As of June 3, 2025, Moss Adams LLP has merged with Baker Tilly.
FINAL REPORT
City of Cupertino
GRANTS MANAGEMENT INTERNAL CONTROLS REVIEW
July 20, 2026
Baker Tilly Advisory Group, LP
999 Third Avenue, Suite 2800
Seattle, WA 98104
(206) 302-6500
Grants Management Internal Controls Review Report
FOR INTERNAL USE OF THE CITY OF CUPERTINO ONLY
Table of Contents
I. Executive Summary 1
II. Scope and Methodology 4
III. Internal Controls Review 6
Baker Tilly Advisory Group, LP and Baker Tilly US, LLP, trading as Baker Tilly, operate under an alternative practice structure and are members of the global network of Baker Tilly International Ltd., the members of which are separate and independent legal entities. Baker Tilly US, LLP is a licensed CPA firm that provides assurance services to its clients. Baker Tilly Advisory Group, LP and its subsidiary entities provide tax and consulting services to their clients and are not licensed CPA firms.
Grants Management Internal Controls Review Report | 1
FOR INTERNAL USE OF THE CITY OF CUPERTINO ONLY
I. Executive Summary
The City of Cupertino (the City) contracted Baker Tilly to assess the internal controls over the City’s grants management activities for compliance with policies and procedures and best practices. This included reviewing the application, review, administration, and reporting processes as well as assessing the overall adequacy of the grants management function. The internal controls review took place between June and October 2025.
As of June 30, 2024, the City's operating grants and contributions constituted approximately 25% of its total program revenues, or $8,350,734 out of $34,401,318. Grants management typically encompasses processes such as grant application and award administration, compliance monitoring, expenditure tracking, documentation and recordkeeping, and financial reporting. These processes are essential to ensure that grant funds are used in accordance with grantor requirements and applicable regulations. Effective internal controls over grants management are critical for safeguarding grant resources, maintaining accurate financial records, and supporting the integrity of the City’ s Annual Comprehensive Financial Report (ACFR). Implementing comprehensive controls helps mitigate risks of misstatement, noncompliance, and misappropriation of funds, ultimately enhancing the City’s financial accountability and transparency to stakeholders.
The City currently employs a primarily decentralized approach to grants management, where individual programs and departments are responsible for the end-to-end management of their respective grants. This includes administering grant application and award, monitoring compliance, tracking and approving expenditures, preparing and submitting required reports, and maintaining documentation in accordance with grantor requirements and applicable regulations. The Finance Department provides centralized financial support by tracking grant revenues and budgets within the Enterprise Resource Planning (ERP) system and producing budget-to-actual reports to assist departments in financial oversight. While many departments maintain organized electronic folders and utilize spreadsheets for grant tracking, these practices vary and are not fully standardized or integrated across the City.
Recognizing opportunities to strengthen internal controls and improve consistency, the City is planning to hire a Grants Management Analyst to formalize and centralize key aspects of the grants management function. This role is expected to support standardized grant opportunity identification and monitoring, enhance documentation and recordkeeping practices, enforc e segregation of duties, and coordinate training programs.
The review of internal controls was completed in accordance with Standards for Consulting Services established by the American Institute of Certified Public Accountants (AICPA). As such, this work was not an audit of internal controls that resulted in a formal opinion or other form of assurance.
Specific areas where controls were reviewed included:
• Grant Application and Award Approval
• Compliance Monitoring and Reporting
• Expenditure Authorization and Tracking
• Documentation and Recordkeeping
Grants Management Internal Controls Review Report | 2
FOR INTERNAL USE OF THE CITY OF CUPERTINO ONLY
• Financial Reporting and Reconciliation
• Overall Grants Management Control Environment
Specific departments where controls were reviewed included the Finance, Public Works, and Housing Division departments. These departments were selected for review due to their critical roles in the City’s grants management environment. Finance is responsible for supporting accounting, financial reporting, and budget monitoring for all City grants, providing centralized financial oversight. Public Works and the Housing Division were selected because they receive and administer a substantial portion of the City’s overall grant funding, making their grant management practices particularly impactful on the City’s financial accountability and compliance.
