Community Foundation of Northwest Indiana, Inc.Non-Profit

Finding 2024-001 – Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance Identification of the federal program: Federal Grantor: United States Department of Homeland Security Assistance Listing No.: 97.036, COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (FEMA) Pass-Through Grantor: Indiana Department of Homeland Security Pass-Through Award Period: 03/01/2020–05/11/2023 Criteria or specific requirement (including statutory, regulatory, or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Payroll expenses charged to FEMA that related to timecards for employees were not reviewed and approved. Cause: Community Foundation of Northwest Indiana, Inc. and Subsidiaries (CFNI) does not have internal controls in place that require all timecards for employees submitted to a federal program to be reviewed and approved.   Effect or potential effect: Expenses may be charged to the federal award that are not in compliance with the federal or pass-through grant agreement. Questioned costs: None. Context: For three (totaling $1,756) of 40 (totaling $27,583) (8%) payroll transactions sampled during the fiscal year, the employees’ timecards did not have evidence of review and approval by the employees’ manager. Identification as a repeat finding, if applicable: This is not a repeat finding. Recommendation: CFNI should implement internal controls to require the review and approval of all timecards charged to a program funded with federal funds. Views of responsible officials: CFNI acknowledges the finding related to the lack of documented review and approval of all timecards for payroll expenses charged to federally funded programs. In line with industry standards, CFNI prioritizes timely payroll processing and does not delay payroll for outstanding timecard approvals. While this is not a recurring issue and did not result in any questioned costs, CFNI recognizes the importance of ensuring compliance with all federal requirements. To address this finding and prevent recurrence, CFNI is implementing a comprehensive policy that mandates timely review and approval of all timecards associated with payroll expenses charged to federal grants. Additionally, CFNI is establishing a formal process to monitor adherence to this policy, including regular audits and detailed documentation of the review process.

Finding 2024-001 – Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance Identification of the federal program: Federal Grantor: United States Department of Homeland Security Assistance Listing No.: 97.036, COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (FEMA) Pass-Through Grantor: Indiana Department of Homeland Security Pass-Through Award Period: 03/01/2020–05/11/2023 Criteria or specific requirement (including statutory, regulatory, or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Payroll expenses charged to FEMA that related to timecards for employees were not reviewed and approved. Cause: Community Foundation of Northwest Indiana, Inc. and Subsidiaries (CFNI) does not have internal controls in place that require all timecards for employees submitted to a federal program to be reviewed and approved.   Effect or potential effect: Expenses may be charged to the federal award that are not in compliance with the federal or pass-through grant agreement. Questioned costs: None. Context: For three (totaling $1,756) of 40 (totaling $27,583) (8%) payroll transactions sampled during the fiscal year, the employees’ timecards did not have evidence of review and approval by the employees’ manager. Identification as a repeat finding, if applicable: This is not a repeat finding. Recommendation: CFNI should implement internal controls to require the review and approval of all timecards charged to a program funded with federal funds. Views of responsible officials: CFNI acknowledges the finding related to the lack of documented review and approval of all timecards for payroll expenses charged to federally funded programs. In line with industry standards, CFNI prioritizes timely payroll processing and does not delay payroll for outstanding timecard approvals. While this is not a recurring issue and did not result in any questioned costs, CFNI recognizes the importance of ensuring compliance with all federal requirements. To address this finding and prevent recurrence, CFNI is implementing a comprehensive policy that mandates timely review and approval of all timecards associated with payroll expenses charged to federal grants. Additionally, CFNI is establishing a formal process to monitor adherence to this policy, including regular audits and detailed documentation of the review process.

