to have. Now we're going to talk a little bit more about the content of those policies and procedures, starting with security. Centers for Independent Living and Statewide Independent Living Councils, for that matter, have some specific identifiable data for employees, sometimes for others, sometimes health-related, which would fall under HIPAA,
We don't follow the HIPAA unless we're working with a health-related entity but sometimes we are and sometimes that is part of the information that we have. We have a responsibility to take all reasonable measures to protect the confidentiality of that information. It's not just-- [crosstalk] Go ahead, John.
>> I'm sorry, Paula. I didn't mean to butt in.
>> No, I was kind of pausing there so you could if you wanted to.
>> Okay. Limiting access. What that means is access to the different computer programs that you have limiting those to people who need to have access. Even within that, limiting access to the factions of a program. For example, in your accounting software, you can not only limit who has access to your QuickBooks, for example, but also who might have access only to accounts receivable or accounts payable information, and testing your systems.
I know one recommendation is to send out emails to your employees that are fake emails as a test. I don't particularly like that one, but you can test your security. You can actually hire professional organizations to do that. Then we, finally on this slide say that the disaster recovery plan can help with security because it's really developed through a process of thinking about what can go wrong, what are your risks and what can you do to minimize the risks that you will have a disaster. Then also think about what should do if one occurs to minimize the impact of it and then the recovery phase, so all three of them.
>> That was real interesting to see this, I wasn't familiar with an intrusion detection systems that can be built into the software so that you can actually have an alarm sent to somebody to say something has happened. Some event has happened that you want to check. We all get that back and if we change our password anywhere, it's the same kind of know back to something is happening.
>> Paula, do you have any sense for how many people use outside professional IT organizations to monitor their security and do updates and patches?
>> I Don't, but I'll tell you from my own experience, you always have somebody on your staff, especially some of the smaller centers, who is tech-savvy and seems like a really good person to have be in charge of XYZ. My suggestion to you is, don't do it. Get an outside fund because as soon as you give a single person that kind of access, instead of doing it through a professional group, I just think you're asking for trouble and I've seen that trouble a time or two out there.
Just because someone says, I know how to do that doesn't mean that you should have them do that. Contracts with an IT organization gives you that extra level of security. What have you seen with that kind of contract, John?
>> I agree with that, we use an outside security firm, not only is it the number of people involved, but it is the discipline to get the updates and patches sent along quickly and to contact you if there's any potential problems. If you're using somebody who is knowledgeable and good, they still wouldn't have that discipline that you would have in an organization that does this for a living.
>> Now, often that person has other job responsibilities, and this is at the end of their list. If you're using somebody in-house and if you're using somebody's relative, stop.
>> Right, I agree.
>> Don’t do that.
>> Strategies to improve banking security. There are all sorts of things that can go bad, falsified checks, we talked about bank account hijacks and including on your mobile devices. These can be reduced with a number of technologies that the banks have actually developed. They're not to sell them to you. They're not trying to keep them secret from you. They are very, very willing to share that. One very simple thing is just using secure checks and secure checks are much harder to change, harder to change a payee name, harder to change the amount from, let's say 100 to 1000.
That's just a physical security, but then there's a thing called positive pay, where you provide your back with information about checks you're going to issue for matching. If they come up with a check that you didn't tell them was on that list, they'll send an email to you. You need to respond to that if you want that check to clear. There's a reverse of that where you get to review the incoming checks before they get processed. Finally, in that section, you use the secure font insert asterix above the payee named to prohibit adding another name.
>> Yes. I'm real curious about how many of your banks have told you about this security, but if they haven't volunteered it and you haven't taken advantage of it, we really do urge you typically doesn't cost you anything, and what a nice way to begin to limit the access that someone else might attempt to have on your account itself. It's always a good thing to do. We also ask you to look at objective controls over compliance and there's several things that you can do here that you can take a look at. I don't know, John, you want to hit this? You're probably more familiar with it.
>> Right. The objectives of controls over compliance are to make sure you're preparing a reliable and timely financial statements and federal reports. That's one objective. Another is to maintain accountability over your asset, basically to secure your cash or investments, your property, et cetera. Then demonstrating compliance with federal regulations and agreements particularly any statutes like uniform guidance or uniform administrative requirements and the terms of grants and contracts. Paula, you said this so many times, but if you're not documenting it, you didn't do it when it comes to a funder audit, right?
>> Right. You have to make that commitment and make sure you do it consistently. We talk about this some when we talk about the Cares Act funds because here's a new pot of money and suddenly you're spending it on things that are different from what you were doing before, at least some of the time. So, you finally find yourself in this situation where you have to have additional checks and balances, some of you are making purchases at a higher level than you've made before.
Suddenly you're purchasing with a vendor at a higher level, and we'll talk about it and procurement, at what point you have to get price comparisons and at what point you have to get bids. Many of you are in that category where you have to at least have pricing comparisons to prove it's reasonable and maybe you weren't doing that with your day to day stuff before the Cares Act came along. You've got to be able to apply those skills you're gaining to the next situation, in this case, the Cares Act funds.
>> The next sentence section is talking about information technology control, and you need to have current operating systems, not only on your individual workstations but also on your server. Workstations should use operating systems that are Windows 10 or better. Windows 7 is no longer supported. No longer supported means that the updates are not being made to Windows 7.
As a result, when somebody finds a weakness and a weak Windows 7operating environment, they can exploit that to get control of your information or your assets and there's nobody protecting you even if you had a service Bureau looking for updates. If you're on a system that isn't currently being updated, you're not going to get--you're not going to get any updates. Operating system and updates patches should be installed properly.
>> One of the things that many of you are doing, what the Cares Act funds is upgrading your computer services. We did a little survey. We had you mark all of the things that you're doing, and 72% of you are using some of that funding to upgrade the center's technology. That is certainly an allowable of that funding because you're suddenly supporting a number of remote locations, which has increased your risk. You want to improve your technology in whatever ways you can, so take a look at what we're suggesting here.
Have you upgraded all of your operating systems? Have you put patches in place? Do you have an IT person who's now on contract to help keep things up to date because those are allowable as you expand? Now, you will have to sustain those costs if there are ongoing costs, but some of them are onetime costs that you can use the cares Act Funds to do now.
Your backups need to be stored offsite, in a cloud typically, because that way you're protecting some data away from the system that might become compromised. We suggest you do that often, daily is good because anytime you're in making transactions, if your crash or ransom comes in, you can only go back to the point at which you last backed up. You want to make sure that your backups are frequently happening so that you don't lose anything significant.
Then IT and IT, security training should be provided to the staff as well. Think about what kinds of things around cybersecurity do your staff need to know? We're talking about some of them that you need to know, but they do too. They need to know password protection. No matter how frustrating it is to change your passwords on a frequent basis, they need to know the reason why. That training is good for them too, including social engineering awareness.
I love that term, but you know what it is, you get that email in your inbox that looks like it's important that's from either IRS, social security, something that has to do with something that you would respond to if you thought it was real, and then they asked me to click on that link. Some people don't have the savvy to realize that's a risk. When they first started getting hit with those emails, they don't understand that they shouldn't open certain attachments or download certain things or respond to certain voicemails, all of that stuff. They can't really do all of those things. You need to make sure your staff are savvy too.
>> That training is every bit as important, maybe more important now that we're working remotely, but it's harder to do. You need to be a little bit more proactive. You will find that there are some great sources online, your IT. If you do use an IT service, they may be able to provide some things for you. It's really important these days with the increased risk and the increased hacking that we talked about that training continues even though you're not all together in the offices.
>> Yes, absolutely. You also have some things that you set up to happen automatically, backups and we were just talking about is one of them, but also logging off after a certain time. Whether that workstation is on my dining room table or on my desk at the office, it needs to log off if I step away. If I don't think to make it happen, it still needs to happen so that we keep that security because many of you who are working at home have other people in your household. That other person in your household can access that whether or not that it's intentional.
I mentioned my three-year-old grandson and his older sister are fearless. If you leave any screen around, they're in there messing with it. You just can't do it even for a minute. There's not always intentional, but sometimes things get damaged unintentionally because it hasn't logged off. For both reasons, for both the intentional and the unintentional you want to make sure you have that taken care of.
Then you've got to do another level access to your screen, turn it on, but then access also to the software itself. At both levels, you need that protection because if you're in QuickBooks, working on something, you don't want to leave that open anywhere so that somebody could come by and enter a check to themselves or something.
