Vanderbilt University Medical CenterNon-Profit

Identification of the Federal Program: U.S. Department of Health and Human Services, Health Resources and Services Administration (HRSA) Federal Agency and Program Name: Maternal and Child Health Federal Consolidated Programs (MCH) Assistance Listing #: 93.110 Award: 5 T73MC30767‐09 Award Year(s): 7/1/2024-6/30/2025 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR 200.303 requires that the non-Federal entity must “(a) establish, document and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under the requirements of the Federal Funding Accountability and Transparency Act (Transparency Act) that are codified in 2 CFR Part 170, “unless the recipient is exempt as provided in paragraph d. of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward”. The recipient must report each subaward described to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the end of the month following the month in which the subaward was issued. Condition: During our audit, we noted 3 Federal Funding Accountability and Transparency Act (FFATA) reports, for the subaward modifications made during fiscal year 2025, were not submitted in the FSRS/SAM.gov timely. Cause: Vanderbilt University Medical Center (VUMC) did not have sufficient internal controls to ensure that the required FFATA reports were submitted timely. Effect or Potential Effect: VUMC did not submit the necessary FFATA reports under the MCH project for each first-tier subaward modifications in FSRS/SAM.gov and consequently was not in compliance with the requirements under the Transparency Act. Questioned Costs: $0 Context: Under the MCH program, there were five subrecipients that had a total of five subaward modifications in FY 2025. The three subaward modifications for which FFATA reports were not submitted timely totaled $33,853. Upon eventual submission, we did not identify any errors in the data reported. Total subrecipient’s costs are $326,025 in FY 2025. The total federal expenditures for the MCH program for FY 2025 were $5,760,179. Identification as a Repeat Finding: This is not a repeat finding. Recommendation: We recommend management strengthen its internal controls and procedures over the review of subrecipient awards and modifications to ensure the required FFATA reports are submitted timely to be in compliance with the Federal Transparency Act. Views of Responsible Officials: Management agrees with the finding and has strengthened our internal controls and procedures to ensure required FFATA reports are submitted timely in compliance with the Federal Transparency Act.

Identification of the Federal Program: Department of Homeland Security Federal Agency and Program Name: COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (FEMA) Assistance Listing #: 97.036 Pass-Through Entity: State of Tennessee Award: All FEMA Projects (Projects 435263, 550461, 684580) Award Year(s): Project 435263: 1/1/2020-7/31/2021 Project 550461: 1/1/2020-7/31/2021 Project 684580: 8/1/2020-6/30/2022 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR 200.303 requires that the non-Federal entity must “(a) establish, document and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control - Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Management did not retain documentation over their review and approval of FEMA expenditures prior to submission in the FEMA Portal. Cause: Management represented that FEMA expenditures were reviewed and approved prior to submission; however, supporting documentation over the review and approval was not maintained. Effect or Potential Effect: Unallowable expenditures could have been charged to the federal program. Questioned Costs: $0. Context: There were three project worksheets obligated in FY2025. Management did not maintain documentation over the review and approval over the expenditures submitted to the FEMA . We selected 40 expenditures charged to FEMA, noting no instances of non-compliance. Total FEMA expenses reported on the SEFA for the year ended June 30, 2025, is $9,857,313. Identification as a Repeat Finding: This is not a repeat finding. Recommendation: We recommend Management ensure that appropriate documentation be retained over the review and approval of FEMA expenditures. Views of Responsible Officials: Management understands that additional audit evidence must be retained at a detailed enough level to allow the auditor to meet their reperformance standard. All expenses claimed were eligible and were reviewed by management prior to the submission. The control issue identified is due to the lack of evidence to support approval. Should management have a future FEMA claim we will retain additional audit evidence to enable auditor reperformance of the controls regarding approval of expenditures.