Finding 2024-002 – Procurement, Suspension, and Debarment Identification of the federal program: Federal Grantor: United States Department of Health and Human Services Assistance Listing No.: 93.493, Congressional Directives Federal Award Number: 1 CE1HS52357‐01‐00 Federal Award Period of Performance: 09/30/2023–09/29/2026 Criteria or specific requirement (including statutory, regulatory, or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Procurement policies required by 2 CFR 200.318-326 were not formally documented. Documentation was not consistently retained evidencing the review and approval of new vendors for suspension and debarment prior to adding them into PeopleSoft, CFNI’s vendor management platform. Management represented that they performed a monthly reconciliation of the number of vendors screened and the number of vendors submitted to the third-party, however, management did not retain evidence of the reviews in fiscal year 2024. CFNI’s third-party contractor for suspension and debarment does not have a SOC 1 (System and Organization Controls Report) report that covers the controls over suspension and debarment services provided. Management did not perform testing over the results of the third-party contractor to assess the accuracy of its procedures. Effect or potential effect: Suspension and debarment results provided by the third-party contractor may not be accurate. As a result, federal funds may be used to pay a contractor that is suspended or debarred. Questioned costs: None. Context: For three of 40 new vendors sampled during the fiscal year, the documentation evidencing the review of new vendors for suspension and debarment was not retained. For Assistance Listing No. 93.493, the federal portion of procurement expenditures subject to suspension and debarment review totaled $1,441,622, which represents approximately 61.5% of total federal expenditures of $2,341,797 reported in the SEFA for the year ended June 30, 2024. Identification as a repeat finding, if applicable: This is not a repeat finding from the prior year. Recommendation: CFNI should revise its procurement policies to be in compliance with 2 CFR 200.318-326. CFNI should implement procedures to reperform the testing for a sample of vendors from the third-party suspension and debarment results to ensure the accuracy of the results received. CFNI should formalize the documentation of the reconciliation of the number of vendors screened and the number of vendors submitted to the third-party. CFNI should update its policies and procedures over the new vendor setup process to require supporting documentation related to the suspension and debarment search performed be maintained. Views of responsible officials: The audit identified three instances out of 40 sampled where CFNI did not retain documentation verifying that suspension and debarment reviews were conducted during the onboarding of new suppliers. Although CFNI has an established vetting process, it recognizes the need for consistent documentation to evidence compliance. CFNI will implement formalized procedures to ensure all suspension and debarment reviews are documented and retained for audit purposes. CFNI engages a third-party contractor to monitor its supplier list against suspension and debarment databases. While the vendor provided a SOC 1 report, it did not specifically cover the suspension and debarment services provided. Additionally, CFNI did not conduct testing to validate the accuracy of the third-party's results. CFNI will revise its vendor management practices to ensure the SOC 1 reports cover the relevant services, and it will establish testing procedures to confirm the reliability of the vendor's outputs. Although CFNI utilizes two processes to monitor active suppliers against suspension and debarment lists, no reconciliation was documented to confirm that the supplier lists provided to and received from the third party were complete and accurate. Additionally, no testing was conducted to validate the third party’s work. CFNI will implement a reconciliation process to verify the completeness and accuracy of supplier lists before and after third-party reviews. Furthermore, it will establish a sampling and testing procedure to validate the results provided by external vendors.

Finding 2024-002 – Procurement, Suspension, and Debarment Identification of the federal program: Federal Grantor: United States Department of Health and Human Services Assistance Listing No.: 93.493, Congressional Directives Federal Award Number: 1 CE1HS52357‐01‐00 Federal Award Period of Performance: 09/30/2023–09/29/2026 Criteria or specific requirement (including statutory, regulatory, or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Procurement policies required by 2 CFR 200.318-326 were not formally documented. Documentation was not consistently retained evidencing the review and approval of new vendors for suspension and debarment prior to adding them into PeopleSoft, CFNI’s vendor management platform. Management represented that they performed a monthly reconciliation of the number of vendors screened and the number of vendors submitted to the third-party, however, management did not retain evidence of the reviews in fiscal year 2024. CFNI’s third-party contractor for suspension and debarment does not have a SOC 1 (System and Organization Controls Report) report that covers the controls over suspension and debarment services