Also, surge protectors. There are lots of natural disaster-related power outages and then surge as they come back on. I know that we're experienced in some of those here, I'm in California with the wildfires. I know that some of you have ever experienced that with some of the hurricane activity along the Gulf Coast and along the East coast. There are just good reasons why you ought to always have battery backup as well as surge protectors in place so that you can make sure that your data is safe and doesn't, and your hard drives don't get damaged by those surges.
>> Yes. A couple more comments on that, with the backups, you should check periodically to make sure they're working. You put a backup system in place even if it's a cloud-based system, you need to test that occasionally not all the time, but occasionally. Maybe every other month see if you can download and restore a file from wherever your backup is. We have seen just terrible situations where there was a loss of information and the backups that were set in place weren't working properly. That becomes a real disaster.
Then also we said surge protectors should be, or battery backups should be properly configured. What that means is that they're configured to shut down the computer after a period of time. They might last 30 minutes. They might last 60 minutes, but if they're not configured properly, it'll just be like pulling the plug after 30 minutes. That's not much better than just pulling the plug, particularly if you've lost because of a calamity in the area.
>> Yes. When we look at all these in information, technology controls, some of these, your IT company will assist you with. When it comes to backups, if you have that IT contract and they're backing up, they will also do a verification, at least from time to time of that backup for you as a part of that contract. You still want to go in and check it yourself because you don't want to know, but it's the information that you expect to be there, but they can also assist with some of these items as you go a long.
>> Of course password should be secure and they shouldn't be changed periodically. Actually, in the industry they don't use the term passwords as much. They use the term passphrases because it's really the length of a password that makes it difficult for a hacker. They can try a combination of things, but each time you add a character, you add a level of difficulty for that password to be hacked.
It's probably no secret that I like motorcycles, but if that was my password for my bank account, maybe it is, maybe it isn't, you can try it[chuckles]. That's pretty long. That's really easy for me to remember so, think about the length. You may also have standards for having special characters, capital letters, numbers, et cetera. Just keep in mind the length is really key to a secure password. More and more people are talking about password keepers, where you really only need to remember one password and your password keeper will keep all of the others.
>> One of the reasons that you have your devices time out, is that you've saved all those passwords in there, along with your usernames as if no one was ever going to see your computer. They can get into almost everything by going into your desktop if you've saved all those usernames and passwords in the operating part of it. You got to think about that too, is that what you wanted to do?
I was going to say, who gets what somewhat depends on how you have it all connected. I'm sitting here at my house and they always want me to connect all my devices through my Microsoft thing, so that my phone and my tablet and my computer, my email was all the same on everything. I can look at any document on any other. John, am I wrong to resist some of that? [laughs]
>> Did we what, Paula?
>> Am I wrong to resist having everything duplicate across all my devices?
>> I think there are clearly benefits to having that, but what that means, is you need to have the same level of protection across all of your devices. That means up-to-date anti-virus protection, ad blocking, Anti-spam software. There are programs now that will scan emails before you even get to look at them. Also, that will scan websites when you try to log onto a website. Takes just a little bit longer but it definitely adds a layer of protection, but it should be across the board.
Now I don't have the exact configuration at home, and in the office, I have the exact same computer though. For some, I just have less access at home than I do in the office.
>> Makes sense. Makes sense. Now that we're all working remotely, how many of you are getting email on your phone instead of where you used to on the desktop? Most of us are checking work email on our telephones, which is not something that we used to do very much because we could do it at the office and leave it behind. Now, we're working at home, In think I'm seeing a lot more of that.
So, is your server secured as well? If we're going into your servers for more information, you need to know that at every level, you've got these barriers, these walls, to keep fraud from happening or to keep somebody from trapping you into their schemes. I know it increased due to COVID-19 everywhere. When I talk to people about it, they're all saying, "Yes", the use of other devices other than the desktop computer. A lot of you have changed over to laptops or docking stations for your laptop or other items. Have you, with all those new items, put all the security in place, would be the question that we've had there.
>> Hard drives should be defragmented occasionally. What that does is, it reduces the possibility of a hard drive failure, but also it gives you more space and we didn't say this anywhere, but it is important to make sure that you do have adequate space on your hard drives so that you don't run out of space and then have failures as a result of that. That should be monitored as well.
>> Yes. Your licenses for your software and your warranty information for your hardware, you need to have that in a place where you can access it readily. If you did all that by email and you stored it somewhere in your email, that's an electronic copy is fine, but make sure that your email doesn't timeout to archives. If you have something that you need to keep, you need to find a place to keep it that's going to be always available to you or always accessible to you. If it's an electronic record, as opposed to a paper record, it doesn't matter as long as you can truly access it.
I know I have a person I'm working with who had their settings on their email account to archive after a certain period of time, and then they can't find anything in those archives. They're not organized in a way that they can find them well. The search no longer works with those older emails, and so they've set themselves up for a problem because they can't access their license and warranty information. Continuous Remote Monitoring, is that your IT group, right?
>> Right, right. It'd be nice if we could ask these is as survey questions and see a show of hands there. Really, just a question to ask yourself, do you have continuous remote monitoring by a professional IT organization? Do you simply work with an outside professional IT organization for any issues that come up and do you have an IT professional on staff?
I doubt many organizations do. I remember the day when we had to and they had a full-time job, but as computers have become more reliable, it's just not necessary. It's also hard for somebody outside of that environment working in your environment to keep up with everything, particularly the newest and most challenging hacks and things that can cause problems for you.
>> One of the things I want to mention here is that if you're using a database software program, which almost all of you do, to keep track of your consumer information about what services you've provided and be able to tally that up for you for your PPR704 report program performance report at which you are going to start working on right on the 1st of October because all the work's done for the fiscal year. As you do that, make sure you also know what they have available to you in customer support and also what they have available to you in a cloud because some of them use some cloud-based options, but make sure you've also checked into that.
We are going to spend a lot of time talking about that software. We're going to talk more about the financial pieces, but that's a very critical piece of software that you have that these same things apply to. You need to have it protected. We can't have people in there messing with that information. You need to make sure that you keep it up to date, that the patches are in place, that your staff is trained, and so forth.
All of the same things that applied that we're talking about also apply to that and maybe you need to step back a little and think, well, I ought to call the provider and you ask them what they have available, or I'm not on their mailing list. They must have said that to the prior executive director. Make sure that you are in the loop for that software as well, not just your financial one and personal information.
>> We can't really ask and answer questions that easily here, but I will tell you when we were developing this program and we talked about this area, Tim and I both became aware of organizations that had recently been hacked. I believe Tim's was a cyber scam. Mine was, it was ransomware, quite a large organization that lost access to all their computers, their emails, virtually everything. It truly was crippling. We're not talking about purely theoretic things here. These really happened.
>> 8% of the respondents said it had happened to their center.
>> Ouch.
>> Even though that's a smaller number and you might want to play the odds, don't because this is a very, it's a very cumbersome thing to come back from if you can even. Sometimes you end up starting moving with a lot of stuff.
>> Yes. That's a good point, Paula. It really can affect an organization. They say organizations that can't be up within a certain number of days have a heightened chance of failure. That's scary.
>> John, this is Tim. My anecdote was a little different than yours. It wasn't an organization that had been hacked. It was, we've started to see funders require cybersecurity insurance as part of agreements to receive funding from them. That was very interesting that not, yes, being insured against this could be an added expense, but it may be something that makes you more attractive or that could be required by some private funders. Just thought that was interesting.
>> Yes, it is. When you look at your risk management planning and you think, okay, is this a real risk? It is. 8% of you have already had it happen. It's a real risk. Is that something you ought to be insured against? Certainly, that's, yes, it would be good practice these days.
>> Yes, not just the insurance aspect of it, but they don't want to pay out a big claim. Basically, they're going to take responsibility to educate you on what you can do to minimize risks. I imagine they will continuously communicate with you about new risks, new challenges. It's really a very good investment. Tim, thanks for bringing that up because that is a good point. The cyber insurance is more than just insurance. It's a resource.
>> Just all of your insurance carriers, all of the policies that you have should also come with some advice for you. In some way, those companies, like you said, John, don't want to have the claims. It's always a good thing to keep that. Well, what do those guys want when they hack into your system? What are the cybercriminals after? They want you to pay them, that's the ransom money, or they want to get money out of your account directly if they have the ability to do that. They can sell credit card numbers and social security numbers and so they want to do that, of course. That's part of what they want to when they're looking for your information.
