To: All Executive Directors; All Board Chairs

From: Ronald S. Flagg, President

Date: November 11, 2024

This Program Letter describes the most common compliance issues that the Legal Services Corporation’s (“LSC”) Office of Compliance and Enforcement (“OCE”) has observed during compliance oversight visits in the past 12 months, or which have otherwise come to LSC Management’s attention. This Program Letter highlights these issues so you and your staff can avoid or mitigate compliance risks. More extensive guidance, including examples of how LSC grantee have implemented the compliance requirements listed below, can be found in OCE Final Reports from visits to LSC-funded legal aid programs. Final Reports can be found online under Assessment Visit Reports by visiting this link: https://www.lsc.gov/i-am-grantee/assessment- visit-reports.

I encourage you to share this guidance, along with the guidance LSC has provided in previous years, with your staff.

Fiscal Management and Internal Controls

45 C.F.R. Part 1630 – Cost Allocation. See also Financial Guide, § 3.7.1

Pursuant to 45 C.F.R. § 1630.5(c)(3), "[r]ecipients must maintain accounting systems sufficient to demonstrate the proper allocation of costs to each of their funding sources." Further, pursuant to the LSC Financial Guide, § 3.7, a recipient “must adopt written policies and procedures to guide its staff” in cost allocation procedures. Consistent with the principles of the LSC Financial Guide, § 3.7.1, such policies “must address the following: [...] [d]irect cost methodology(ies)[,] [i]ndirect cost allocation methodology(ies), [and] [d]ocumentation requirements to support the allocation.”1

Recipients are reminded there must be sufficient documentation for LSC and other third- party viewers to follow the cost allocation process from start to finish. Additionally, an allocation base must be cost-driven and therefore, measure benefits provided to a cost objective. Recipients must implement and document a cost allocation methodology that utilizes a cost-driven allocation base for indirect personnel costs. (e.g., program, contract).

LSC Financial Guide, § 2.3 – Record Retention

Recipients are reminded that, pursuant to LSC Financial Guide, § 2.3, they are required to retain all financial records, supporting documents, statistical records, and all other records pertinent to an award for a minimum period of three years from the end of the grant term. Some records have a three-year retention period, while others have a seven year, or permanent retention period.2

LSC Financial Guide, § 2.5.3 – Electronic Data Processing and Cybersecurity

Pursuant to the LSC Financial Guide, § 2.5.3, “[r]ecipients are required to have written security policies and procedures for physical and digital assets including all financial data and records in any form (e.g., electronic data processing (EDP) and cybersecurity policies and procedures). These policies and practices should be part of an overall data and records security policy and an annual overall risk-assessment process.” Included in the requirements of the Financial Guide are that the related policies and procedures must require that the recipient perform (and document) an annual risk assessment and develop and periodically test an emergency disaster prevention and recovery plan.3 Recipients are reminded that they must: (1) perform and formally document the risk assessments related to EDP and cybersecurity and (2) develop and periodically test emergency disaster prevention and recovery plan.

LSC Financial Guide, § 3.2.1 – Bank Accounts

The LSC Financial Guide, § 3.2.1 provides that recipients must notify their Board when opening, closing, or changing bank accounts with sufficient justification. Further, recipients must also document who has access to bank accounts (this includes all types of bank accounts and all related activities), and the date of access granted. This record must also indicate that access has been revoked when the individual leaves the position or transfers to a position without bank access duties.

LSC Financial Guide, § 3.2.1.c – Bank Statements and Reconciliations

Pursuant to the LSC Financial Guide, § 3.2.1.c, recipients are required to perform bank reconciliations for each bank account on a timely basis after the close of each month. Additionally, the individual who prepares the bank statement reconciliation must document this by including their initials or signature, and the date the task was performed.

LSC Financial Guide, § 3.2.4.c – Credit and Debit Purchase Cards and LSC OIG April 2020 Fraud Alert

If a recipient makes use of credit or debit purchase order cards, it must have a credit/debit card policy that comports to the requirements of the LSC Financial Guide, § 3.2.4.c, ensuring that the use of credit and debit cards do not lead to unauthorized charges. Per the LSC OIG April 2020 Fraud Alert, one means of protecting accounts from such is to limit or monitor the linking of recipient credit/debit cards to third party payment systems.