The City appeared to have internal controls developed for many grants management functions and was in the process of implementing additional internal controls in this area. Per interviews, the planned hiring of the Grants Management Analyst is to help formalize the grants management function and to assist in implementing these additional internal controls. Based on the review performed, the following are examples of commendable activities that appeared to have well-designed internal controls:
• The City requires City Manager approval for grant applications, supporting executive oversight. • Departments seemed to maintain organized electronic folders for grant documentation, aiding record retention and audit readiness.
• Finance tracks grant revenues and budgets within the ERP system, facilitating centralized financial management.
• Project managers are generally responsible for monitoring grant expenditures and compliance, providing operational accountability.
• A quarterly grants tracking spreadsheet is maintained and reviewed to monitor statuses and deadlines, supporting timely reporting.
• Segregation of duties appeared to be practiced in invoice review and approval, reducing risk of errors or unauthorized transactions.
• Recruitment of a Grants Management Analyst appeared aimed at centralizing oversight and enhancing internal controls.
• The City’s grant reimbursement packets undergo multiple levels of review before submission, supporting accuracy.
• Training resources from federal agencies appeared to be utilized to educate staff on grant compliance requirements.
• Departments appeared to prepare handoff lists to mitigate risks associated with staff turnover.
Similar to many other cities, there is an opportunity to strengthen controls, policies and procedures, and documentation. While our review identified gaps in internal controls of varying degrees across the departments reviewed, it is important to acknowledge that the City appeared to have internal controls developed for many functions. However, enhancing the documentation of these controls will strengthen this foundation and promote greater consistency and effectiveness in operations.
Suggested priorities to address over the next six to 18 months include, but are not limited to:
Grants Management Internal Controls Review Report | 3
FOR INTERNAL USE OF THE CITY OF CUPERTINO ONLY
• Develop and Implement Standardized Grants Management Policies and Procedures and Continuity Plans
○ Establish comprehensive, documented grants management policies and procedures that apply to all departments, including those with limited grant activity, to ensure consistency and reduce reliance on informal practices.
○ All departments should develop continuity plans and implement cross-training and handoff lists to maintain grant management activities during staff absences or transitions. • Centralize Grant Opportunity Identification and Monitoring ○ Centralize the process for identifying, tracking, and communicating grant opportunities, using a consolidated system to ensure departments are aligned with City priorities and deadlines. • Enhance Grant Tracking and Documentation Practices:
○ Departments should maintain dedicated tracking spreadsheets and complete electronic grant files for each active grant, and the City should conduct regular oversight to verify that documentation is accurate and complete.
• Standardize and Enforce Segregation of Duties Across Departments:
○ Departments should clearly define and separate responsibilities for key grant management activities, and where staffing is limited, use compensating controls such as supervisory review or independent reconciliation.
• Standardize Grant Documentation and Recordkeeping Policies:
○ Implement formal policies for organizing, retaining, and securing grant documents, and use a centralized electronic folder structure to improve accessibility and audit readiness. • Implement Structured Grant Management Training Programs:
○ Provide mandatory, tailored training for all staff involved in grant management, covering internal processes, compliance requirements, and best practices, with periodic refresher courses.
• Formalize Grant Application and Approval Workflows:
○ Standardize the workflow for grant application preparation and approval, ensuring that required executive authorizations are consistently documented and retained. • Establish Consistent Internal Review and Approval Processes for Grant Reporting:
○ All grant reports and reimbursement requests should be subject to formal internal review and approval, with designated reviewers and documentation of the approval process. • Strengthen Subrecipient Monitoring and Documentation:
○ Distribute monitoring responsibilities for subrecipients, maintain complete documentation of contracts and payments, and formalize Council approval and payment tracking procedures.