The interesting thing, I don't know, John, I've wondered if some of these cybercriminals used to have day jobs that disappeared after COVID came, and so now they're home all day long because the increases has been proportionate to the maybe the unemployment rate in during COVID.
>> That could be right. That could be right. I will tell you, I sat through another program on this topic not too long ago. They put up an actual ad looking for IT professional cybercriminals, and they were paying $216,000, and this wasn't in the US. $216,000, that's the kind that gives you some sense of the fact that this is a well-organized continuously operating highly incentivized process to steal your money or stuff that will get the money.
>> Wow. Well, how can you reduce those cyber attacks? By 90%, this website is actually good for you to look at other said, well. John, do you want to introduce this video at all or we want to just play it?
>> Well, the only thing I want to do is just to reiterate when you go to this link, so save this slide, go to this link because there are several different training programs. They're short, they're very concise, they're well done, they're accurately done. These are things you can push out to all of the people in your organization. The way to reduce your risk 90% is to reduce the social engineering exposure you have to keep your people from clicking on emails or links that they shouldn't be clicking on. That reduces it significantly. It's really worth training. This is just one example. Yes, If you can go ahead and show that video. I'd appreciate that.
[music]
>> Hi, this is Joe White. I'm the senior director of internal audit risk and compliance at the Association of International Certified Professional Accountants. Here's a cybersecurity tip. Always remember to patch. Timely patching is a key to an effective cybersecurity strategy, but what is a patch, and what does it do? A patch is essentially a piece of code sent from a vendor such as Microsoft to correct a problem with an operating system or software program.
Over half of all breaches occur because of a known vulnerability that was not patched. Think about that for a second. Microsoft informed you of an issue, provided a fixed, and yet you still failed to act. We're all guilty of it, but now you know.
To make sure timely patches are happening, conduct an audit of your software programs. Once you have oversight of your inventory, create a consistent and repeatable process to update systems with new patches as they are released.
[music]
>> Thanks, Joey. Again, you'll see several different topics like that. It's really worth sharing that with your folks and we're going to give you another link here. We won't show a video, but we'll provide another link with the tips of the day that you can check out. You may have to subscribe to this after a certain point.
>> If you can get that out to your staff on a regular basis, talk about it as just a point of your staff meetings, make sure that people are aware because that awareness is going to make the difference for you. This is happening all the time. I think I'm pretty low profile, more or less, but I ignore a lot of emails. Maybe that's because I don’t know I'm in too many people's lists, but I get them all the time and they usually are from the IRS or social security or some other important thing. I got something from the TSA yesterday.
You look at that email address and you see it isn’t the TSA. It's something else, but we all have it happen. If somebody doesn't realize that's what's going on and they click and then almost instantly, I bet some of you have seen that. Almost instantly emails start going out from that address to other people about whatever it is. It's scary
>> more importantly, now you've got some malware or malicious software and your own system that may result in either copy in keystrokes, so they know your password when you log into your bank account or installing that ransomware, so nothing good.
>> Nothing good can come of it. That's right. That's the end of the cybersecurity piece that we had. If you had any questions, be sure to put those questions in one of the methods that Tim mentioned, and we will revisit that during the Q&A in a little bit. Let's look at internal controls in a little more detail.
>> What we have is a very clear structure for internal control. You've heard references to COSO, which stands for the Committee on Sponsoring Organizations. These are national and international accounting leadership organizations. The green book, maybe you've heard of the yellow book, the green book is internal controls in the federal government. These are a couple of different sources you can look to for developing your internal controls.
The interesting thing is they both start with this very same structure. You need to have each of these five key areas, the first thing, the control environment, your commitment to integrity and ethical values, your oversight, your commitment to competence, and accountability. Ongoing training is a big indicator of your commitment to competence.
>> You're also going to look at a risk assessment. What are the things that are you most afraid of and what can you do about it? If you identify as a potential risk, a cybersecurity attack, for example, what are your mitigating measures? That training that we talked about is a huge one. You may have other things in your policies and procedures or in your in the protections on the computers themselves, that also protect you from that one. Those are the things you do to prevent that risk from becoming a reality. An assessment of risk is real important, and you just--
This is the one place where you probably want to use your disaster [inaudible]>> Some of you are people who like to worry, while you're doing this assessment is the perfect time to think about all the things you're most worried about, and then what you're going to do to get them as much as you can back in your control.
>> You may ask who should actually do the risk assessment? Well, clearly it's going to be leadership, but you probably have people on your board who would be very good at this. This doesn't have to be an ongoing committee. They may meet once, twice a year, but it's a combination of your senior staff. They know best what's going on inside your board. They understand your organization and its objectives and many of them may be business leaders, bankers, accountants, and then even people from your IT organization and possibly, from your bank, possibly from your insurance company.
All of these can get together, maybe virtually, and brainstorm what can go wrong with your organization. That's the risk assessment process here. In the next section, the control activities that that's what we do about it and then I'll let you finish, Paula, because you didm[crosstalk]
>> Yes. You do go into your policies and procedures and adopt policies and procedures that you need in order to avoid the risk that you're worrying about. What would assist your organization in minimizing at least that risk? As you look, maybe we can't stop all risks, whatever, but let's do all the things that are in our power to do in order to reduce that risk, and that includes some policies and procedures for your different sensitive activities, whatever those are. How do you document and what do you keep and who reviews? All of those kinds of things are part of that, identifying what the control activities are.
>> Then the next section is information and the communication. That's how you tell everybody about these policies that you've developed. It's how you get that information out there, whether it's training, whether it's emails, whatever that process is, but that's called information and communication.
>> Then of course, whatever monitoring you're going to do to check to see if your controls are working and also see if you've identified any other risks that might emerge, that's the process that that committee that John mentioned might do. Once or twice a year, meet and go back over, see how the controls are working and see if there's any other risks that you've identified as a result.
>> When we get to resources, Paula, we've got a list of possible monitoring techniques.
>> We do.
>> I'm going to rewind for just a second and go through those five points again, because this is one of those things that if you can speak well about it in a audit or a funder audit, then you're going to get a lot of credit and credibility in terms of understanding what this is all about. Again, you've got the tone at the top management's integrity and different ways of showing that integrity. Part of it is in how you hire, a part of it as in how you train.
Then your risk assessment getting together and say, what can go wrong. Developing policies and procedures, your control activities to minimize the possibility of those things going wrong. Information and communication, getting it out to your folks so that they know what they should be doing. Then finally, checking back to say are these still the right policies for our current programs and are they being followed the way we intended? Those are the five elements of internal control, really important to understand that, and you can apply those in any area that you're trying to control.
>> You mentioned these are understood universally among professionals who are handling this, right, John? Internationally and nationally, that's a pretty big statement to say these are the ones.
>>  Going on to monitoring activities. If somebody asks if you're doing monitoring activities, you should always say yes because you are, even if you think you're not. Maybe you can do more of this. You can add more formality to it, but just by just looking at a budget, the actual comparisons, that's actually a monitoring activity. Assessing your insurance at the end of the year, sitting down with your insurance agent to talk about risks and coverages that you have. That's a monitoring thing. Review of your receivables is really a monitoring thing. A receivable is being followed up, is the aging proper, and discussing controls with your staff. These are just examples. As I said, we've got a resource with more of those.
>> These controls and the monitoring of these controls is something that, again, that committee that does risk assessment, our internal control review can look at, but so can each part of your organization. When you have a staff meeting and you want to discuss what some of the procedures are to reduce risks, know that it's one of the things that the staff and say on an individual level, okay, we've got a hurricane coming in, what do we do to keep our physical files safe whether emergency or a fire. What's our process and do we know what to do?
Staff can give input into what that policy and procedure is. What is our process for reconciling our bank account? The board and the management staff can get input into how you would do that and how it's a monitoring activity. You do lots of things from day to day that are monitoring related. When you look at some of those, suddenly you think, "Oh, yes, that's right. I do monitor that. I didn't have, I hadn't thought about it, but I do monitor it." Here are some areas where you, where you want to make sure you have some procedures limit.
I mentioned the hiring process, so nobody can make up an employee for you. Making sure that you have the information intact, making sure that somebody who knows that position, physically approves it. Making sure that you have good personnel files, making sure that you have good oversight on your payroll because we had seen more than one situation where this is exactly where the fog took place, was that somebody either created an employee or kept somebody on the roles that was not still there so that they can draw a paycheck into a direct deposit account on a regular basis, changed the accountant the person left monies direct, deposited to the long place.
