NovaSalud, Inc.

2019-001: Significant Deficiency ? Credit Card Approval (CFDA No. 93.940, U.S. Department of Health and Human Services, HIV Prevention Activities ? Health Department Based) Criteria: Internal controls are designed to safeguard assets and help prevent or detect losses from employee dishonesty or error. A fundamental concept in a good system of internal control is the segregation of duties. While adequate segregation of duties can be difficult to accomplish within a small organization, management should be mindful of areas that may be enhanced, and to maintain documentation of the reviews and approval process. Condition: During our audit we noted that approval of credit card purchases made by the Executive Director were only verbally approved by the Director of Operations, and therefore, no documentation was maintained to indicate the review and approval of the Executive Director?s credit card transactions. Cause: Segregation of duties can be difficult to accomplish within a small organization and the Organization was unaware of appropriate controls to put in place to enhance the review process of credit cards. Effect: The Organization did not have the appropriate documentation to substantiate the review and approval of credit card transactions. Questioned Costs: None Recommendation: We recommend that the approval of the Executive Director?s credit card purchases be documented in writing (date and by whom) and maintained by the Organization. Repeat Finding: This is not a repeat finding. This is the Organization?s first single audit. Views of Responsible Officials and Corrective Action Plan: NovaSalud, Inc. agrees with the finding and the recommended procedures have been implemented.

2019-002: Significant Deficiency ? Approval of Invoices and Review of Reimbursement Requests (CFDA No. 93.940, U.S. Department of Health and Human Services, HIV Prevention Activities ? Health Department Based) Criteria: Internal controls are designed to safeguard assets and help prevent or detect losses from employee dishonesty or error. A fundamental concept in a good system of internal control is the segregation of duties. While adequate segregation of duties can be difficult to accomplish within a small organization, management should be mindful of areas that may be enhanced, and to maintain documentation of the reviews and approval process. Condition: During our audit, we noted that the Organization?s policy is that invoices are provided to the Executive Director or the Director of Operations for review, along with the outgoing accounts payable check. Once reviewed, the Executive Director or Director of Operations will sign the accounts payable check to indicate their approval. However, during our audit we were unable to trace to images of the signed checks (due to bank time limitations on providing this support) in order to substantiate the Organization?s review process for several checks in our sample. Additionally, we noted that accounts receivable invoices are prepared by the accountant and the Director of Operations and submitted to the funding agencies for payment. Cause: Segregation of duties can be difficult to accomplish within a small organization and the Organization was unaware of appropriate controls to put in place to enhance the review process. Effect: The Organization did not have the appropriate documentation to substantiate the review and approval process of invoices. Questioned Costs: None Recommendation: We recommend that the Organization develop a policy whereby the individual that is signing the check should initial the invoice to indicate review and approval of the invoice. Additionally, we recommend that a review of the compiled invoices be done by the Executive Director before invoices are submitted to the funding agencies. Supporting documentation of the review should be maintained, such as an email noting approval or an initial on the invoice. Repeat Finding: This is not a repeat finding. This is the Organization?s first single audit. Views of Responsible Officials and Corrective Action Plan: NovaSalud, Inc. agrees with the finding and have implemented procedures where the individual signing the check will also initial the invoice to indicate review and approval of the invoice. As for the approval of the grant reimbursement invoices, the current process is: the accountant prepares the invoices, and the Director of Operations reviews and approves the invoice for submission to the donors. We will continue this process.