Information on the Federal Program: Federal Program: HIV - Related Training and Technical Assistance - Aids Education and Training Centers Assistance Listing: 93.145 Federal Agency: U.S. Department of Health and Human Services – Health Resources and Services Administration (HRSA) Grant Award Number: 6 U1OHA30535-08-01 Award Periods: July 1, 2023 through June 30, 2024 Pass-Through Agency: Columbia University Grant Award Number: U1SHA46532 Award Periods: September 1, 2023 through August 31, 2024 Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): 2 CFR 200.303 requires that a non-Federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The Uniform Guidance 2 CFR section 200.510 states, “(b) Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the auditee’s financial statements, which must include the total Federal awards expended as determined in accordance with §200.502, Basis for determining Federal awards expended.” Condition: The Schedule of Expenditures of Federal Awards (the Schedule) did not accurately classify the HIV-Related Training and Technical Assistance – Aids Education and Training Centers program. The final Schedule was corrected for the misclassification.   Cause: The internal control over the SEFA reporting process was not operating effectively to appropriately classify grant awards on the SEFA. Effect or Potential Effect: Management included the HIV-Related Training and Technical Assistance grant (Assistance Listing 93.145) in the amount of $5,642,581 in the Research & Development (R&D) cluster. Questioned Costs: None. Context: Total R&D Cluster expenses included on the draft Schedule was $592,460,606 for the year ended June 30, 2024. Total R&D expenses included on the final Schedule were $586,818,025 for the year ended June 30, 2024. Total expenditures on the SEFA did not change. Identification as a Repeat Finding, if Applicable This is not a repeat finding. Recommendation: We recommend that management implement more robust controls to ensure accurate reporting of federal awards on the SEFA. Management’s Response: Department of Health and Human Services – Health Resources and Services Administration (HRSA) updated the award template utilizing a new federal format. Modification of this federal award template has allowed HRSA to indicate/flag (item 18 in the Notice of Grant Award - R&D “no”) whether the federal program is R&D in a manner not previously recorded or visible. This indicator flag now indicates AETC is non-R&D, therefore, we have reflected it appropriately in the FY24 SEFA. We will strengthen our controls for monitoring the cluster to ensure appropriate classification paying attention to any indications in the Notice of Grant Award.

VUMC did perform a physical inventory during fiscal year 2023, but our documentation did not adequately support the existence of all fixed assets. VUMC will improve the internal controls around our fixed asset physical inventory procedures by ensuring that we document the location and existence of all fixed assets ensuring completeness of the physical inventory performed and allowing for reperformance by our auditors. VUMC will also improve the documentation for disposals ensuring that the required criteria under section 200.313(e) are met and can be evidenced to allow for reperformance by our auditors.

Finding 2022-001 Identification of the federal program: Federal Grantor: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Assistance Listing No.: 93.461, COVID-19 HRSA COVID-19 Claims Reimbursement for the Uninsured Program and the COVID-19 Coverage Assistance Fund Pass-Through Award Period of Performance: 07/01/2021?06/30/2022 Criteria or specific requirement (including statutory, regulatory, or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Health and Human Services (HHS) ? Health Resources and Services and Administrative (HRSA) issued Terms and Conditions for Participation in the HRSA COVID-19 Claims Reimbursement to Health Care Providers and Facilities for Testing, Treatment, and Vaccine Administration for the Uninsured Program (T&Cs) outlining requirements that recipients of funding from the HRSA COVID-19 Uninsured Program must comply with, including the following sections: Testing Services, Treatment Services and Vaccine Administration, and General Provisions in FY2020 Consolidated Appropriations. Per the HRSA T&Cs and further clarified in the HRSA FAQs for COVID-19 Claims Reimbursement to Health Care Providers and Facilities for Testing, Treatment, and Vaccine Administration, the FAQ states the following: ?If a provider tests for COVID-19 as part of pre-operative or other medical treatment unrelated to COVID-19, is the test eligible for reimbursement? For the HRSA COVID-19 Uninsured Program, COVID-19 testing is eligible for reimbursement if one of the following diagnoses codes is included in any position on the claim: ? Z03.818 ? Encounter for observation for suspected exposure to other biological agents ruled out (possible exposure to COVID-19) ? Z11.59 ? Encounter for screening for other viral diseases (asymptomatic) ? Z20.828 ? Contact with and (suspected) exposure to other viral communicable (confirmed exposure to COVID-19) ? Z11.52 ? Encounter for screening for COVID-19 (asymptomatic) ? Z20.822 ? Contact with and (suspected) exposure to COVID-19 ? Z86.16 ? Personal history of COVID-19 Related treatment visits and services are not eligible for reimbursement given the primary reason for treatment is not COVID-19.? Condition: Vanderbilt University Medical Center (VUMC) did not retain audit evidence to support the report logic that was developed to extract patients from the patient billing systems that were identified as having an allowable COVID-19 testing and treatment diagnosis code and eligible for reimbursement under this federal program. In addition, supporting documentation was not retained to validate who had access to modify and run the script, what changes were made to the script and how any changes to the script were tested and implemented during the fiscal year based on changes to HRSA guidance, and how management validated the completeness and accuracy of the data extracted by the script. For certain emergency department, physician office visits, and inpatient claims that included COVID-19 testing, but COVID-19 was not the primary reason for the related treatment visit and services, VUMC erroneously billed the HRSA COVID-19 Uninsured Program for the entire encounter, which was not in compliance with the HRSA COVID-19 Uninsured Program regulations. Cause: Management did not develop and maintain effective internal control over report writing, program changes, and user access. VUMC did not have internal controls in place to ensure claims billed to the HRSA COVID-19 Uninsured Program were in accordance with HRSA Uninsured Program regulations. Effect or potential effect: The key report used to identify eligible federal program participants could be inaccurate or incomplete. VUMC did not have internal controls in place to formally document its compliance with the HRSA COVID 19 Uninsured Program?s allowability and eligibility requirements. Outpatient encounters that included a COVID-19 testing diagnosis code, where the primary treatment diagnosis code was not COVID-19 related, were not reviewed for allowability and eligibility prior to submission to HRSA to verify treatment costs were allowable under the HRSA COVID-19 Uninsured Program. Questioned costs: $336,536 Context: Management performed an analysis over claims submitted to HRSA related to services with dates of service from July 1, 2021 through June 30, 2022, indicating that 1,013 patient accounts totaling $336,536 related to certain claims where COVID-19 was not the primary diagnosis were inappropriately billed to HRSA. The $336,536 was refunded to HRSA in August 2022. Total federal expenditures for Assistance Listing 93.461 totaled $5,809,048 for the year ended June 30, 2022. Identification as a repeat finding, if applicable: 2021-001 Recommendation: The Uninsured Program ended in 2022; therefore, the development of internal controls is not required. However, if the program were to continue, VUMC should implement sufficiently precise internal controls to review changes to the HRSA COVID-19 Uninsured Program to ensure it is administering the program in compliance with the HRSA COVID-19 Uninsured Program regulations. In addition, internal controls should be implemented to ensure claims submitted to the HRSA COVID-19 Uninsured Program meet the allowability criteria established by the HRSA COVID-19 Uninsured Program regulations before claims are submitted to HRSA for reimbursement. VUMC should retain evidence of internal controls related to access and change management over the report. Management should implement a quality review process of eligible claims identified on a monthly basis to ensure that patients identified meet the required eligibility requirements. Views of responsible officials: Management agrees with this finding and performed a review of claims submitted to the HRSA COVID-19 Uninsured Program identifying payments for ineligible services and refunded the entire overpayment amount. In March 2022, HRSA announced the discontinuance of the HRSA COVID-19 Uninsured Program, and therefore, remediation of internal controls is no longer applicable.