You need to make sure that you are paying attention to the hiring process, especially if you have a large payroll, which like I said, some of you with personal attendant services, especially have a very large payroll of people you never see. Make sure that you have something good in place related to that.
>> Again, this is just a list in a really short list of things that you might do, but I agree, Paula. That's a really key one is your personnel policies, hiring, paying, et cetera, who double-checks the rates and the hours but reviewing fundraising communications for accuracy and integrity. That's a good thing. Keep in mind, the monitoring may be done is going to be done by a committee of the board or a group of people from the board. Verify the bank accounts are reconciled in a timely manner. That's an important one, but you're really just going to pick from these different things. Maybe you'll do a few of these one year and a few of them the next year.
>> Kind of a random look at the different things that might be impacted. Yes. Your purchasing process, do you have the right levels of approvals on your purchasing? Do you double-check now and then to make sure that purchases are especially a credit card is still store credit card purchases, that all the purchases are accounted for with original receipts and not just the credit card piece"
Other things that we’ll, talk to you about is with practice, those are things you can double-check on, and continually training. We're going to bring that up a lot because unless that staff are trained and unless they understand what's going on, they can get a question during that audit too, it can go to anybody. Make sure they know what they're supposed to be doing and are clear on that.
>> I liked that question asking staff if they think their training and mentoring is sufficient because when he asked that of management, of course, we know the answer, but if the staff doesn't feel that it's sufficient then that management needs to not have that feedback.
>> Absolutely. Just because we're remote or partially remote, some of you may be going back to opening up to some extent. It doesn't mean you don't need control, so you still need controls in place. In fact, maybe you've changed some of those controls because of that remote status. Look at what still works and what doesn't work in that kind of a situation.
Compliance-related to federal funding does have to do at least in part with what's allowed and what isn't. We will be talking about that a little bit more as we wind up a little later today, but it also is a number of other processes too. When you look at what the feds will look at when they come in, they'll say it's compliant if all of these things are in place. Do you have good cash management policies? What are you doing related to what allowable costs and how are you deciding a cost is or is not allowable?
What are you doing to make sure that the people that you're serving are eligible to receive services? This is one of the reasons, just to give you a little background on what you probably already have in your policies. You're required to show that the people that you provide services to were eligible to receive those services. You ask them, do you have a disability? You don't have to have them have proof, but you have to ask them the question, do you have a significant disability is actually the language that you need to use? Do you have a significant disability? You need to record that.
A lot of us as we were trying to decide how to get things out quickly to people related to their COVID health and safety, we looked at streamlining your intake process, but you noticed that streamlining your intake process doesn't mean you don't have to know if people are eligible. You still can only serve eligible recipients. You can only serve people who have a significant disability and the best way to know that is if they say yes, they do.
You can set a lot of things for later, but that isn't one of them. You can't provide services unless the person's eligible. While we might not think about that, we say, oh, yes, any person with a disability. No, the language is significant disability. Don't forget that as you go through this process. You can see a lot of other related things there, some of which we'll talk about more in a minute.
>> The equipment and real property management, the matching, that doesn't happen as much with the funding that you get, but with some funding sources, you have to provide matching funds, which in some cases can be in kind. That's a good thing, but it also adds some additional requirements and responsibilities that we'll talk about. The period of performance is just about when you can carry on contract that evidence.
>> You know what, John, that, one's a really important one because when we switched from RSA to ACL, RSA is the Rehabilitation Services Administration, and they formally had these funds, and then they were changed over to the Administration on Community Living. At some point during that transition, the period of performance changed. For RSA, it was October one through September 30, but for ACL, it's September 30 through September 29.
That's important to remember when you're looking at what you spent when, especially if you're doing some last-minute spending because you asked them part title seven-part C money left, and you know you can't carry it over. You're trying to figure out what to don't date that bill, September 30, because that's next year, you do have to know your period of conformance. That was it took us all by surprise, but that happened.
>> The other area of procurement suspension and the bar mint and I think procurement is pretty readily understood, but has anybody been suspended from providing goods or services on federal contracts or debarred, which is similar? It means that they've been prohibited from --
>> You can't spend money with people who've been debarred so suspended and there's a place you can learn that. If somebody has been suspended?
>> Yes. I don't have that at my fingertips, but we can get that out.
>> I’m trying to remember what that was. We'll get that.
>> SAM.
>> It's at the SAM registration. You all are registered with the-- What does SAM stand for? Anyway, you all are registered with that site and so our vendors and other folks. I'm going to pull that up while I'm looking at, of course, Sam's club comes up first. SAM registration, civils, and say what the SAM is.
>> While she's doing that, let me just mention, so a couple of other areas of compliance would be how does program income get used? We're going to dig into that one a little bit more because there are some special rules here. There are reporting requirements that you need to comply with, and of course, there are time deadlines for them. We talked a little bit about sub-recipient monitoring. We'll get into some of the specifics for that later. Then do you have that, Paula?
>> No, I don't.
>> We’ll come back.
>> It jus says SAM over and over again.
>> We'll come back.
>> I'll come back around to that. I was going to say that with the program, not program income, it was something you said that it'll come back to me. I don't know what it was, reporting. Reporting, the most obvious report that you need to do is that you have a SF425 that tells how much you spent in a year and the quarter we need to do it periodically. Then at the end of the year, you also have coming up your program performance report.
>> Then the last item there is special tests and provisions. Those are usually things that are unique to the particular funding contract or grant that you have. They go beyond the normal standard compliance, federal compliance.
>> The kinds of things that we see most frequently when there's a compliance report, some of this based on the past, but some of them based on also what we see in the instrument that the office of independent living programs has put together that they call, I'm not going to say what they call it because then I have to tell you what the letters stand for and I can't remember. It's one of those days when abbreviations are just not [inaudible] but it's called COMP. I will tell you that, it's a compliance something or other, something rather something, which I'll come back to in a minute. That compliance includes these elements.
When you look at all the different kinds of things that we mentioned, just know that there are areas that will be reviewed, that are in the check list. So, when they ask you to send that paper, because sometimes they'll do a desktop review, you have to make sure you're showing them everything that you do related to these things. When they're on-site, you're going to have to pull the documentation for them physically at that point too. Wherever the review happens, whether it's a desktop review and you're attaching electronic documents, or it's a paper review, and now on your site, you're going to have to show them backed up information for all these things. Just keep that in mind.
Now, not all of those maybe apply to all of the areas, but most of the time, whether something's allowed or not, is the same. It's the same across all federal grants. Most of the grants that you get are federal or federally-sourced. Most of the time, the States have very similar language about what they don't allow. It's almost always the same. So as we talk about what's allowed not allowed, we're going to be able to talk about that in a little more detail
>> When these areas apply to your funding and if they're direct in material, you need to have in document that you have controls over these areas. It is not good enough to have a funder go through and not find exceptions to these required areas. You have to have controls in place. You have to document that you have controls in place. You really need to get it right at two levels. You need to get it right because there are errors, or at least they didn't find any, but also you need to have controls that are in place that will allow you to either prevent or detect and correct mis statements.
>> The controls are in place, whether we say they have to be written in your policies and procedures, and then you have to follow what you said you would do. They will look at both those things. They won't look at just one or the other. They will ask you, where is your policy, and then they'll follow through on whether or not the policy has been followed.
>> Specific controls over allowable activities and allowable cost principles can include things like having an independent person who's knowledgeable identify allowable activities, the overall budget and whether certain costs or activities require pre-approval. Just an example, but that's the kind of thing that falls into that category of controls over your federal awards. You've got these broad areas, you reduce that to the areas that apply here to your funding and that are direct and material and then you have to have controls. This is just one example. It could be any of a number of things but you need to have controls and demonstrate you have controls that should allow you to comply.
>> That's what I was going to add is that you have to document. If you have a committee that's reviewing XYZ, you have to document that they met and reviewed the things they were supposed to review. If you have that kind of a control in place, you have to take that next step to make sure it's always happening and that you can prove it because if you don't write it down, I don't know that they would accept a note on your calendar that it happened. They probably want to see minutes or at least I'd feel better providing them with minutes because then they can see what the committee actually did rather than a note on my calendar.
>> Now let's move into controls over allowable activities and allowable costs or cost principles. A typical internal control for that would be review of contracts again, by a knowledgeable person to identify allowable activities, the overall budget and whether certain costs require pre-approvals.