2019-003: Significant Deficiency ? Journal Entries (CFDA No. 93.940, U.S. Department of Health and Human Services, HIV Prevention Activities ? Health Department Based) Criteria: Internal controls are designed to safeguard assets and help prevent or detect losses from employee dishonesty or error. A fundamental concept in a good system of internal control is the segregation of duties. While adequate segregation of duties can be difficult to accomplish within a small organization, management should be mindful of areas that may be enhanced, and to maintain documentation of the reviews and approval process. Condition: During our audit we noted that general journal entries are not being approved. We also noted that general journal entries are not stored with supporting documentation in a central location. Cause: Segregation of duties can be difficult to accomplish within a small organization and the Organization was unaware of appropriate controls to put in place to enhance the journal entry process. Effect: The Organization did not have appropriate segregation of duties for journal entries. Questioned Costs: None Recommendation: We recommend that management adopt a policy requiring a designated member of management or the board to approve journal entries. All journal entries should be initialed by both the preparer and the individual approving them in order to attribute responsibility to the appropriate individuals. All journal entries should be accompanied by a full explanation and stored with adequate supporting documentation in a central location. Repeat Finding: This is not a repeat finding. This is the Organization?s first single audit. Views of Responsible Officials and Corrective Action Plan: Director of Operations currently reviews journal entries as it is printed from Quickbooks (QB). NovaSalud, Inc. agrees with the findings and have implemented the recommendation for the Director of Operations to review and approve journal entries in QB as opposed to a printout from QB.

2019-004: Significant Deficiency ? Preparation of the Schedule of Expenditures of Federal Awards (CFDA No. 93.940, U.S. Department of Health and Human Services, HIV Prevention Activities ? Health Department Based) Criteria: The Schedule of Expenditures of Federal Awards (SEFA) is a supplemental schedule to the financial statements that an organization is required to produce when it is subject to the single audit requirement. The single audit requirement is triggered when the federal expenditures reported on the SEFA exceed $750,000 during the Organization?s year. It is the Organization?s responsibility to prepare a complete and accurate SEFA, which is a key component of the reporting requirements under the Uniform Guidance. Condition: During our audit we noted that the Organization did not prepare the Schedule of Expenditures of Federal Awards for the year ended December 31, 2019. Cause: The Organization was unaware that its federal awards were subject to a Single Audit compliance requirement under the Uniform Guidance. Effect: The Organization did not prepare the Schedule of Expenditures of Federal Awards for the year ended December 31, 2019. Questioned Costs: None Recommendation: We recommend that the Organization prepare the SEFA at the end of each year. The preparation of the SEFA will also be crucial for the Organization in order to determine the single audit requirements for each year. Repeat Finding: This is not a repeat finding. This is the Organization?s first single audit. Views of Responsible Officials and Corrective Action Plan: Since this was NovaSalud Inc.?s first Single Audit, we did not know to file the SEFA. NovaSalud, Inc. agrees with the finding and the recommended procedures and will file the SEFA.

2019-005: Significant Deficiency ? Procurement Policy and Conflict of Interest Disclosure Policy (CFDA No. 93.940, U.S. Department of Health and Human Services, HIV Prevention Activities ? Health Department Based) Criteria: The Organization must follow the procurement standards set out at 2 CFR sections 200.318 through 200.326. The Organization must use their own documented procurement procedures, which reflect applicable state and local laws and regulations, provided that the procurements conform to applicable Federal statutes and the procurement requirements identified in 2 CFR part 200. Additionally, conflict of interest disclosures are essential in identifying potential conflicts that may exist within the Organization. Condition: During our audit we noted that the Organization?s procurement procedures do not meet the standards set out in 2 CFR part 200. Additionally, we noted that the Organization does not require the annual disclosure of potential conflicts of interest by members of the Board of Directors or senior management. Cause: The Organization was unaware of procurement standards identified in 2 CFR part 200, and did not have a policy requiring annual conflict of interest disclosures to be completed on an annual basis. Effect: The Organization did not have a procurement policy that meets federal standards and did not require conflict of interest disclosures to be completed on an annual basis. Questioned Costs: None Recommendation: We recommend that the Organization adopt a procurement policy that meets the standards set out in 2 CFR part 200. We also recommend that the Organization adopt a policy that includes a requirement that conflict of interest disclosures be completed and signed on an annual basis by all members of the Board of Directors as well as members of senior management. Review of the annual certifications should be noted in the board minutes. Repeat Finding: This is not a repeat finding. This is the Organization?s first single audit. Views of Responsible Officials and Corrective Action Plan: NovaSalud agrees with the finding and the recommended procedures have been implemented.