Grants Management Internal Controls Review Report | 4
FOR INTERNAL USE OF THE CITY OF CUPERTINO ONLY
II. Scope and Methodology
The scope of our grants management internal controls review included an evaluation of the City’s key grants management internal controls, to determine the general adequacy of internal controls and identify areas warranting more in-depth review in the future. Our review included the following functional areas:
• Grant Application and Award Approval
• Compliance Monitoring and Reporting
• Expenditure Authorization and Tracking
• Documentation and Recordkeeping
• Financial Reporting and Reconciliation
• Overall Grants Management Control Environment
For each functional area assessed, we conducted a review of key controls which included:
• Identifying control objectives in specific areas and controls that would satisfy each objective • Reviewing policies and procedures
• Examining relevant documentation in support of select key controls • Performing control walkthroughs to observe the design of key controls and understand workflow processes
• Obtaining an understanding of the characteristics of each relevant control activity, including who performs it, how often it is designed to operate, whether it is designed to mitigate fraud, whether it is a manual or programmed (automated) control, and whether it is a preventive, detective, or corrective control
• Assessing whether the controls in place would prevent or detect errors • Providing recommendations on key controls that need to be implemented or changed The work performed included interviews with employees involved in managing functions and processing key transactions in the following departments:
• Finance
• Public Works
• Housing Division
In addition to the interviews conducted, the following procedures performed to assess compliance with controls and policies related to grants management:
• A sample of nine grants received by the City and five subrecipient grants awarded by the City, were assessed for adherence to select applicable control and policy requirements • The sample of nine grants received was evaluated for proper application procedures, documentation, expenditure tracking, and compliance with select established grant management controls and policies
• The sample of five subrecipient grants was assessed for proper authorization and monitoring
Grants Management Internal Controls Review Report | 5
FOR INTERNAL USE OF THE CITY OF CUPERTINO ONLY
In support of the internal controls review, the matrix in Section III provides results and includes:
• Control objectives
• Control issues
• Corresponding recommendations
• Likelihood of occurrence
• Impact of occurrence
“Likelihood of occurrence” is defined as the probability of a negative event occurring. “Impact of occurrence” is defined as the level of significance if a negative event occurs. Risk levels of low, moderate, or high were used to rate the likelihood and impact of occurrence for each control issue.
Beyond the controls noted within this report as an issue, additional controls were reviewed without exception. It should be noted that many controls were reviewed multiple times in relevant, separate department reviews, but not all controls or departments were reviewed. The departments selected provide a broad understanding of the City’s grants management control environment. Key controls with exception conditions are reported in this document.
Grants Management Internal Controls Review Report | 6
FOR INTERNAL USE OF THE CITY OF CUPERTINO ONLY
III. Internal Controls Review
NO. CONTROL OBJECTIVE CONTROL ISSUE RECOMMENDATION
OCCURRENCE
LIKELIHOOD
IMPACT OF
OCCURRENCE
Overall Grants Management Controls
1 Grant management
processes are formalized
and consistent across
departments, regardless of
grant volume or diversity in
purpose, funding source, or
dollar amount. Whether a
department manages a
large federal infrastructure
grant, a small community
funding grant, or any other
type of grant with varying
requirements and funding
levels, it follows
standardized policies and
procedures to ensure
effective oversight,
compliance, and
accountability.
The City currently lacks formal,
City-wide grants management
policies and procedures (P&Ps).
As a result, departments with low
grant volume or specialized
grants, such as Planning and
Information Technology (IT), rely
heavily on informal practices and
individual knowledge. This
increases continuity risks during
staff absences or transitions.
While larger departments may
have more established practices,
the absence of City-wide P&Ps
disproportionately affects smaller
departments, highlighting the
need for both City-wide policies
and tailored departmental
procedures to ensure consistent
and resilient grants
management.
The City should develop and implement
standardized, City-wide grant management
policies and procedures to provide a
consistent framework for all departments.
While some departments currently manage
grants more frequently, their department-
specific procedures are not formally
documented and should be formalized to
ensure consistency and accountability.
Additionally, departments with limited grant
activity, such as Planning and IT, should
create tailored procedures that clearly
define roles, responsibilities, and specific
processes for grant application, monitoring,
and reporting to ensure compliance with
City-wide policies and reduce reliance on
individual knowledge.
All departments should also establish
formal grant management continuity plans
that include comprehensive documentation,
cross-training, and periodic knowledge
transfer sessions. This approach will help
ensure seamless continuation of grant
management activities during staff
absences or transitions, reducing
operational risks and enhancing
organizational resilience.