>> Yes. You actually then look at that to determine how much money you're going to draw down. Sometimes I have- this is the past management piece. Sometimes people will ask me, how can I know how much to draw down? Well, you look and see what checks you wrote and what portion was allotted to Title VII Part C. Then you go in and draw down that amount so that you can pay those checks. That's the process that should be happening. When I first started doing this five or six or seven years ago, depending on how-- I was a contractor.
Anyway, when I first started doing this I saw some centers that just pull down 1/12th every month, spend what they wanted to spend and then put the difference in their savings account. That's not okay. You're not allowed to save money from your Title VII. You have to show that you actually spent the money on the approved processes, the approved programs and services for that grant.
You need to know that when you draw down money, you can draw it down before you spend it, but you really draw it down as you spend it. Because you figure out what checks you're going to write, you figure out the amount, you draw it down, you mail the checks. The cash-flow issue should not be a cash-flow issue for Title VII. It may be a cash-flow issue for other grants. By the way you can't borrow from Title VII to pay for those cash-flow issues and then move it back later or whatever. You don't get to do that. You don't get to juggle the money. But for your actual Title VII expenses, you get to draw it down as you spend it so there shouldn't be a cash-flow issue for those specifically. You do want to make sure that you can report on the time-frame. They want to see that there's not a big time-frame between when you draw the money and when you spend it. They want to see that you were issuing those checks and why you drew down what you did, has been part of that review.
>> Again, we're talking about controls over this process here. For period of performance, the time during which you can carry on the activities that are funded here. Someone should review the contracts to identify what that [inaudible] performance is. Any unique requirements about pre award spending, sometimes that is allowable to an extent. Extensions and how any unspent amounts get repaid or carried over. You've got a process for monitoring that, that’s what's expected, is you've got a control over that aspect of federal awards.
>> I hope you remember that you're required to have a three-year program plan. You report on that on your annual report that you submit. You report on what progress you've made in the past year on that plan and what you plan to do in the future with that plan, but you're required to have a three-year program plan. If you're not currently doing planning, you need to step back and make sure you are because your spending has to be in keeping with the requirements for IO but also with that plan. You should be able to show a connection between your plan and the spending that you're doing.
I found the abbreviation for CALM. It's compliance and outcome monitoring protocol. Compliance and outcome monitoring protocol is what the ACL is calling their review system which is their process for reviewing your center to see that you're meeting the requirements of the regulations and so forth. They've got that in place and as I said, we've been able to look at those and see what we're doing in relationship to that and we have training on how to apply that instrument to improve the services. That's also available.
>> This next slide says that even though for each of the areas that are applicable to our funding, we actually need to have all of those five categories of internal controls that we mentioned a while ago. We need to have all of them, but most of them, four of the five of them are actually agency wide. When you think about it, your control environment applies to all of your grants, so if you've got that in place, you've got that for all of your funds. Same is true with your risk assessment process. It's really just a matter of like we said, sitting down with a group of people, brainstorming what could go wrong.
Your information and communication pretty much can be an agency wide process as well. How you get this information out to people, how you have training programs or email communications, and your monitoring. Your monitoring is going to be- call it haphazard. That's not a bad word. It means you just select among all of the different possible monitoring activities you can think of periodically. All of those, if you're doing it for one, you're probably doing it for all of them. It's really just the control activities that will be unique to your funding here. That's how you get and you prove you have controls over federal awards, each aspect of controls for each federal award.
>> You can see what we've been saying is that it's a lot more than a written policy. There is other documentation that needs to be in place so that you can show that you did what you said you would do. If you don't document that, then it's as if it didn't occur because documentation is an essential part of showing that you have internal controls. As John said, some of that may be somewhat random. You can select different things as you monitor, but they may select them all. When they come out to review, they may select different things, but they may select to look at all of your monitoring processes and if they do, what is your documentation that it actually occurred? Especially on that monitoring piece. I think a lot of the other pieces are pretty easy to show, but if you're not doing the monitoring piece, that's going to be something you'll want to spend some time with.
That's going to be true for also establishing the proper environment for control. You want to make sure that you are continually looking at this. Think about one of those circles would be arrows. You assess what your risk is and then you address that risk, establishing controls and activities and so forth. Then you communicate those policies and procedures. You provide the training, anything that people need, you monitor to see how it's being implemented, and then you adjust whatever it is you're going to do so that you can continue that process of continually knowing you have good internal controls in place, and that you are monitoring on a regular basis to make sure they don't fail, your internal controls don't fail.
I've told this story a time or two, but I'm aware of an organization that administered the Section 8 existing housing grant and that required a lot of different checks and balances for it, including somebody who went in and inspected any of the approved sites so that you verify that they were there. The person who was doing that had a serious illness in the family, was gone a couple months. Came back and started doing those assessments and found that the other person in the department had made up some addresses and was sending those checks to her own account. She was prosecuted and she did have a huge fine and jail time as a result of that federal fine. But it failed because he was out and there wasn't a backup plan and so the monitoring didn't happen as it should have. It did eventually catch up and they did catch it, but it didn't happen as it should have, so certainly you're going to look at those controls when things are unusual, that's often when they slip away.
>> I just wanted to say, when auditors do single audits, compliance audits, which basically happens when you're over that $750,000 of expenditures, we need to look at your controls over compliance and people look over our shoulders too. Auditors get audited as well. Not every year like many of you do, but every three years we have what's called peer review, which is really an audit of our auditing procedures. This is something we do, if we do compliance auditing, we need to have a peer reviewer who specifically looks at how we do that and we need to show how we tested what actually happened but also how we tested the controls over it.
>> Okay. These are my favorite words. If you look at the regulations, the regulations are found in 45. CFR stands for Code of Federal Regulations and we're looking at part 75 in the paragraph 403, it says- this is on slide 54 if you're following along that way. It says, "All costs must be necessary, reasonable and allocable." Those are terms that-- We'll give you a definition on the next slide, but those are terms that you'll see show up over and over again throughout the financial regulations.
Every cost needs to be necessary to the performance of your grant. Every cost needs to be reasonable, even if it falls below the threshold where you have to get bids, how do you know it was a reasonable cost? Did you do your diligence to ensure that? And you have to spread that cost if you have more than one program benefiting from it. That's what allocable means. It's not a word that we commonly use except when we're talking like this. You need to conform with federal laws and grant terms and be consistent with local and state policies.
This means that whatever you're using out of the-- If the designate state entity is providing you with regulations, you need to conform with the federal things. You need to also know that you may be responsible for additional state things and your own policies and procedures. You need to treat each cost consistently. A cost is only allowable if it meets all these things. You'd have to treat it consistently. That means that you can't decide that a cost is public relations for one grant but it's outreach for another. If you've got to split the cost, it is what it is. It's the same thing, and whether it's direct or indirect, it has to be consistent. You can't have it be a direct expense on this grant but an indirect expense over on another grant.
You just need to make sure that you're treating things consistently. This should stop the procedure that I alluded to. I was talking about drawdowns, that you can't borrow from the money you can drawdown to pay while you're waiting for the state to come through with the money for this grant over here. The same thing is true with not being able to change the categories of things. You don't get to just adjust it after the fact and decide, "This works better over here," or "Just for this once, I'm going to pay for that under my direct expenses because I have it." You have to treat a cost the same way across all of the things that you do. In accordance with GAAP, which I don't know a lot about, John. I don't know if you want to finish these [inaudible]
>> GAAP is generally accepted accounting principles and that is a requirement of Uniform Administrative Requirements and Uniform guidance. That then means things like the accrual basis. We said we can use cash or accrual basis when determining whether we need a single audit or a compliance audit, but when it comes to the allowability of costs, that doesn't need to incorporate the accrual basis so we record it as an expense when we received the product or benefit, not when we write the check.
>> Right, right. When we look at these costs, we also need to make sure that again, they're adequately documented throughout. That's also one of the things we're looking at here. Here are those definitions we promised you. Reasonable. A cost is reasonable if in its nature and amount, it does not exceed that which would be incurred by a prudent person under the circumstances prevailing at the time the decision was made. That's the actual definition. If you think somebody would raise their eyebrows at something you're doing, that it doesn't seem reasonable to the average person, then you need to really document why it is reasonable. You can do that right on the bill and then can say this was reasonable or necessary because of whatever the circumstances are. If you think anybody would question it, we really do suggest that you document why you think it's reasonable, also why you think it's necessary.
A cost is necessary if it's required to accomplish the purposes of the project. In this case the purpose of Title VII of the Rehab Act, the purpose is the core services and-- The purpose is that first paragraph that's a wonderful mission and philosophy [inaudible] paragraph, those are the purposes that you're achieving.
