FAMILY FIRST HEALTH CORPORATION

Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Health Center Program Cluster, Temporary Assistance for Needy Families Federal Assistance Listing Number: 93.224, 93.527, 93.558 Compliance Requirements: Activities allowed or unallowed, Allowable costs/Cost Principles Type of Finding: Material Weakness in Internal Control over Compliance Criteria: According to 2 CFR, Part 200.430(i)(1) of the Office of Management and Budget's Uniform Guidance, charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed, which must, among other things: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity. Condition/Context: In connection with the Activities allowed or unallowed, and Allowable Costs/Cost Principles compliance testing, we noted that the time and effort attestations for all employees were not completed at all during fiscal year 2023. Salaries and related costs were charged to the grants based on budgeted estimates. Cause: Procedures and controls were not put in place to ensure actual time spent was properly charged to the programs. Effect or Potential Effect: The deficiency in the Center's controls over compliance with activities allowed or unallowed, and allowable cost/cost principles could result in unallowed payroll costs being charged to the grant. Questioned Costs: None Identification as a Repeat Finding Yes - See 2022-003 Auditor's Recommendation: The Center should ensure that the time and effort attestations are signed by both employee and supervisor timely. Views of Responsible Officials: The Center will review its Time and Effort policy to ensure continued compliance with federal regulations in maintaining records of personnel time and effort to substantiate salary costs associated with its federal grants. We will add steps to our process to ensure that the certifications by employees whose time is allocated to one federally funded program will sign an after-the-fact certification on a semi-annual basis confirming that the employee worked on a single award for the given period. The transition from ADP (our past payroll processor) to Paycom (our new payroll processor) will provide additional levels of timekeeping detail that will enable time and effort to be more closely monitored and reported.

Federal Agency: U.S. Department of Health and Human Services Federal Program Title: COVID-19 - Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Federal Assistance Listing Number: 93.498 Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: In accordance with the reporting requirements of the U.S. Department of Health and Human Services, the Center is required to accurately report to HRSA the methodology applied to the provider relief funds received. Condition/Context: In connection with the Reporting test for the Provider Relief Funds, we noted that the Center inaccurately reported the methodology used to HRSA as expenditures attributable to coronavirus as opposed to lost revenues. Cause: Personnel in charge of the submission inadvertently reported the incorrect methodology. Effect: HRSA could deem the report to be invalid and require the Center to pay back the funds. Questioned Costs: None Identification as a Repeat Finding Yes- see 2022-004 Auditor's Recommendation: The Center should ensure that the reporting over the provider relief funds is accurate prior to submission. Views of Responsible Officials: Procedures will be put in place to review accuracy of reporting prior to submission.

Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Health Center Program Cluster, COVID-19 Immunization Cooperative Agreements Federal Assistance Listing Number: 93.224, 93.527, 93.268 Compliance Requirements: Activities allowed or unallowed, Allowable costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: The time and effort attestations are to be prepared and signed by the employees who work on the grants and their supervisor on a timely basis. Condition/Context: In connection with the Activities allowed or unallowed, and Allowable Costs/Cost Principles compliance requirements for the DHHS 330 grant and the PA DOH COVID vaccine grant, we noted that the time and effort attestations for all employees were not done until the time of the audit. Cause: Due to turnover in the finance department, the attestations were not completed until they were requested by the auditors. Effect or Potential Effect: The deficiency in the Center's controls over compliance with activities allowed or unallowed, and allowable cost/cost principles could result in unallowed payroll costs being charged to the grant. Questioned Costs: None Identification as a Repeat Finding No Auditor's Recommendation: The Center should ensure that the time and effort attestations are signed by both employee and supervisor timely. Views of Responsible Officials: Family First Health will review its Time and Effort policy to ensure continued compliance with federal regulations in maintaining records of personnel time and effort to substantiate salary costs associated with its federal grants. We will add steps to our process to ensure that the certifications by employees whose time is allocated to one federally funded program will sign an after-the-fact certification on a semi-annual basis confirming that the employee worked on a single award for the given period. The transition from ADP (our past payroll processor) to Paycom (our new payroll processor) will provide additional levels of timekeeping detail that will enable time and effort to be more closely monitored and reported.

Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Health Center Program Cluster, COVID-19 Immunization Cooperative Agreements Federal Assistance Listing Number: 93.224, 93.527, 93.268 Compliance Requirements: Activities allowed or unallowed, Allowable costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: The time and effort attestations are to be prepared and signed by the employees who work on the grants and their supervisor on a timely basis. Condition/Context: In connection with the Activities allowed or unallowed, and Allowable Costs/Cost Principles compliance requirements for the DHHS 330 grant and the PA DOH COVID vaccine grant, we noted that the time and effort attestations for all employees were not done until the time of the audit. Cause: Due to turnover in the finance department, the attestations were not completed until they were requested by the auditors. Effect or Potential Effect: The deficiency in the Center's controls over compliance with activities allowed or unallowed, and allowable cost/cost principles could result in unallowed payroll costs being charged to the grant. Questioned Costs: None Identification as a Repeat Finding No Auditor's Recommendation: The Center should ensure that the time and effort attestations are signed by both employee and supervisor timely.

Federal Agency: U.S. Department of Health and Human Services Federal Program Title: COVID-19 - Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Federal Assistance Listing Number: 93.498 Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: The Center is required to accurately report to HRSA the methodology applied to the provider relief funds received. Condition/Context: In connection with the Reporting test for the Provider Relief Funds, we noted that the Center inaccurately reported the methodology used to HRSA as expenditures attributable to coronavirus as opposed to lost revenues. Cause: Personnel in charge of the submission inadvertently reported the incorrect methodology. Effect: HRSA could deem the report to be invalid and require the Center to pay back the funds. Questioned Costs: None Identification as a Repeat Finding No Auditor's Recommendation: The Center should ensure that the reporting over the provider relief funds is accurate prior to submission. Views of Responsible Officials: Procedures will be put in place to review accuracy of reporting prior to submission.

Federal Agency: U.S. Department of Health and Human Services Federal Program Title: COVID-19 - Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Federal Assistance Listing Number: 93.498 Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control over Compliance Condition/Context: In connection with the Reporting test for the Provider Relief Funds, we noted that the Center inaccurately reported the methodology used to HRSA as expenditures attributable to coronavirus as opposed to lost revenues. Criteria: The Center is required to accurately report to HRSA the methodology applied to the provider relief funds received. Cause: Personnel in charge of the submission inadvertently reported the incorrect methodology. Effect: HRSA could deem the report to be invalid and require the Center to pay back the funds. Questioned Costs: None Identification as a Repeat Finding: No Auditor's Recommendation: The Center should ensure that the reporting over the provider relief funds is accurate prior to submission.