Finding 2022-002 Identification of the federal program: Federal Grantor: U.S. Department of Health and Human Services Assistance Listing No.: 93.067, Global AIDS Award Number: 5 NU2 GGH001943-04-00 and 6 NU2 GGH001943-05-00 Award Year: 2021?2022 Criteria or specific requirement (including statutory, regulatory, or other citation): 2 CFR 200.303 requires that a non-federal entity ?must (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282) (Transparency Act) that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements who make first tier subawards of $30,000 or more are required to register in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) and report subaward data through FSRS. Condition: VUMC is a prime recipient of funding from the Centers for Disease Control and Prevention related to the Global AIDS grant and made first tier subawards of greater than $30,000. VUMC filed a single report in FSRS for the total of all its subawards instead of filing a separate report for each subaward. Cause: Policies and procedures and internal controls were not in place to ensure compliance with the Transparency Act. Effect or potential effect: VUMC did not comply with the Transparency Act and report all required information in FSRS. Questioned costs: $0 Context: VUMC made first tier subawards to 22 subrecipients totaling $3,885,454 in federal expenditures. Total Global AIDS expenditures totaled $41,208,584. Subaward reports were not independently reported in the FSRS. Identification as a repeat finding, if applicable: 2021-002 Recommendation: We recommend that VUMC implement internal controls and a review process to ensure that subrecipients are appropriately entered into FSRS. Views of responsible officials: VUMC is a prime recipient of funding from the Centers for Disease Control and Prevention related to the Global AIDS grant and made first tier subawards of greater than $30,000. VUMC reported the subaward from VUMC, the prime, to Friends in Global Health, the subrecipient, as a single report in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) instead of filing a separate report for each subaward. Procedures and internal controls were in place for first tier subawards. VUMC has changed procedures and internal controls to report each Global AIDS subaward separately in FSRS. All subawards have been reported in FY23 in compliance with the Transparency Act.

