CENTRAL MAINE HEALTHCARE CORPORATION AND SUBSIDIARIES

Assistance Listing Number, Federal Agency, and Program Name - 93.498, Department of Health and Human Services, COVID-19 - Provider Relief Fund (PRF) and American Rescue Plan (ARP) Rural Distribution Federal Award Identification Number and Year - N/A Pass-through Entity - N/A Finding Type - Material weakness and material noncompliance with laws and regulations Repeat Finding - Yes 2021-004 Criteria - In order to comply with program rules, nonfederal entities must establish and maintain effective internal controls over the federal award, as prescribed by 2 CFR 200.303(a). For Provider Relief Funds, the terms and conditions of the grant, according to U.S. Department of Health and Human Services (HHS), require that the Corporation report certain information accurately into the HHS PRF Reporting Portal in order to attest to the utilization of the funding received. Specifically, the HHS June 11, 2021 post-payment reporting notice provides specific guidance on the calculation of lost revenue and amounts to be reported in the portal. Condition - The Corporation did not follow the reporting requirements outlined in the HHS June 11, 2021 post-payment notice. Questioned Costs - N/A Identification of How Questioned Costs Were Computed - N/A - refer to context below Context - The detailed testing of lost revenue reported in the PRF portal revealed an overstatement of $9.9 million through period 3 (the latest period for which the Corporation submitted lost revenues). Two of the Corporation's subsidiaries, Rumford Hospital and Bridgton Hospital, received target distributions and reported their respective lost revenue at both the subsidiary and parent level. Excluding the overstatement, the aggregate lost revenue reported should have been approximately $64.9 million in comparison to $78.9 million reported. Total payments received through Period 3 were approximately $32.9 million. The corrected lost revenue still exceeded the aggregate Periods 1 - 3 payments and, thus, did not result in questioned costs. Additionally, the Rumford Community Family Health Center, Inc. portal period 1 submission indicated that approximately $207,000 of targeted distribution payments were transferred to the parent entity; however, the parent entity portal period 1 submission did not include the approximately $207,000 transfer. Further, the approximately $207,000 of lost revenue was not appropriately transferred between entities related to the targeted distribution transfer. Cause and Effect - The Corporation designed controls related to identification of allowable lost revenue to be entered into the portal for submission to HHS, which included a review of the final lost revenue calculation; however, the review process did not effectively identify lost revenue for targeted distributions that needed to be reduced on the Corporation portal submission or the transfer of lost revenue from Rumford Community Family Health Center, Inc. to the parent. The failure to have an effective control in place caused the Corporation to overstate the amount of the actual lost revenue available for use in the Period 2 and 3 portal submissions. Recommendation - We recommend that the review process include specific procedures to ensure that lost revenue amounts have not been included more than once and that the lost revenue reported in the portal submission follows the guidance provided by the HHS. Further, we recommend that the lost revenue calculation be updated in the next available portal submission. Views of Responsible Officials and Corrective Action Plan - A misinterpretation of the guidance has been corrected and the submissions in fiscal year 2023 are now in compliance with the reporting requirements.

Assistance Listing Number, Federal Agency, and Program Name - 84.425F, 84.425M, 84.425N; U.S. Department of Education; Education Stabilization Fund (ESF) - HEERF Institutional Portion, HEERF Strengthening Institutions Program (SIP), HEERF Fund for Improvement of Postsecondary Education (FIPSE) Formula Grant. Federal Award Identification Number and Year - P425F204736, P425M201046-20A , P425N200748 Pass-through Entity - N/A Finding Type - Material weakness Repeat Finding - Yes 2021-005 Criteria - Per 2 CFR 200.510(b) - The auditee must also prepare a schedule of expenditures of federal awards for the period covered by the auditee's financial statements, which must include the total federal awards expended as determined in accordance with ? 200.502. While not required, the auditee may choose to provide information requested by federal awarding agencies and pass-through entities to make the schedule easier to use. Condition - The schedule of expenditures of federal awards (SEFA) was not complete and accurate. Questioned Costs - None Identification of How Questioned Costs Were Computed - N/A Context - In fiscal year 2022, the Corporation expended approximately $15.7 million of federal funding. The funding was received from several federal and nonfederal entities. The Corporation accumulates the financial data and other required information to complete the SEFA. The SEFA improperly excluded $387,635 of expenditures under programs ALN 84.425F, 84.425M, and 84.425N. The addition of the $387,635 of expenditures caused the ALN 84.425 Education Stabilization Fund to require testing as a major program Cause and Effect - Controls in place did not ensure the SEFA was complete and accurate. The effect of the lack of controls is detailed in the context section above. Additionally, the lack of controls resulted in an additional major program the year ended June 30, 2022. The error noted above have been corrected on the SEFA as of June 30, 2022. Recommendation - The Corporation should implement a process to ensure that the SEFA is prepared is complete and accurate. Views of Responsible Officials and Planned Corrective Actions - Management concurs with the finding and additional training for those individuals responsible for grant accounting has and will continue to be conducted as well as incorporating additional levels of review to ensure the SEFA is completed accurately and timely.