High High
2 Grants management
functions, including grant
opportunity identification
Grants management functions
are decentralized, with grant
opportunity identification relying
The City should centralize certain grants
management functions, potentially under
the planned Grants Management Analyst
High High
Grants Management Internal Controls Review Report | 7
FOR INTERNAL USE OF THE CITY OF CUPERTINO ONLY
NO. CONTROL OBJECTIVE CONTROL ISSUE RECOMMENDATION
OCCURRENCE
LIKELIHOOD
IMPACT OF
OCCURRENCE
and monitoring, are
centralized to improve
oversight, coordination,
and control and alignment
with City priorities.
on informal networks and
disparate departmental
processes. This increases the
risk of inconsistent controls,
missed funding opportunities,
and lack of strategic alignment
across departments.
position. This centralized function should
include formalized grant opportunity
identification and monitoring through a
consolidated database or tracking system
that captures available grants, deadlines,
eligibility criteria, and application status.
Regular communication and updates
should be provided to all departments to
ensure alignment with City priorities and
reduce the risk of missed opportunities.
This communication and decision-making
process should be documented to ensure
grant applications and acceptances align
with City priorities and Council direction.
Centralization will improve consistency in
policies and procedures, enhance
oversight, and support strategic resource
allocation.
3 All grants received,
including report due dates,
period of availability and
budget-to-actual financial
data, are consistently
tracked throughout their
lifecycle. Comprehensive
grant reporting packets are
maintained electronically,
in a centralized repository,
and contain all grant-
related documentation,
such as applications,
contracts, invoices, and
approvals.
The City does not track all key
grant information in a consistent
manner and does not deploy a
centralized repository to maintain
complete grant reporting packets
resulting in missing grant
documentation.
Our testing found that four of
nine grants received were not
supported by a dedicated
tracking spreadsheet. In
addition, all nine grant reporting
packets lacked complete
documentation. Missing items
included things such as grant
applications, executed contracts,
and documented approvals.
The City should require all departments to
maintain dedicated, up-to-date tracking
spreadsheets for each active grant that
consistently capture key grant information,
such as report due dates, period of
availability, and budget-to-actual financial
data. In addition, departments should
include required supporting documents
such as invoices and signed agreements,
in their grant reporting packets. All grant
tracking spreadsheets and supporting
documentation should be stored
electronically and in a centralized
repository to ensure consistency,
accessibility, and audit readiness across
the organization.
To ensure consistent adherence, the City
should establish regular oversight
Moderate Moderate
Grants Management Internal Controls Review Report | 8
FOR INTERNAL USE OF THE CITY OF CUPERTINO ONLY
NO. CONTROL OBJECTIVE CONTROL ISSUE RECOMMENDATION
OCCURRENCE
LIKELIHOOD
IMPACT OF
OCCURRENCE
mechanisms, such as periodic audits or
reviews, to verify that all grants are actively
tracked, and that required documentation is
properly retained across all departments.
This approach will address root causes by
promoting accountability, reducing risks of
incomplete or inaccurate reporting, and
supporting compliance with grantor
requirements.
4 Segregation of duties is
established and
consistently applied in
grant management
activities.
Segregation of duties appears to
vary by department and grant
type; smaller grants or
community funding appear to
often be managed entirely by
one individual, increasing the
risk of errors or misappropriation.
The City should require that all
departments that manage grants
adequately segregate duties. Multiple
individuals should participate in critical
grant management activities such as
application approval, expenditure
authorization, and reporting. In cases
where staffing is limited, compensating
controls such as periodic supervisory
reviews or independent reconciliations,
should be implemented.
All roles and responsibilities should be
clearly defined in the City-wide grants
management policies and procedures to
ensure that no one individual is responsible
for incompatible duties.
High Moderate
5 Grant tracking and
monitoring systems are
integrated, comprehensive,
and efficient.
Departments primarily use
spreadsheets or electronic
folders for grant tracking, lacking
integration with financial systems
and detailed compliance
checkpoints.
An assessment of current grant tracking
practices and available technology
solutions should be conducted to identify
opportunities for improved integration and
efficiency. Implementing a centralized grant
management system, or enhancing existing
ERP functionalities, can provide significant
benefits, such as enabling real-time
tracking of grant applications, budgets,
expenditures, compliance requirements,
High Moderate
Grants Management Internal Controls Review Report | 9
FOR INTERNAL USE OF THE CITY OF CUPERTINO ONLY
NO. CONTROL OBJECTIVE CONTROL ISSUE RECOMMENDATION
OCCURRENCE
LIKELIHOOD
IMPACT OF
OCCURRENCE
and reporting deadlines. System integration
can also improve data accuracy, reduce
manual entry errors, and support
comprehensive monitoring and reporting of
grant performance.