provided. Management did not perform testing over the results of the third-party contractor to assess the accuracy of its procedures. Effect or potential effect: Suspension and debarment results provided by the third-party contractor may not be accurate. As a result, federal funds may be used to pay a contractor that is suspended or debarred. Questioned costs: None. Context: For three of 40 new vendors sampled during the fiscal year, the documentation evidencing the review of new vendors for suspension and debarment was not retained. For Assistance Listing No. 93.493, the federal portion of procurement expenditures subject to suspension and debarment review totaled $1,441,622, which represents approximately 61.5% of total federal expenditures of $2,341,797 reported in the SEFA for the year ended June 30, 2024. Identification as a repeat finding, if applicable: This is not a repeat finding from the prior year. Recommendation: CFNI should revise its procurement policies to be in compliance with 2 CFR 200.318-326. CFNI should implement procedures to reperform the testing for a sample of vendors from the third-party suspension and debarment results to ensure the accuracy of the results received. CFNI should formalize the documentation of the reconciliation of the number of vendors screened and the number of vendors submitted to the third-party. CFNI should update its policies and procedures over the new vendor setup process to require supporting documentation related to the suspension and debarment search performed be maintained. Views of responsible officials: The audit identified three instances out of 40 sampled where CFNI did not retain documentation verifying that suspension and debarment reviews were conducted during the onboarding of new suppliers. Although CFNI has an established vetting process, it recognizes the need for consistent documentation to evidence compliance. CFNI will implement formalized procedures to ensure all suspension and debarment reviews are documented and retained for audit purposes. CFNI engages a third-party contractor to monitor its supplier list against suspension and debarment databases. While the vendor provided a SOC 1 report, it did not specifically cover the suspension and debarment services provided. Additionally, CFNI did not conduct testing to validate the accuracy of the third-party's results. CFNI will revise its vendor management practices to ensure the SOC 1 reports cover the relevant services, and it will establish testing procedures to confirm the reliability of the vendor's outputs. Although CFNI utilizes two processes to monitor active suppliers against suspension and debarment lists, no reconciliation was documented to confirm that the supplier lists provided to and received from the third party were complete and accurate. Additionally, no testing was conducted to validate the third party’s work. CFNI will implement a reconciliation process to verify the completeness and accuracy of supplier lists before and after third-party reviews. Furthermore, it will establish a sampling and testing procedure to validate the results provided by external vendors.

Finding 2024-001 – Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance Identification of the federal program: Federal Grantor: United States Department of Homeland Security Assistance Listing No.: 97.036, COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (FEMA) Pass-Through Grantor: Indiana Department of Homeland Security Pass-Through Award Period: 03/01/2020–05/11/2023 Criteria or specific requirement (including statutory, regulatory, or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Payroll expenses charged to FEMA that related to timecards for employees were not reviewed and approved. Cause: Community Foundation of Northwest Indiana, Inc. and Subsidiaries (CFNI) does not have internal controls in place that require all timecards for employees submitted to a federal program to be reviewed and approved.   Effect or potential effect: Expenses may be charged to the federal award that are not in compliance with the federal or pass-through grant agreement. Questioned costs: None. Context: For three (totaling $1,756) of 40 (totaling $27,583) (8%) payroll transactions sampled during the fiscal year, the employees’ timecards did not have evidence of review and approval by the employees’ manager. Identification as a repeat finding, if applicable: This is not a repeat finding. Recommendation: CFNI should implement internal controls to require the review and approval of all timecards charged to a program funded with federal funds. Views of responsible officials: CFNI acknowledges the finding related to the lack of documented review and approval of all timecards for payroll expenses charged to federally funded programs. In line with industry standards, CFNI prioritizes timely payroll processing and does not delay payroll for outstanding timecard approvals. While this is not a recurring issue and did not result in any questioned costs, CFNI recognizes the importance of ensuring compliance with all federal requirements. To address this finding and prevent recurrence, CFNI is implementing a comprehensive policy that mandates timely review and approval of all timecards associated with payroll expenses charged to federal grants. Additionally, CFNI is establishing a formal process to monitor adherence to this policy, including regular audits and detailed documentation of the review process.

