The Opioid Abatement Authority’s finance committee on the virtual meeting reviewed tentative findings from a performance audit by the Auditor of Public Accounts and outlined immediate steps to address the report.Adam Rosatelli, the OAA’s director of finance, told the committee the APA identified that “many of the OAA's financial and administrative policies and procedures haven't been formally written out and memorialized as actual approved policies and procedures.” Rosatelli said the APA also noted the agency had not yet adopted an IT security standard and governance program.

Rosatelli said OAA staff have already responded to the APA's management recommendations and moved quickly to close gaps. “We immediately retained strategic technology solutions to develop and implement an appropriate IT security standard and associated governance policies,” he said, with a targeted completion date stated in the presentation. He added the OAA is contracting with an audit consulting firm in a phased engagement to compile existing policies and procedures, document requirements for external customers (cities and counties), and perform ongoing periodic reviews to sustain compliance.

Committee members and staff framed the audit letters as preliminary correspondence, not a final report. A staff speaker summarized the agency’s position: the audit “is not that we're not doing any of these things” but that the agency “needs to document our processes,” reflecting the OAA’s status as a new agency that has rapidly disbursed grants.

Separately, Rosatelli outlined a proposed purchasing and procurement policy that clarifies delegated authority for the executive director to make administrative purchases while preserving the OAA’s statutory exemption from the Virginia Public Procurement Act for its grant-making mission. He emphasized that the proposed policy would not govern grant awards to cities and counties and that larger procurements handled through the OAA’s third-party administrative provider will comply with applicable VPPA-related rules.

The committee did not vote on these staff-proposed compliance and procurement measures at the finance meeting; staff said the procurement policy would go before the full board in November. The finance committee discussion included questions about how OAA will ensure grant recipients comply with external audit requirements; Rosatelli said the OAA will incorporate Auditor of Public Accounts specifications and provide internal guidance for subrecipients.

What’s next: Staff said the IT standard work is underway and the audit consulting contract will move forward in phases to produce a comprehensive policies-and-procedures manual and ongoing compliance reviews.