If implementing a new system or enhancing
ERP functionalities is not feasible at this
time, the City should establish a centralized
electronic repository for grant files and
tracking spreadsheets, which may help
address finding number six below. This
repository should be accessible to all
relevant staff and used to consistently
maintain tracking spreadsheets and to
store key grant documentation, including
applications and related approvals,
budgets, expenditure support, grant reports
and supporting documentation, and other
support to demonstrate compliance with
grant requirements. Centralizing grant
documentation in this manner will improve
data accuracy, streamline oversight,
support compliance, and enhance
monitoring of grant performance.
6 Grant recordkeeping is
standardized, accessible,
and secure.
Based on interviews, most
departments appear to have
processes in place to store
documentation electronically, but
there is a lack of standardized
organization and retention
policies across departments,
potentially posing challenges
during audits or staff transitions.
Currently, based on interviews,
there is no centralized City-wide
file location or standardized file
Formal policies governing the organization,
retention, and security of grant-related
documentation are essential. These
policies should specify document types to
be retained, retention periods in
compliance with legal and grantor
requirements, and procedures for secure
storage and disposal.
Implementing a centralized repository for
electronic document management with
standardized folder structures, version
control, and role-based access permissions
Moderate Moderate
Grants Management Internal Controls Review Report | 10
FOR INTERNAL USE OF THE CITY OF CUPERTINO ONLY
NO. CONTROL OBJECTIVE CONTROL ISSUE RECOMMENDATION
OCCURRENCE
LIKELIHOOD
IMPACT OF
OCCURRENCE
structure for retaining grant
documents; instead, each
department is responsible for
establishing and maintaining its
own documentation on individual
drives.
will enhance accessibility and protect
sensitive information. Regular audits of
documentation practices should be
conducted to ensure compliance and audit
readiness.
7 Staff receive structured
training on grant
management and
compliance requirements.
Grant-related training appears to
be minimal and mostly self-
directed or external; limited
internal training may lead to
inconsistent knowledge, reliance
on informal learning, and grant
noncompliance.
A comprehensive internal training
curriculum focused on the City’s specific
grant management processes, appropriate
uses of grant funds, compliance
obligations, and best practices should be
designed and rolled out.
Training should be mandatory for all staff
involved in grant activities and cover topics
such as federal and state grant regulations,
internal control requirements,
documentation standards, and use of grant
management systems. Incorporating
refresher courses and updates on
regulatory changes will further enhance
staff competency, reduce reliance on
informal learning, and promote consistent
policy application across departments. This
will improve staff competency, consistency,
and reduce compliance risks.
Moderate Moderate
8 Grant application and
approval processes are
formalized and
documented.
Application approvals require
City Manager authorization but
appear to lack formal workflows
and standardized
documentation, risking
inconsistencies and
accountability gaps. Of the nine
grants tested, four did not have
documentation supporting that
the City Manager approved the
Formalized workflows for grant application
preparation, approval, and submission
should be developed, clearly delineating
required review steps, responsible parties,
and approval thresholds.
City Manager authorization and other
executive approvals must be consistently
documented in writing and retained in the
grant file. Utilizing standardized forms or
electronic workflow tools will facilitate
Moderate Low
Grants Management Internal Controls Review Report | 11
FOR INTERNAL USE OF THE CITY OF CUPERTINO ONLY
NO. CONTROL OBJECTIVE CONTROL ISSUE RECOMMENDATION
OCCURRENCE
LIKELIHOOD
IMPACT OF
OCCURRENCE
related grant application. tracking and audit trails. These measures will improve accountability, reduce
inconsistencies, and support effective
governance over grant pursuits.
9 Grant reporting undergoes
consistent internal review
and approval prior to
submission.
Review processes vary widely;
some departments have formal
departmental reviews, others
submit reports directly with
minimal internal review,
increasing risk of errors or
noncompliance.
Standardized procedures requiring all grant
reports, reimbursement requests, and
related submissions to undergo formal
internal review and approval should be
implemented. This process must include
verification of compliance with grant terms,
accuracy of financial data, and
completeness of supporting
documentation.
Designated reviewers and approvers with
appropriate expertise and authority should
be assigned, and documentation of reviews
and approvals maintained. Consistent
application of these procedures will reduce
errors and enhance compliance.