Finding 2024-001 – Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance Identification of the federal program: Federal Grantor: United States Department of Homeland Security Assistance Listing No.: 97.036, COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (FEMA) Pass-Through Grantor: Indiana Department of Homeland Security Pass-Through Award Period: 03/01/2020–05/11/2023 Criteria or specific requirement (including statutory, regulatory, or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Payroll expenses charged to FEMA that related to timecards for employees were not reviewed and approved. Cause: Community Foundation of Northwest Indiana, Inc. and Subsidiaries (CFNI) does not have internal controls in place that require all timecards for employees submitted to a federal program to be reviewed and approved.   Effect or potential effect: Expenses may be charged to the federal award that are not in compliance with the federal or pass-through grant agreement. Questioned costs: None. Context: For three (totaling $1,756) of 40 (totaling $27,583) (8%) payroll transactions sampled during the fiscal year, the employees’ timecards did not have evidence of review and approval by the employees’ manager. Identification as a repeat finding, if applicable: This is not a repeat finding. Recommendation: CFNI should implement internal controls to require the review and approval of all timecards charged to a program funded with federal funds. Views of responsible officials: CFNI acknowledges the finding related to the lack of documented review and approval of all timecards for payroll expenses charged to federally funded programs. In line with industry standards, CFNI prioritizes timely payroll processing and does not delay payroll for outstanding timecard approvals. While this is not a recurring issue and did not result in any questioned costs, CFNI recognizes the importance of ensuring compliance with all federal requirements. To address this finding and prevent recurrence, CFNI is implementing a comprehensive policy that mandates timely review and approval of all timecards associated with payroll expenses charged to federal grants. Additionally, CFNI is establishing a formal process to monitor adherence to this policy, including regular audits and detailed documentation of the review process.

Finding 2024-002 – Procurement, Suspension, and Debarment Identification of the federal program: Federal Grantor: United States Department of Health and Human Services Assistance Listing No.: 93.493, Congressional Directives Federal Award Number: 1 CE1HS52357‐01‐00 Federal Award Period of Performance: 09/30/2023–09/29/2026 Criteria or specific requirement (including statutory, regulatory, or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Procurement policies required by 2 CFR 200.318-326 were not formally documented. Documentation was not consistently retained evidencing the review and approval of new vendors for suspension and debarment prior to adding them into PeopleSoft, CFNI’s vendor management platform. Management represented that they performed a monthly reconciliation of the number of vendors screened and the number of vendors submitted to the third-party, however, management did not retain evidence of the reviews in fiscal year 2024. CFNI’s third-party contractor for suspension and debarment does not have a SOC 1 (System and Organization Controls Report) report that covers the controls over suspension and debarment services provided. Management did not perform testing over the results of the third-party contractor to assess the accuracy of its procedures. Effect or potential effect: Suspension and debarment results provided by the third-party contractor may not be accurate. As a result, federal funds may be used to pay a contractor that is suspended or debarred. Questioned costs: None. Context: For three of 40 new vendors sampled during the fiscal year, the documentation evidencing the review of new vendors for suspension and debarment was not retained. For Assistance Listing No. 93.493, the federal portion of procurement expenditures subject to suspension and debarment review totaled $1,441,622, which represents approximately 61.5% of total federal expenditures of $2,341,797 reported in the SEFA for the year ended June 30, 2024. Identification as a repeat finding, if applicable: This is not a repeat finding from the prior year. Recommendation: CFNI should revise its procurement policies to be in compliance with 2 CFR 200.318-326. CFNI should implement procedures to reperform the testing for a sample of vendors from the third-party suspension and debarment results to ensure the accuracy of the results received. CFNI should formalize the documentation of the reconciliation of the number of vendors screened and the number of vendors submitted to the third-party. CFNI should update its policies and procedures over the new vendor setup process to require supporting documentation related to the suspension and debarment search performed be maintained. Views of responsible officials: The audit identified three instances out of 40 sampled where CFNI did not retain documentation verifying that suspension and debarment reviews were conducted during the onboarding of new suppliers. Although CFNI has an established vetting process, it recognizes the need for consistent documentation to evidence compliance. CFNI will implement formalized procedures to ensure all suspension and debarment reviews are documented and retained for audit purposes. CFNI engages a third-party contractor to monitor its supplier list against suspension and debarment databases. While the vendor provided a SOC 1 report, it did not specifically cover the suspension and debarment services provided. Additionally, CFNI did not conduct testing to validate the accuracy of the third-party's results. CFNI will revise its vendor management practices to ensure the SOC 1 reports cover the relevant services, and it will establish testing procedures to confirm the reliability of the vendor's outputs. Although CFNI utilizes two processes to monitor active suppliers against suspension and debarment lists, no reconciliation was documented to confirm that the supplier lists provided to and received from the third party were complete and accurate. Additionally, no testing was conducted to validate the third party’s work. CFNI will implement a reconciliation process to verify the completeness and accuracy of supplier lists before and after third-party reviews. Furthermore, it will establish a sampling and testing procedure to validate the results provided by external vendors.