Assistance Listing Number, Federal Agency, and Program Name - 84.425F, 84.425M, 84.425N; U.S. Department of Education; HEERF Institutional Portion, HEERF Strengthening Institutions Program (SIP), HEERF Fund for Improvement of Postsecondary Education (FIPSE) Formula Grant. Federal Award Identification Number and Year - P425F204736, P425M201046-20A , P425N200748 Pass-through Entity - N/A Finding Type - Significant deficiency Repeat Finding - No Criteria - Per 2 CFR 200.318 - The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or services required under a Federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standards identified in ?? 200.317 through 200.327. Condition - The Corporation's procurement procedures does not fully conform to the procurements standards identified in ?? 200.317 through 200.327. Questioned Costs - None Identification of How Questioned Costs Were Computed - N/A Context - During testing we did not identify any instances of noncompliance related to procurement. However, during the review of the policies we discovered the following provisions of the standards were not in conformity with Uniform Guidance: * ? 200.318 - general procurement standard: the policy excluded a written standard of conduct covering conflicts of interest, including organizational conflicts of interest * ? 200.320 - methods of procurement: the policy does not appear to conform to the standards specific to non-construction purchases in excess of the small acquisition threshold * ?? 200.321 - 300.326 are not addressed in the policies Cause and Effect - Controls in place did not ensure the procurement policies and procedures conformed to the procurement standards identified in ?? 200.317 through 200.327. The lack of controls could result in acquisition of property or services that does not provide full and open competition and could result in disallowed costs. Recommendation - The Corporation should review the procurement standards identified in ?? 200.317 through 200.327 to identify policy deficiencies and work to establish policy that will confirm to the standards. Views of Responsible Officials and Planned Corrective Actions - Management concurs with the finding and will be conducting a thorough review of the current policies to ensure compliance with Uniform Guidance, as well as providing additional training and education to those responsible for procurement.

Assistance Listing Number, Federal Agency, and Program Name 93.498, U.S. Department of Homeland Security, COVID 19 Provider Relief Fund Federal Award Identification Number and Year N/A Pass through Entity N/A Finding Type Material weakness and material noncompliance with laws and regulations Repeat Finding No Criteria In order to comply with program rules, nonfederal entities must establish and maintain effective internal controls over the federal award, as prescribed by 2 CFR 200.303(a). For Provider Relief Funds, the terms and conditions of the grant, according to U.S. Department of Health and Human Services (HHS), require that the Corporation report certain information accurately into the HHS PRF Reporting Portal in order to attest to the utilization of the funding received. Specifically, the HHS June 11, 2021 post payment reporting notice provides specific guidance on the calculation of lost revenue and amounts to be reported in the portal. Condition The Corporation did not follow the reporting requirements outlined in the HHS June 11, 2021 post payment notice. Questioned Costs N/A Identification of How Questioned Costs Were Computed N/A refer to context below Context The detailed testing of lost revenue reported in the PRF portal revealed an overstatement of $9.7 million. Two of the Corporation's subsidiaries, Rumford Hospital and Bridgton Hospital, received target distributions and reported their respective lost revenue at both the subsidiary and parent level. Excluding the overstatement, the aggregate lost revenue reported should have been approximately $53.5 million in comparison to $63.2 million reported. Total payments received in Period 1 were approximately $27.5 million. The corrected lost revenue still exceeded the aggregate Period 1 payments and, thus, did not result in questioned costs. Additionally, the Rumford Community Family Health Center, Inc. portal period 1 submission indicated that approximately $207,000 of targeted distribution payments were transferred to the parent entity; however, the parent entity portal period 1 submission did not include the approximately $207,000 transfer. Further, the approximately $207,000 of lost revenue was not appropriately transferred between entities related to the targeted distribution transfer. Cause and Effect The Corporation designed controls related to identification of allowable lost revenue to be entered into the portal for submission to HHS, which included a review of the final lost revenue calculation; however, the review process did not effectively identify lost revenue for targeted distributions that needed to be reduced on the Corporation portal submission or the transfer of lost revenue from Rumford Community Family Health Center, Inc. to the parent. The failure to have an effective control in place caused the Corporation to overstate the amount of the actual lost revenue available for use in the Period 1 portal submissions. Recommendation We recommend that the review process include specific procedures to ensure that lost revenue amounts have not been included more than once and that the lost revenue reported in the portal submission follows the guidance provided by the HHS. Further, we recommend that the lost revenue calculation be updated in the next available portal submission. Views of Responsible Officials and Corrective Action Plan Management agrees with the assessment and is working to correct the issue. The Corporation will develop formal policies and procedures and engage in additional training and education in grant accounting.

