OA staff outline compliance, procurement policies and pilot compliance reviews after APA audit

The finance committee heard a staff update on audit responses and proposed administrative and grants compliance policies designed to address recommendations from the Auditor of Public Accounts.

Dr. Adam Rosatelli said the APA’s performance audit of the OA’s financial and administrative processes and IT security prompted staff to document all processes in a comprehensive manual. "Following the audit recommendations, OA staff immediately sought to address them and in doing so retained Strategic Technology Solutions and RSM to develop and implement appropriate IT security standards and to assist with finance and administrative findings," he said.

As part of that effort the OA proposed a purchasing policy to be included in the manual. Rosatelli noted that the Code of Virginia exempts the OA from the procurement provisions of the Virginia Public Procurement Act, so the proposed policy aims to preserve statutory autonomy while creating documented, prudent purchasing procedures. The policy delegates purchasing authority for administrative operations to the executive director and specifies that larger-scale procurements conducted through the OA’s third-party administrative support provider must comply with applicable laws.

Tony (OA staff) described compliance-monitoring work and a risk‑assessment tool the OA will use to prioritize which grants need more in-depth review. "We've completed a risk assessment tool that allows us to assess how high of a level of risk each one of our grants might be," Tony said. He said the OA plans to contract a firm for a pilot operational compliance review of higher‑risk recipients (described as a compliance review rather than a full audit) to ensure funds are used appropriately.

Staff said the manuals, policies and the operational review approach are in final stages and will be presented to the board for consideration and potential adoption. The committee offered praise to staff for fiscal management and compliance preparations and had no objection to moving the policies forward for later board review.

Next steps: staff expect to finalize the comprehensive policies and present them to the OA board for formal consideration; the pilot compliance review vendor selection will be scoped and brought back to the board for approval.