Finding 2024-002 – Procurement, Suspension, and Debarment Identification of the federal program: Federal Grantor: United States Department of Health and Human Services Assistance Listing No.: 93.493, Congressional Directives Federal Award Number: 1 CE1HS52357‐01‐00 Federal Award Period of Performance: 09/30/2023–09/29/2026 Criteria or specific requirement (including statutory, regulatory, or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Procurement policies required by 2 CFR 200.318-326 were not formally documented. Documentation was not consistently retained evidencing the review and approval of new vendors for suspension and debarment prior to adding them into PeopleSoft, CFNI’s vendor management platform. Management represented that they performed a monthly reconciliation of the number of vendors screened and the number of vendors submitted to the third-party, however, management did not retain evidence of the reviews in fiscal year 2024. CFNI’s third-party contractor for suspension and debarment does not have a SOC 1 (System and Organization Controls Report) report that covers the controls over suspension and debarment services provided. Management did not perform testing over the results of the third-party contractor to assess the accuracy of its procedures. Effect or potential effect: Suspension and debarment results provided by the third-party contractor may not be accurate. As a result, federal funds may be used to pay a contractor that is suspended or debarred. Questioned costs: None. Context: For three of 40 new vendors sampled during the fiscal year, the documentation evidencing the review of new vendors for suspension and debarment was not retained. For Assistance Listing No. 93.493, the federal portion of procurement expenditures subject to suspension and debarment review totaled $1,441,622, which represents approximately 61.5% of total federal expenditures of $2,341,797 reported in the SEFA for the year ended June 30, 2024. Identification as a repeat finding, if applicable: This is not a repeat finding from the prior year. Recommendation: CFNI should revise its procurement policies to be in compliance with 2 CFR 200.318-326. CFNI should implement procedures to reperform the testing for a sample of vendors from the third-party suspension and debarment results to ensure the accuracy of the results received. CFNI should formalize the documentation of the reconciliation of the number of vendors screened and the number of vendors submitted to the third-party. CFNI should update its policies and procedures over the new vendor setup process to require supporting documentation related to the suspension and debarment search performed be maintained. Views of responsible officials: The audit identified three instances out of 40 sampled where CFNI did not retain documentation verifying that suspension and debarment reviews were conducted during the onboarding of new suppliers. Although CFNI has an established vetting process, it recognizes the need for consistent documentation to evidence compliance. CFNI will implement formalized procedures to ensure all suspension and debarment reviews are documented and retained for audit purposes. CFNI engages a third-party contractor to monitor its supplier list against suspension and debarment databases. While the vendor provided a SOC 1 report, it did not specifically cover the suspension and debarment services provided. Additionally, CFNI did not conduct testing to validate the accuracy of the third-party's results. CFNI will revise its vendor management practices to ensure the SOC 1 reports cover the relevant services, and it will establish testing procedures to confirm the reliability of the vendor's outputs. Although CFNI utilizes two processes to monitor active suppliers against suspension and debarment lists, no reconciliation was documented to confirm that the supplier lists provided to and received from the third party were complete and accurate. Additionally, no testing was conducted to validate the third party’s work. CFNI will implement a reconciliation process to verify the completeness and accuracy of supplier lists before and after third-party reviews. Furthermore, it will establish a sampling and testing procedure to validate the results provided by external vendors.