Assistance Listing Number, Federal Agency, and Program Name * ALN 93.461, Department of Health and Human Services, HRSA COVID 19 Uninsured Program (Uninsured Program) * ALN 32.006, Federal Communications Commission, COVID 19 Telehealth Program (Telehealth) * ALN 97.036, Department of Homeland Security, Disaster Grants Public Assistance (Presidentially Declared Disasters) (FEMA) * ALN 93.498, Department of Health and Human Services, Provider Relief Fund (PRF) Federal Award Identification Number and Year N/A for ALNs 93.461, 32.006, and 93.498. ALN 97.036 is 4522 DR ME Pass through Entity N/A for ALNs 93.461, 32.006, and 93.498 since direct funded. ALN 97.036 pass through entity is Maine Emergency Management Agency Finding Type Material weakness Repeat Finding No Criteria Per 2 CFR 200.510(b) The auditee must also prepare a schedule of expenditures of federal awards for the period covered by the auditee's financial statements, which must include the total federal awards expended as determined in accordance with ? 200.502. While not required, the auditee may choose to provide information requested by federal awarding agencies and pass through entities to make the schedule easier to use. Condition The schedule of expenditures of federal awards (SEFA) was not complete, accurate, or prepared timely. Questioned Costs None Identification of How Questioned Costs Were Computed N/A Context In fiscal year 2021, the Corporation expended approximately $32.1 million of federal funding. The funding was received from several federal and nonfederal entities. The Corporation accumulates the financial data and other required information to complete the SEFA. The SEFA included the following inaccuracies: * ALN 93.461 (Uninsured Program) Expenditures of $364,675 were improperly excluded from the SEFA. * ALN 32.006 (Telehealth) Expenditures of $88,882 were reported as ALN 97.036 (FEMA). * ALN 97.036 The expenditures reported on the SEFA were overstated by approximately $11,000. * ALN 93.498 (PRF) Expenditures of $27,480,752 were improperly reported as ALN 21.022. Cause and Effect Controls in place did not ensure the SEFA was completed in a timely manner and that it was complete and accurate. The effect of the lack of controls is detailed in the context section above. Additionally, the lack of controls could result in inappropriate major programs being tested. The errors noted above have been corrected on the SEFA as of June 30, 2022. Recommendation The Corporation should implement a process to ensure that the SEFA is prepared timely and that it is complete and accurate. Views of Responsible Officials and Planned Corrective Actions Management agrees with the assessment and is working to correct the issue. The Corporation will develop formal policies and procedures and engage in additional training and education in grant accounting.

Assistance Listing Number, Federal Agency, and Program Name 97.036, U.S. Department of Homeland Security, Disaster Grants Public Assistance (Presidentially Declared Disasters) Federal Award Identification Number and Year 4522 DR ME Pass through Entity Maine Emergency Management Agency Finding Type Significant deficiency Repeat Finding No Criteria In order to comply with program rules, nonfederal entities must establish and maintain effective internal controls over the federal award, as described in 2 CFR 200.303(a). Condition The Corporation's payroll hours expensed to FEMA awards for screener pay varied from supporting payroll documentation in some cases due to a detail review of the hours charged to FEMA against payroll records not being performed. Questioned Costs None Identification of How Questioned Costs Were Computed No known or likely questioned costs in excess of the reporting threshold were identified based on extrapolation of errors identified in audit testing. Context Out of the sample of nine screener pay samples tested for allowability, one sample resulted in an overcharge to FEMA as a result of two hours in the FEMA project workbook being charged at overtime rates, versus regular hour rates paid to the employee during the time period tested. Cause and Effect Hours input into the project workbook for screener pay were not reviewed in detail against payroll records. As a result, the Corporation submitted incorrect hours and amounts on the project workbook containing screener pay. Recommendation We recommend the Corporation take steps to ensure it performs a secondary review on all data submitted on FEMA project workbooks against supporting documentation. Views of Responsible Officials and Planned Corrective Actions Management agrees with the assessment and is working to correct the issue. The Corporation will develop and adopt formal policies and procedures to perform a detailed review of FEMA projects before final submission.