It's allocable meaning that you can charge it or assign it to different projects based on whether or not it's a shared cost. If it's incurred specifically for your Title VII Part C grant and not any other, then you can charge it to specifically the federal grant, but if it benefits more than one award you're going to have to allocate across those awards. Some costs might be direct, some costs might be indirect, but you're going to share those costs in a fair way. That's how you look at it. I don't know if I explained that long enough or not. Does it need more, John?
>> It’s good.
>> All right. Those are the main requirements and here we go. Let's talk about some unallowable costs that cannot be charged to programs that are entirely or partially federally-funded.
>> Alcoholic beverages, that's an absolute.
>> No question.
>> Bad debts. Clearly you're not going to have bad debts from your federal funding. Obviously your bad debts is from another source, whether it be dues, income, or other commitments from purchases or even contribution commitments. Those can't be charged to federal.
>> What about somebody misused our federal dollars and they've come back to tell us we have to pay it back now.
>> That's bad. It's not a bad debt.
[laughter]
>> I thought it was [inaudible]
>> I suppose even if it could be characterized as a bad debt, it still wouldn't be deductible because it creates a vicious circle.
>> Yes. You can't pay for something you messed up with your federal [inaudible] Certain advertising, we’ve mentioned that a little bit. We'll go into that in just a little more detail in a second.
>> Yes. Contributions you make wouldn't be deductible. That's a [inaudible]
>> [crosstalk] two center directors talking to each other and they say, "I'll send $1,000 to your center if you'll send $1,000 to my center because we've got this match going on right now in the state from donations, so if I donate to you and you donate to me, we'll all come out ahead because we've got this match." [laughs] You don't get to donate to another center so that they donate to you. That's just not okay.
Certain entertainment and I think maybe that's where the events sometimes fall. When they're questioned around whether or not they're resource development, that also brings a certain question to bear is, are they entertainment? Sometimes there are things about that that could be entertainment.
Fines and penalties, lobbying. Those are all costs that you cannot charge to programs that are entirely or partially federally funded. When they're partially funded, of course it's just their share we're talking about, the federal share that we're talking about, but they are unallowable. Let's look at a little more detail. Now there's a long list in here. It starts at 30 and it goes 31, 32, 33 and so forth. It's alphabetical so if you're trying to find something, if you know what to call it, you might be able to find what it says about it, so you can take a look at that. Here's some that sometimes people ask questions about. I'll do the conferences and I'll let John handle depreciation.
Conferences are allowable. They do provide some extra guidance on them and that is that costs for educational programs are allowable as are costs or programs the organization itself develops. You can have conferences and the cost of those conferences. They're allowable as long as they're still considered reasonable and necessary, so that's an important caveat. I say this just because I once knew of a center that had to pay back for a conference they attended. It was judged that it was more recreation than conference and that it wasn't appropriate to what they were doing. They just wanted to go to this destination. When they were reviewed, they found it is not allowable because they couldn't show how it related to anything they did in independent living and it was a destination they wanted to go to, so they had to pay that back. It was not allowed.
>> Then depreciation is a tough one. Let's say generally it is allowable but you need to be very aware of the fact that if the equipment was purchased with federal funds, you can't also charge depreciation on that same equipment. Equipment used exclusively for non-federal contracts, the depreciation on that wouldn't be allowable. General-purpose equipment that serves the organization throughout, depreciation would generally be allowed. Land doesn't get depreciated, so no depreciation there.
>> I'll look at employee health and welfare costs. They're costs you incur consistent with your policies for the improvement of working conditions or the employer-employee relations, performance appraisals, performance-related stuff, but they have to be allocated based on your staff time and where they're spending their time. A couple of interesting ones that I've seen charged as employee health and welfare costs include bottled water. There's an argument that some people can make that it's not reasonable and necessary.
Then in certain parts of the country, you just wouldn't drink out of the tap and so what are you going to do and is it a health and welfare expense is a good question. That was one that was interesting. The question of bonuses comes up a lot. Are we able to give people any kind of a bonus? That is not really health and welfare but you do have to have a policy in place in order to do that. You can't just decide at the end of the year that you've got money leftover that you can give everybody money because you've got money leftover. You have to have a pre-existing policy and procedure in order to do that. Just because that's an employee cost and I didn't want to forget to [inaudible] Then I mentioned entertainment costs, not allowable unless they have a program purpose and are authorized in the approved budget, which right now we don't submit a budget for approval, so it would be instead with prior written approval.
>> Then equipment and capital expenditures for general purpose. Land, buildings, or equipment wouldn't be allowable as direct. They might be recoverable as indirect. The exception being if there was prior written approval of HHS or the pass-through entity to reimburse for those purchases. Then special purpose equipment over the capitalization threshold is allowable but only with prior approval. It should be part of the budget. It should stand out as an individual item. Same rules for improvements to buildings and equipment.
>> Well, we've mentioned, probably exhausted, what we know so far about fundraising just that generally fundraising costs are not allowable. Fundraising costs for the purposes of meeting the federal program objectives are allowable with prior written approval. Resource development is required. Those things still stand. If you're part of a SILC resource development is allowed if included in the State plan for independent living. The SILC is the Statewide Independent Living Council and it's permissible but it's not required. In the case of the centers, it is required that you do these [inaudible]
Insurance costs required or approved under a federal contract are allowable. Payments into a reserve for self insurance like you do with unemployment often or into some account like that is typically allowable. I don't know what the limitations would be, I guess not to exceed the amount required or something like that.
>> Yes, possibly, and you know we really didn't discuss board insurance. That would probably fall into an indirect, if it did. I think if the board determined that that was appropriate, it would probably fall into indirect but I am not aware of a prohibition against that, but it certainly wouldn't be a direct charge.
>> Typically some kind of liability insurance, directors and officers insurance. Often the board has some say in, because it's partly the board that it protects as well as the organization as a whole. They certainly want to be at least cognizant of what you're doing [inaudible]
Lobbying. We had some extensive slides on this and we trimmed them down to short slides because we decided you have [inaudible] training and we don't- we're packing a lot of material into this training. In fact I'm going to do this fairly quickly so we can get through the slides this afternoon. The costs of lobbying or influencing regarding grants, contracts, cooperative agreements and loans are not allowable. Influencing is defined as influencing lawmakers or influencing federal employees who might oversee your grant. Either one is actually included in that influencing piece. The costs incurred to attempting to improperly influence an employee or officer of the executive branch of the federal government regarding a federal award or regulatory matter is not allowed. There are certain exceptions which make lobbying allowable, including lobbying related to your ability to perform services under that federal grant.
You can discuss whatever the barriers are preventing you from performing services under your federal grant. You can do technical or factual presentations on topics directly related to the performance under that federal award. You can provide information on what is happening as a result of a regulation or what services are being provided, who's unserved and where. Anything like that is certainly allowable as you're providing factual presentations on topics related to the performance of your award. There are some things that you can't do because you're a 501(c)(3).
That's a designation under IRS for a type of organization. Centers are all required to be 501(c)(3)s. It's in the law itself and there are things you cannot do because of that status. You don't want to lose that status because you can't be a center if you lose that status. Some of the things that they said are excluded from the IRS definition are nonpartisan analysis of study or research. That would be allowed. Examinations and discussions of broad social, economic or other problems and certainly we might take a look at some of those, right? Also information provided upon request from a legislator for technical advice.
You certainly could be in that situation. Those are the things that are allowed. Typically trying to influence people for other purposes is not allowed. I always say as soon as you ask somebody to vote for or against something, you probably are crossing into the lobbying territory. John, I know there have been some- interesting things have happened with that IRS definition on political candidates? I remember an example you gave at the last training. [chuckles] Maybe that just stood out in my mind about a non-profit who supported a political candidate.
>> Yes. I think we'll save that because we've got a session where we're going to talk about how that might happen even inadvertently and what to do about it, but certainly any support or opposition of a political candidate and boy, what a year that you're tempted to do that but you can't. Short story is you can't and sometimes it happens almost unintentionally.
>> You can't do that whether or not federal dollars are being used. Everything else we've talked about here, lobbying, you can't do with federal dollars, but you can do it. But that's not true when it comes to the support of a candidate. That's not allowed because you're a 501(c)(3).
>> Yes.
>> Hold that thought, and we'll talk more about it later. All right. Interest.