LSC Financial Guide, § 3.6.1 - Capitalized Assets

Recipients are required to record capitalized property and equipment in a property subsidiary ledger that reconciles to the general ledger. The property subsidiary ledger must include all necessary documentation listed in § 3.6.1.

Regulatory Concerns 

45 C.F.R. Part 1604 – Outside Practice of Law

Recipient organizations are required by 45 C.F.R. Part 1604 to follow their written policies that detail the organization's internal policies and procedures pertaining to any allowable outside practice of law by full-time attorneys. Recipients are reminded that their policies may permit the outside practice of law by full-time attorneys only to the extent allowed by the LSC Act and Part 1604 but may impose additional restrictions as necessary to meet the recipient's responsibilities to clients.

Additionally, recipients are reminded of the obligation discussed in LSC Advisory Opinion 2020-002 that Part 1604 policies and practices include methods for monitoring and documenting approved outside of practice of law in order to demonstrate ongoing compliance with Part 1604. Such monitoring should include the use of leave time when full- time attorneys are approved for outside practice of law activities (i.e., time taken off to engage in the outside practice activity) and whether the nature of the approved outside practice has changed.

45 C.F.R. § 1610.7 – Notification to non-LSC funders and donors

Under 45 C.F.R. §§ 1610.7(a) and (b), recipients may not accept funds of $250 or more from any source other than LSC, unless the recipient provides the source of the funds with written notification of LSC prohibitions and conditions that apply to the funds. Recipients are encouraged to include the language found in 45 C.F.R Part 1610 on their websites.

45 C.F.R. § 1611.3(e) – Financial Eligibility and Victims of Domestic Violence

Pursuant to the requirements of 45 C.F.R. § 1611.3(e), “the recipient shall consider only the assets and income of the applicant and members of the applicant's household other than those of the alleged perpetrator of the domestic violence.” Recipients are reminded to ensure that staff exclude any assets held by the alleged perpetrator of the domestic violence, jointly held by the applicant with the alleged perpetrator of the domestic violence, or assets jointly held by any member of the applicant's household with the alleged perpetrator of the domestic violence.

45 C.F.R. § 1611.9 – Retainer Agreements

Pursuant to 45 C.F.R. § 1611.9 (a), “written retainer agreements must include, at a minimum, a statement identifying the legal problem for which representation is sought, and the nature of the legal services to be provided.” Additionally, “the retainer agreement shall be executed when representation commences or as soon thereafter as is practicable.” Recipients are reminded that retainer agreements must be executed in a timely manner and contain an adequate description of the nature of the legal services provided.

45 C.F.R. Part 1614

To ensure compliance with 45 C.F.R § 1614.7, recipients must separately track LSC-eligible PAI matters activities. Additionally, recipients operating pro se clinics staffed by law school students are reminded they can only report cases as PAI-eligible if supervised by a private attorney as defined by Part 1614.3(a) and (i) or when the representation is provided before an administrative tribunal that permits non-attorneys to represent individuals before the tribunal. See CSR Handbook (2017 Ed.), § 10.1.

45 C.F.R. Part 1626 – Restrictions on Legal Assistance to Aliens and CSR Handbook (2017 Ed.), §§ 5.5 and 5.6 – Legal Assistance Documentation Requirements

Pursuant to 45 C.F.R. § 1626.6 and CSR Handbook, § 5.5, recipients must (1) ensure citizenship attestation are executed when required and in a timely manner (unless the emergency provision of 45 C.F.R. § 1626.8 is properly applied); and (2) implement oversight procedures to ensure that all case files that require it contain timely and properly executed citizenship attestations.

45 C.F.R. § 1626.4 - Aliens eligible for assistance under anti-abuse laws and Program Letter 24-1

Recipients are reminded that victims of abuse acts do not need to be citizens of the United States to receive LSC funded legal services, so long as the legal assistance is related to the abuse per the requirements of 45 C.F.R. § 1626.4.

Victims of trafficking are covered by different provisions of 45 C.F.R. § 1626.4 depending on the nature of the trafficking activity. Recipients should determine whether a non-citizen is a victim of trafficking under VAWA or section 101(a)(15)(U) of the Immigration and Nationality Act, or a victim of severe forms of trafficking under the Trafficking Victims Protection Act, 22 U.S.C. § 7101 et seq. The facts of a non-citizen’s situation may indicate that the non-citizen is eligible for assistance under one or more of these statutes.