Finding 2022-001 ? Reporting Identification of the federal program: Federal Grantor: United States Department of Health and Human Services (HHS), Health Resources and Services Administration (HRSA) Assistance Listing No.: Assistance Listing 93.498, Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution (PRF) Federal Award Numbers: N/A Federal Award Period of Performance: April 10, 2020 ? December 31, 2021 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? The terms and conditions of the award require the recipient to submit reports to the secretary of HHS for each reporting period to ensure compliance with conditions that are imposed on the payment, and such report shall be in such form, with such content that is complete and accurate, as specified by the secretary of HHS in program instructions directed to all recipients. Condition: Management did not have sufficiently designed internal controls to identify material misstatements and evidence review of the supporting documentation used in the lost revenue calculation and the data submitted into the HHS portal for Period 2. Section III ? Federal Award Findings and Questioned Costs (continued) Finding 2022-001 ? Reporting (continued) Cause: Management represented they performed a review and approved the lost revenue calculation and HHS portal submission; however, supporting documentation to evidence that the internal controls were appropriately designed and operating effectively was not maintained. Effect or potential effect: A lack of sufficiently designed internal controls over the review of the lost revenue calculations could lead to errors in the calculations and/or improper conclusions regarding the retention of Provider Relief Funds or errors in the data submitted to HRSA in the HHS portal. Questioned costs: None. Context: There was a total of six PRF lost revenue calculations and HHS portal submissions for the year ended June 30, 2022, all of which were submitted during Period 2. CFNI had no funding during Period 3 and, therefore, had no reporting submissions. We tested 5 PRF lost revenue calculations and HHS portal submissions for the year ended June 30, 2022, making up 94.68% of the FY22 PRF total per the SEFA. One entity, Community Village, Inc. (CVI), understated the Q3 2021 lost revenue within the Period 2 report submission, as there was $354,213 of calculated lost revenue for the quarter per the lost revenue calculation, but the amount that was reported was $0. Total PRF lost revenue on the SEFA is $20,240,401 for the year ended June 30, 2022. Identification as a repeat finding, if applicable: Yes, repeat of finding 2021-001

Finding 2021-001 ? Reporting Identification of the federal program: Federal Grantor: United States Department of Health and Human Services (HHS), Health Resources and Services Administration (HRSA) Assistance Listing No.: Assistance Listing 93.498, Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Federal Award Numbers: N/A Federal Award Period of Performance: April 10, 2020 ? June 30, 2020 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: Management did not have sufficiently designed internal controls to evidence review of the supporting documentation used in the lost revenue calculation and the data submitted into the HHS portal for the reporting period subject to the above period of performance. Cause: Management represented they performed a review and approved the lost revenue calculation and HHS portal submission; however, supporting documentation to evidence that the internal controls were appropriately designed and operating effectively was not maintained. Effect or potential effect: A lack of internal controls over the review of the lost revenue calculations could lead to errors in the calculations and/or improper conclusions regarding the retention of Provider Relief Funds. Additionally, a lack of internal controls over the review of the data submitted to HRSA in the HHS portal could result in a misstatement of the amounts reported in the HHS portal. Questioned costs: None. Context: There was a total of six HHS portal submissions for the year ended June 30, 2021. Total PRF lost revenue on the SEFA is $48,823,018 for the year ended June 30, 2021. Identification as a repeat finding, if applicable: Not applicable. Recommendation: Management should implement internal controls over the review and approval of the lost revenue calculations and HHS portal submissions. Views of responsible officials: Due to the rapid and evolving nature of the COVID-19 pandemic, CFNI Finance management created a working group to evaluate the requirements for CARES Act funding and hired outside consultants to advise and review CFNI?s documentation throughout the process. CFNI utilized outside consultants to assist in navigating the changing guidance as well as the calculation methodologies used. Prior to submission, CFNI Finance had the hospital CFOs and the Sr. VP of Finance and CFO review calculations and methodologies used. The portal submissions were compiled by outside consultants and reviewed and approved by CFNI Finance staff including the Sr. VP of Finance and CFO. However, CFNI did not maintain written documentation of the detailed review and approval process of the underlying lost revenue calculations or approval and sign-off process for the portal submission. Effective September 2022, CFNI Finance will develop a policy and checklist to maintain written documentation over the review and approval process required under current audit standards to improve internal controls.