>> Interest. If you're borrowing money because you need cash flow, well, that's not the federal government's problem. They actually have a process for you to draw down and be paid in a prompt way so they're not going to pay any interest you have on lines of credit or anything of that nature. But if you're paying interest on a building loan as an example, that probably will be allowable. At least the cost of the facilities if they're general purpose facilities can be included as part of your indirect, or a portion of the facilities that are used for program could be charged directly to program. That would include the interest costs on a building that you've purchased or constructed.
>> Regarding legal defense and other legal costs, they may or may not be allowable, but they're not typically allowable in certain specific circumstances. If you're being sued and it's initiated by any government entity under the False Claims Act which prevents fraud on the part of- defrauding the government on the part of the grant recipient, the costs related to defending that are not allowed. Nor are they allowed if a current or former employee has submitted a whistleblower complaint or a complaint of reprisal or retaliation, then typically those costs would not be allowed.
If the claim relates to a violation or failure to comply with regulations or laws, it would not be allowed. If it results in a criminal conviction or a civil or finding a misconduct or an order to take corrective action or debarment or suspension of the non-federal entity, remember that's what we call you, it would not be allowed. It's important for us to say though, that this is after you already know there's something legal happening. You can use and pay for legal costs related to preparing yourself so that things like this don't happen. For example, a review of your personnel policies and procedures to see if they follow the law and if they provide you good protections should an employee later decide to sue you because you let them go. What are your good policies and procedures? Are there some things that the board might want reviewed like a contract, certain contracts or things like that. If you're being proactive on the legal side, then it's typically allowed. If you're being reactive because somebody is suing you, it's typically not allowed.
There's one more page to this one- there's two more pages to this one. If the parties decide to settle rather than continue with the litigation, the legal fees might be allowed if the litigation could have resulted in those things that we just mentioned that are not allowed. There's a possibility of the liability with specific written approval if there are proceedings by a state, a local or a foreign government, but you have to have approval before you can pay those legal costs. Presumably this would only be when the federal government would not have found the transaction to be a violation but someone else did. If the feds didn't find it to be a problem they might allow you to use those funds but you have to have prior approval. Then like I said, general legal and other professional costs are allowable when the individuals have a specialized skill, there's no conflict of interest, their fees are not contingency fees based on what costs they get back. You can usually pay for those legal costs in that kind of a situation.
>> A lease review, a review of your procurement policy, things of that nature as Paula mentioned. Proactive things.
>> Other factors that might affect those costs, there are several of them listed there. Whether or not you had to use a contractor to assist you with that, how qualified the folks are and their fees and whether they're reasonable, how significant federal funding is to your operations, might all affect how much they would not or would approve that.
I think that the most important thing for you to hear is this. If you are concerned that a policy or an action of the board or the staff is going to be a legal problem, hopefully before you take that action you can certainly consult legal counsel. That legal counsel can guide you before anything happens that you think might be questioned. You might have an employee that has already said, "You can't fire me. I'm going to sue you until--" If the board intends to fire that person then the board needs to talk to a lawyer first. That's allowable as long as they haven't taken action yet. Is that accurate John?
>> I agree.
>> Okay.
>> Paula, this is Tim. I'm thinking you need to be careful with confidentiality but that would also the right time to notify your insurance broker or agent. That's something our broker educated us about, that they actually want to know about those issues as soon as you realize there's a liability and that there could be action--[crosstalk]
>> Well, even potential liability. They may be able to help you with what actions they feel would be useful. [crosstalk] [inaudible]
>> And in terms of not having the claim denied when it comes to paying the claim.
>> Paying the claim itself and sometimes they'll assign counsel too. They have counsel that's paid for by your insurance company to deal with some of those things and sometimes they'll assign person to assist you as well. Real good point.
Memberships and subscriptions and professional activity costs. Typically they're allowable. Not the local country club but memberships in national organizations. Certainly we have our most common memberships for centers would be [inaudible] Some of the centers have a membership fee to a state association. Cost of membership and lobbying organizations are not allowed but professional memberships are allowed. The memberships to [inaudible] organizations even if they lobby has been allowed but you may want to ask just so you're doing your due diligence whether or not your membership fees go to lobbying costs. If they do you can separate out the portion that's lobbying.
[inaudible] says they're not using your memberships by the way for lobbying but if [inaudible] figures came back at 2%, then 2% of your membership fee would be paid under discretionary funds and the remainder would be paid under the regular funds. Membership subscriptions and professional activities costs are allowed but not the lobbying portion if there is such a thing.
Just keep that in mind. The last time I said this out loud in a meeting was when we did the [inaudible] one. Several people immediately sent notes out and said, "Everybody, you better not do this membership and you better figure this out." That's really more than I'm telling you. What we're telling you is you have a responsibility to know what of your costs are going to lobbying.
If you have a concern you need to research that. We don't do that for you. ACL doesn't do that for you, they're not going to tell you yes or no to something. They're going to expect that you've figured out for yourself whether the cost [inaudible] That's true here so I don't want to see any notes going out that I said that you had to do XYZ. I didn't say XYZ, did I? John did I say XYZ? [laughs]
>> No, absolutely not.
>> I don't think so. So you just want to keep that in mind, that you determine it. I don't say it's allowed, I don't say it's not allowed, neither does John. We just tell you in general what the regs say, you figure out the rest, especially when it's something that can be [inaudible] Just a quick point. I want John to talk about the paycheck protection program.
>> The paycheck protection program is a great program. They've made some revisions to it to greatly extend the length of time that you could use this money and qualify for forgiveness. Don't go running off trying to [inaudible] the forgiveness right away. The banks don't even know how to do it yet, so be a little bit patient with the forgiveness. The other message that's really important and that we need to share with you is if that program pays for some of your payroll, you can't also charge that same payroll to one of your federal awards. You've got to be very, very careful with that to make sure that you're not charging to two basically federal grants is what it would be.
>> It would be charging twice to two federal grants. Yes. Which we can't do. Most of us aren't dealing with pre-award costs. Those have to do with new grants but there are some provisions where you can incur costs before the beginning of the fiscal year. If you have a brand new center or a brand new award, just tuck that away if it ever fits you. We're going to go really fast on these last couple of slides because I think we've got quite a few questions to look at. Recruiting costs are typically allowed. That's where advertising is allowed, so you can see that. Employment agency fees are probably allowed. If there are relocation costs paid in whole or in part with federal dollars though, and then the employee leaves within 12 months, you have to repay or credit that federal award portion. Federal award cannot be spent for relocation if the person only stays for nine months or whatever. If they stay less than a year you may owe that back, so keep that in mind. John?
>> Rental costs are generally allowable. They may be direct. A portion of them are certainly going to be indirect, your administrative facilities. I don't think this happens very commonly but there have been cases where a second nonprofit organization was set up and the building was sold to that organization and then rented back. That rent is going to be limited to what the rent would have been if you didn't do that transaction. Some organizations use this as a scheme, if you will, to continue collecting rental income and it doesn't work. It's not allowable.
>> Travel costs incurred in connection with the performance of the award are allowable. They have to be charged either on an actual cost basis or a per diem mileage basis. I guess you can use a combination but you have to apply it uniformly. Whatever you do, whether you do per diem or actual costs or mix, you have to do it exactly the same way all the time. You don't get to decide, "I'm going to do the per diem for the meals but I'm going to charge the actual cost or something or other because I'll get more that way." You don't get to shift them back and forth. You have to-- [crosstalk] [inaudible]
>> IRS just announced brand new travel per diems just in the nick of time now that none of us is traveling.
>> [laughs] Exactly. Nobody's going anywhere but here we are. Just keep in mind that just because we said something was allowable doesn't mean it's affordable for you and it doesn't mean that it's funded. You still have to work within your budget. You still have to know what your costs are and it does have to be necessary for the accomplishment of the purpose of the grant, so unless you can tie back to why it is then that would be something that could be questioned. How about an assignment for tomorrow? How about review your financial policies and procedures and you can do it next to our samples and identify any areas where there's something that you want to improve. Print off a copy of ours and highlight anything that's not in yours. That's one method of doing that, but do some kind of an analysis of [inaudible] Tim, I think we're ready for the questions.
>> Great. So am I, so is the audience. We'll spend these last 11 minutes going through some questions and then you may have noticed that we're actually going to start each subsequent day with a check-in review. If we don't get to all these questions, we probably won't finish all of them right now. We'll start off with them in the morning. Along those same lines, if you all continue to submit questions in the next few minutes or if you think of questions this evening or tonight, just email it to me and I'll include them in that review of day one that we're going to do it tomorrow morning.