Eligibility for assistance based on qualifying for a U-visa or being a victim of severe forms of trafficking requires consideration of other statutory factors in addition to the qualifying crime. See 8 U.S.C. § 1101(a)(15)(U); 22 U.S.C. § 7105(b)(1)(C). Recipients must document that a non-citizen meets all relevant statutory factors.

Individuals who are applying for assistance as spouses of U.S. citizens who have filed an application for adjustment of status must provide evidence of a valid marriage. This requirement applies to all applicant spouses, including spouses in same-sex marriages. See Program Letter 24-1.

45 C.F.R. Parts 1630 - Cost Standards and Procedures and 1635 - Timekeeping Requirements

A cost is reasonable if, in its nature or amount, it does not exceed that which a prudent person under the same or similar circumstances prevailing at the time the decision was made to incur the costs . . . See 45 C.F.R. § 1630.5(b).

Recipients must base allocations of salaries and wages on records that accurately reflect the work performed. See 45 C.F.R. § 1635.4.

Recipients may not use LSC funds to pay employees for time not worked and not charged to an appropriate leave category.

45 C.F.R. Part 1631 – Real Property Accounting and Reporting

Recipients owning LSC-funded real property are required to adhere to certain accounting and reporting provisions under 45 C.F.R. Part 1631. Recipients must maintain an accounting of LSC funds related to the purchase or maintenance of real property purchased with LSC funds. The accounting must include the amount of LSC funds used to pay for acquisition costs, financing, and capital improvements. This accounting must be provided to LSC annually, no later than April 30 of the following year or in a recipient's annual audited financial statements submitted to LSC. 45 C.F.R. § 1631.19. As a best practice, all recipients owning real property in which LSC has an interest should contemporaneously document property-related expenses and track the amount of LSC funds used over the life of the investment.

Automated Case Management Systems

CSR Handbook (2017 Ed.), § 5.6 - Legal Assistance Documentation Requirements

Pursuant to CSR Handbook (2017 Ed.), § 5.6, for each case reported to LSC, the case file or the Case Management System (CMS) must contain a description of the legal assistance provided to the client. Such description should be sufficient to document that the assistance is a case and to support the level of assistance selected by the program to close the case.

Recipients are required to have procedures in place as well as documentation contained within the case file or CMS that ensures cases are closed with the CSR Closure Category that most accurately reflects the highest level of legal assistance provided to the client.

45 C.F.R. § 1611.3(d) – Financial Eligibility and Asset Ceilings

Pursuant to § 1611.3(d)(1), “As part of its financial eligibility policies, every LSC recipient shall establish reasonable asset ceilings for individuals and households. In establishing asset ceilings, the recipient may exclude consideration of a household’s principal residence, vehicles used for transportation, ...” Recipients must train team members responsible for intake screening to appropriately question applicants, document answers, and apply exemptions according to their board-approved eligibility policies.

New Program Letters 

Program Letter 24-2 – Employee Incentive Payment Guidance

On April 1, 2024, LSC issued Program Letter 24-2regarding the use of Basic Field Grant funds for employment-related incentive payments as a means of strengthening employee recruitment and retention. These incentive payments, which could include but are not limited to retention bonuses, law school loan repayment programs, and relocation incentives, are an allowable use of Basic Field Grant funds, with the stipulation that the development and application of such incentive payment programs must adhere to LSC requirements and the recipient’s established policies.

As a reminder such payments must satisfy the cost standards outlined in 45 C.F.R. § 1630.5 and must follow the recipient’s cost allocation methodology. Further, recipients must establish adequate internal controls to include Board-approved policies and procedures that define, at minimum, the incentive types offered, eligibility criteria, maximum amounts per employee for each incentive type, review/approval requirements, and documentation requirements.

Fraud Awareness

The Office of Inspector General ("OIG") issued several fraud alerts over the past year. The following are particularly critical for recipient awareness:

• Fraud Alert 24-0143-A-FA (August 7, 2024) Mitigating the Growing Risk of Cyber Attacks: New Guidance to Help Nonprofits.

  • Nonprofit organizations and their staff are at an increased risk of being targeted by malicious cyber actors. The Cybersecurity & Infrastructure Agency (CISA) has recently released guidance on mitigating cyber threats. To mitigate risks, recipients are reminded to:

    • Keep software updated on user devices and IT infrastructure. Implement phishing-resistant multifactor authentication (MFA).