Moderate Moderate
Management Response to Overall Grants Management Control Issues and Recommendations Since the time of this review, the City has hired a Management Analyst and has implemented:
• An updated Citywide Grants Policy governing grant application and approval authority and overall grants guidance • Formalized grant opportunity identification, monitoring, review and communication with departmental staff
The City is currently developing with plans of release in 2026:
• Standardized internal grants management policies and procedures to clarify roles and responsibilities across the grant lifecycle including application, approvals, budgeting, monitoring, reporting and closeout • Staff training to ensure comprehensive understanding of internal grants management procedures and support with accurate recordkeeping. • Processes for documentation of application approvals
The state and federal grants landscape continue to evolve and the City is committed to retaining active awareness, adapting as appropriate and ensuring the internal controls for grants fit the City’s needs.
Grants Management Internal Controls Review Report | 12
FOR INTERNAL USE OF THE CITY OF CUPERTINO ONLY
NO. CONTROL OBJECTIVE CONTROL ISSUE RECOMMENDATION
OCCURRENCE
LIKELIHOOD
IMPACT OF
OCCURRENCE
Public Works
1 Grant applications require
documented review and
approval by the
Transportation Director and
City Manager prior to
submission.
Two of five tested grant
applications lacked evidence of
City Manager approval, leading
to potential non-compliance with
City policies and unauthorized
commitments of City resources.
See Control Issue #8 in the Overall Grants
Management Controls section.
High Moderate
Management Response to Public Works Control Issues and Recommendations Since the preparation of this report, the City has hired a Grants Analyst, enhancing staff's capacity to effectively manage grant processes and ensure compliance with City policies.
Housing/Community Development Block Grant
1 Subrecipient contracts and
reports are managed with
complete documentation
and monitoring.
Supporting documentation was
not provided to demonstrate that
ongoing monitoring of
subrecipient expenditures and
activity was occurring. There
appeared to be heavy reliance
on the Senior Housing
Coordinator to monitor and
approve all subrecipient expense
reports. While this staff member
demonstrated strong
competence, dependence on a
single individual creates potential
risks related to continuity and
oversight.
NOTE: After testing was
complete, on April 20, 2026, we
were provided with expense
reports for our selected
subrecipients, however all
The City should conduct a thorough review
of subrecipient monitoring requirements
from funding agencies and compare to their
current practices, with a focus on
distributing monitoring responsibilities to
mitigate risks associated with reliance on
one individual.
Implementing robust document retention
and management processes is key to
ensuring that all subrecipient contracts,
invoices, reports, and monitoring
documentation are maintained in an
accessible, organized, and centralized
manner.
These steps will strengthen compliance,
enhance oversight, and improve audit
readiness while supporting operational
resilience.
Moderate Low
Grants Management Internal Controls Review Report | 13
FOR INTERNAL USE OF THE CITY OF CUPERTINO ONLY
NO. CONTROL OBJECTIVE CONTROL ISSUE RECOMMENDATION
OCCURRENCE
LIKELIHOOD
IMPACT OF
OCCURRENCE
approvals were dated in 2026,
after our testing period.
2 Council approves grant
awards to subrecipients,
and payments are tracked
and monitored
appropriately.
At the time of our review,
documentation supporting
Council approval of subrecipient
awards and related
invoicing/payment tracking was
incomplete or unavailable for the
selected subrecipients.
NOTE: After testing was
complete, on April 20, 2026, we
received documentation that
showed council approval of
subrecipient awards effective
9/11/2025.
The City should formalize and document
the process for Council approval of
subrecipient awards via meeting minutes
and ensure that invoicing and payment
tracking is maintained in a centralized,
accessible system.
Regular reconciliations and monitoring of
payments should be performed to ensure
compliance with contract terms and grant
requirements.
Moderate Low
Management Response to Housing/Community Development Block Grant Control Issues and Recommendations The identified controls were in place and operating at the time of the audit. The Senior Housing Coordinator is responsible for the initial review and approval of invoices, while the Finance Division performs the secondary review and final approval. Accordingly, invoices that have completed the full approval process are maintained by the Finance Division rather than by the Housing division/Community Development Department. As a result, the initial audit testing, which was conducted using records maintained at the Senior Housing Coordinator level, did not reflect the complete approval process or the full extent of the established internal controls.