Let's dive in now. Carolyn is wondering, just going back right to the beginning of the afternoon session, she said, could you please expand on a health related entity, for example, when we're doing community transition with a care facility or a hospital, does that classify as HIPAA or would that be covered under HIPAA, I guess, Paula?
>> Yes. Anything that you do that's health-related may include HIPAA protected information. In that case you're not generating any HIPAA information but you have a responsibility to keep it as confidential when they share it with you. Usually they'll tell you that. Usually there's privacy information that they share, you have to have a signed release of information in order for them to review it and so forth. Typically it would be clear to you that it's HIPAA related information, confidential information.
Often we don't get involved in that part. You don't see any medical information regarding a person, but sometimes I can see a transition from an institution especially, sometimes you might. That would be where it would most commonly happen, is either discharged from rehab or discharge from some type of institutional medical setting.
>> Okay, great. Thank you. Cheryl's wondering if a tool like the [inaudible] software would work well for maintaining confidentiality and documentation for reporting. I've not used [inaudible] so I'm not sure. Paula, do you have any insight on that?
>> All of the databases as far as we're aware do have a place where you can keep notes about your consumer meeting and whatever it is that they've done or mentioned to you or goals they've met and so forth. That would all be confidential information. That's certainly part of their confidential file as a consumer of the organization. You should treat it as such meaning there should be limited access and only the people who need to know.
Typically though that's built into those programs pretty well. Only the person who enters the information can review unless they're an admin on the account, those kinds of things. But do look at it. I'm not familiar with them specifically but I know that most cases they'll be glad to tell you what those protections are and why their software is good for doing that confidentiality piece.
>> Great. Speaking of vendors, John, I'm going to come to you for this one. Patricia is wondering if a [inaudible] is to put out an RFP for help with protections against cyber-security or ransomware. How do you know who to trust to hire? What would you recommend in terms of investigating, going through the RFPs, referrals and references, those sorts of things?
>> It really is a little bit of a process here and it makes it hard to answer that question completely, but what you want to be very clear on is exactly what services are they providing. They should have an outline of their services that will be distilled into a contract ultimately. Certainly all of the things we talked about today should be included in there. There would be software updates, software patches, advising the organization about difficulties, just normal updates. Deleting access when somebody leaves and bringing somebody else on board. Hopefully these days it would also include access for people who are working remotely, in other words that they would be monitored as well.
I don't know that that's happening to any great extent but if somebody was just looking at it right now, I think remote workers would have to be part of that. It's really looking at that array of services and actually I may be able to do a little better job of that tomorrow because I believe I've got a list of things that should be should be part of your IT security and you would expect an outside organization to do.
>> Okay, great. Thanks, John. All right, [inaudible] was wondering if we have a list of what's allowed and unallowed for federal and state funds. There's no simple list. I think we've heard that today and we're going through a lot of the resources that you all need to make those determinations because it can be complex and you do need to read those contracts and be aware of the regs and that's a lot of what we're reviewing. I'm going to move past that one in the interest of time, unless you have anything to add, Paula.
>> It's that that section that we cited at the beginning of this lists them. It doesn't help you to always know though whether--
>> Yes. Myra is wondering, for CARES Act funding, I saw another center was requiring medical documentation for someone to get CARES Act money. I'm not sure what they mean for someone to get CARES Act money. Is that okay to do?
>> What ACL has told us is the same eligibility applies to the CARES Act as applies to the Title VII funding. So it would be a person with a significant disability. They do not have to prove that. That is a underpinning of something we feel is very important.
>> Got you.
>> If I were advising that center I would say you do not require medical proof of a disability, you take the person's word for it. If you're afraid that the whole community is going to come in for those free iPads that you're handing out or whatever it is that you're concerned about, just remember to use the word significant disability, because that does make people stop a second and think, "Am I part of that community?" That's what we want to know. Are they part of the disability community? Not maybe the fact that I need glasses will help me pass. If that's what you're worried about, then throw the word significant in there, it's right out of the law, it will at least cause people to stop and think, "Am I eligible or aren't I?" If that's all you want-- I don't know what the medical thing would be. We don't do that [inaudible]
>> Right. Okay. Let's see. Tammy is wondering if federal funding was used to purchase equipment for a community partner that serves people with significant disabilities along with the general public, would there need to be a matching contribution, presumably to cover those expenses related to the general public?
>> I don't think the matching contribution would be the solution. The issue here is allowability and proper allocation of the cost. Is the cost really fully deductible? Not that we need a contribution to offset part of it, but how much of it is deductible. There we'd have to look at the specific facts and circumstances to determine what portion would be allowable.
>> [inaudible]
>> Yes. There is something in the regulations though that says that if it's no longer used by the original parties that it still can continue to be used by the entity, if I remember right.
>> Okay, thanks. Anaya wants to revisit the award dates. We mentioned earlier that the contracts are actually September 30 through September 29. Anaya says their award letters actually say September 30th. Any insight into that Paula?
>> Well, follow what your award letter says but don't try to budge it a day or two either way because that is your award period. So whatever they told you, maybe some of them are not the same, but the ones I looked at are the 30th to the 29th.
>> Yes, we noticed that with ACL with [inaudible] grant as well. Just carefully check that folks and be sure you know what it says. Due to the pandemic our board was unable to meet this year to develop a new three-year plan so they voted to extend the current one for one year. Is that acceptable?
>> Yes. Is that what you want? Probably you can have some conversations like this without having to be in the same room at the same time.
>> Yes. Is it okay to [inaudible] with documentation included initially and bank statements after you've reviewed them? Is that acceptable?
>> I'm sorry. One more time, Tim?
>> Would it be acceptable to initial bank statements after you've reviewed them as documentation that you've gone-- [crosstalk]
>> Sure, that is the kind of thing we would expect. You might write on there reviewed but the initials indicate that you did this. The date might be a good idea as well.
>> Okay, great. Paul is wondering, since rent is necessary for the center to operate benefits or cost objectives, does it need to be allocated in proportion among all funding sources and grants? In other words, are we not allowed to just put 100% of the rent to Part C money?
>> The short answer is no you can't, you have to allocate it, but the long answer is that's main topic tomorrow. How to do direct and indirect costs. Right, John?
>> Yes. [crosstalk] The way you asked that question Tim, it sounds like you're talking about a classic indirect cost. In other words, something that benefits all of your programs, fits the definition of indirect and that's quite important as we'll talk tomorrow.
>> Great. All right. Let me sneak a few of these in in 30 seconds. Two very related questions. One was what are some types of entertainment that are not allowable? I know you guys had an actual slide on that. I don't know if this came in before or after that.
>> Typically food is part of that, sometimes entertainment like a band, speaker, whatever. Unless you had a program purpose for it, it would be questioned as an entertainment expense. Does that sound about right, John?
>> Yes.
>> What types of advertising are allowable?
>> Advertising for employees, probably the very best example.
>> Good example. All right. I'm going to sneak in this last question and we'll be through these ones that have come in this afternoon. Michael's asking if you purchase a piece of equipment for $5,000 and capitalize it, do you draw down the $5,000 and then not request drawdowns for the depreciation expense in the time period after you've purchased it?
>> Well, again, it needs to be in your budget and your capitalization policy has to be $5,000, but the federal government is already at 5,000. Yes, if that's your capitalization policy and if it's in your budget, absolutely, write it off right away and don't charge for the depreciation.
>> Great. John and Paula, this is a lot of content. You guys have done a great job this afternoon. Thanks for walking us through this. I borrowed one additional minute but I think it was worth it to get through those questions. We'll start fresh in the morning. I want to thank all of you again for sticking with us this afternoon. Great questions. Again, we are going to start with that review of day one tomorrow morning. We'll revisit a couple of things but really that's your opportunity for Q&A for those things that pop up overnight.
Now I'll give the question instructions in the morning if you want to ask questions live, but like I mentioned, at the beginning of the Q&A break, don't hesitate to send questions if you have them, if they come up in a few minutes as you process some of this stuff. So tim@ncil.org, that's Tim@nicl.org. If you have questions and I'll include those in the queue as we go through them tomorrow. With that, we'll go ahead and conclude for this evening. Thanks so much for joining us for day one, and we will see you all back tomorrow at the same link for day two of financial management. Remember you'll join through the training website and if you have any questions, just let me know and we'll see you then. Thanks everyone.
>> Bye, everybody.