    • Audit accounts and disable unused and unnecessary accounts.

    • Remove needless accounts to reduce access vectors that actors can use to get into the system.

    • Disable user accounts and access to organizational resources for departing staff

    • Apply the Principle of Least Privilege and remove any unnecessary permissions or access.

    • Exercise due diligence when selecting vendors, including cloud service providers (CSP) and managed service providers (MSP).

    • Review contractual relationships with all service providers to ensure cybersecurity compliance.

    • Manage architecture risks by auditing and reviewing connections between customer systems, service provider systems, and other client enclaves, such as cloud services.

    • Use a dedicated VPN to connect to MSP infrastructure.

    • Implement basic cybersecurity training to cover concepts such as account phishing, email and web browsing security, and password security.

    • Develop and exercise incident response and recovery plans.

  • Recipients may review the CISA guide in its entirety at: https://www.cisa.gov/sites/default/files/2024-05/joint-guide-mitigating-cyber- threats-with-limited-resources-guidance-for-civil-society-508c_3.pdf

• Fraud Alert 23-0201-A-FA (October 12, 2023) How to Combat Common Fraud Schemes Against Renters.

  • This OIG Fraud Alert discussed several common fraud schemes and abusive practices that renters could fall prey to if they lack awareness. As noted in the alert, the following represent the most common renter-related schemes:

    • Upfront payment

    • Additional fees or charges

    • Harassment

    • Added fees for background checks

  • The HUD OIG recommends that prospective renters protect themselves from becoming victims of fraud by always doing the following:

    • Insist on meeting the prospective landlord by scheduling an in-person meeting in a public place or meet virtually.

    • Use an Internet search engine to look up the prospective rental address. It may already be listed by a legitimate landlord on a different website. Consider conducting a reverse image search of prospective rental property photos.

    • If renting a government-subsidized unit (such as a unit advertised as a "voucher” or “section 8” unit), contact the local public housing authority at the phone 3 number or email address listed on their public website to verify the landlord before sending money, documentation, or rental forms.

    • Pay rent with a check, money order, or other verifiable means to track the money. Avoid using cash, gift cards, or other forms of payment. Keep a copy of the check or money order and ask for a receipt as a record of payment.

• Fraud Advisory 24-0031-A-FA (January 18, 2024) OIG Introduces a "Cyber After Incident Report Form" For LSC Grantees

  • The OIG implemented a “Cyber After Incident Report Form” to gather more information on reported cyberattacks. The OIG will use this information to better assist recipients with their response and recovery in the event of an attack.

  • Recipients can find the full “Cyber After Incident Report Form” attached at the end of the January 18, 2024 Fraud Advisory.

• Fraud Advisory 23-0201-A-FA (December 4, 2023) Prohibited Outside Practice of Law and Outside Employment Activities.

  • During the pandemic, some individuals sought outside employment based upon their personal economic circumstances or due to recent technological advances allowing increased opportunities for telework and remote work. Unfortunately, some individuals have taken advantage of the situation and engaged in prohibited practices. The following are real-life examples of violations reported to the OIG since 2020:

    • Technology (IT) Director was identified as having outside employment at another IT company as a part-time contractor, potentially during grantee business hours. The recipient employee did not disclose the outside employment and did not request approval from the Executive Director, as required by the recipient’s outside employment policy.

    • A full-time paralegal employee was working simultaneously as a full-time paralegal for another local nonprofit during the same core business hours, receiving duplicate pay, in violation of recipient policies and potentially committing time and attendance fraud. The paralegal worked in a hybrid work environment at the grantee, with little to no supervision.

    • A full-time staff attorney was the attorney of record for private clients in small claims hearings. The attorney filed pleadings with the court under the name of a private law firm that included the staff attorney’s last name.

  • The following OIG advisories, as well as LSC Program Letter 18-1, (linked below) provide information on how to draft rigorous outside employment and outside practice of law policies, as well as guidance on how best to detect and prevent prohibited outside practice of law and undisclosed outside employment:

    • LSC Program Letter 18-1

    • OIG Fraud Advisory on Outside Employment

    • OIG Fraud Advisory on Outside Employment During Remote Work

    • OIG Fraud Advisory on Unauthorized Outside Practice of Law

    • OIG Fraud Advisory on Diversion of Clients for Legal Services