Finding 2022-003 Identification of the federal program: Federal Grantor: U.S. Department of Health and Human Services (HHS) Health Resources and Services Administration (HRSA) Assistance Listing: 93.498 COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Award Year: 2021?2022 Criteria or specific requirement (including statutory, regulatory, or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: Management did not retain supporting documentation over its review and approval of the lost revenue calculation and expenses reported in the HHS portal. Cause: Management represented it performed a review and approval of the lost revenue calculation, COVID-19 expenses, and HHS portal submission of lost revenue; however, adequate supporting documentation to evidence that the internal controls were sufficiently designed and operating effectively was not maintained. Effect or potential effect: A lack of internal controls over the review of the lost revenue calculation, COVID-19 expenses, and the data submitted in the HHS portal could result in a misstatement of the amounts reported in the HHS portal. Questioned costs: $0 Context: VUMC had two submissions to HRSA during FY22, which included expenses and lost revenue. Total federal expenditures for Assistance Listing No. 93.498 totaled $58,653,058 for the year ended June 30, 2022. Identification as a repeat finding, if applicable: 2021-003 Recommendation: Management should implement internal controls over the review and approval of the data used to calculate lost revenue and expenses and the report of lost revenue in the HHS portal. Views of responsible officials: All expenditures included by VUMC Management (Management) in its submissions in the Department of Health and Human Services (HHS) portal were verified against HHS guidance to ensure allowability. Management understands that additional audit evidence must be retained at a detailed enough level to allow the auditor to meet their reperformance standard. Management believes that our control risk is mitigated by the fact that our lost revenues far exceed any provider relief funding received. However, should management need to report any future eligible expenses in the HHS portal, we will retain additional audit evidence to enable auditor reperformance of the controls regarding allowability of expenditures. Management also established appropriate review and approval controls surrounding the performance and review of the lost revenue analytic and the subsequent reporting of lost revenue in the HHS portal. Management retained documentation to support execution of this control; however, management understands that additional audit evidence supporting the reviews was not available to the auditor to evidence execution of this control. Management will retain additional audit evidence to allow the auditor to reperform execution of this control for future HHS portal submissions.

Finding 2021-001 Identification of the federal program: Federal Grantor: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Assistance Listing No.: 93.461, COVID 19 HRSA COVID 19 Claims Reimbursement for the Uninsured Program and the COVID 19 Coverage Assistance Fund Pass-Through Award Period of Performance: 07/01/2020?06/30/2021 Criteria or specific requirement: Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Health and Human Services (HHS) ? Health Resources and Services and Administrative (HRSA) issued Terms and Conditions for Participation in the HRSA COVID 19 Claims Reimbursement to Health Care Providers and Facilities for Testing, Treatment, and Vaccine Administration for the Uninsured Program (T&Cs) outlining requirements that recipients of funding from the HRSA COVID 19 Uninsured Program must comply with, including the following sections: Testing Services, Treatment Services and Vaccine Administration, and General Provisions in FY2020 Consolidated Appropriations. Per the HRSA T&Cs and further clarified in the HRSA FAQs for COVID 19 Claims Reimbursement to Health Care Providers and Facilities for Testing, Treatment and Vaccine Administration, the FAQ states the following: ?If a provider tests for COVID 19 as part of pre-operative or other medical treatment unrelated to COVID 19, is the test eligible for reimbursement? For the HRSA COVID 19 Uninsured Program, COVID 19 testing is eligible for reimbursement if one of the following diagnoses codes is included in any position on the claim: ? Z03.818 ? Encounter for observation for suspected exposure to other biological agents ruled out (possible exposure to COVID 19) ? Z11.59 ? Encounter for screening for other viral diseases (asymptomatic) ? Z20.828 ? Contact with and (suspected) exposure to other viral communicable (confirmed exposure to COVID 19) ? Z11.52 ? Encounter for screening for COVID 19 (asymptomatic) ? Z20.822 ? Contact with and (suspected) exposure to COVID 19 ? Z86.16 ? Personal history of COVID 19 Related treatment visits and services are not eligible for reimbursement given the primary reason for treatment is not COVID 19.? Condition: Vanderbilt University Medical Center (VUMC) did not retain audit evidence to support the report logic that was developed to extract patients from the patient billing systems that were identified as having an allowable COVID 19 testing and treatment diagnosis code with uninsured eligibility determination and eligible for reimbursement under this federal program. In addition, supporting documentation was not retained to validate who had access to modify and run the script, what changes were made to the script and how any changes to the script were tested and implemented during the fiscal year based on changes to HRSA guidance and how management validated the completeness and accuracy of the data extracted by the script. For certain emergency department, physician office visits and inpatient claims that included COVID 19 testing, but COVID 19 was not the primary reason for the related treatment visit and services, VUMC erroneously billed the HRSA COVID 19 Uninsured Program for the entire encounter, which was not in compliance with the HRSA COVID 19 Uninsured Program regulations. Cause: Management did not develop and maintain effective internal control over report writing, program changes and user access. Additionally, refunds required to be made to the HRSA COVID 19 Uninsured Program were not identified. Effect or potential effect: The key report used to identify eligible federal program participants could be inaccurate or incomplete. VUMC did not have internal controls in place to formally document its compliance with the HRSA COVID 19 Uninsured Program?s allowability requirements. Outpatient encounters that included a COVID 19 testing diagnosis code, where the primary treatment diagnosis code was not COVID 19 related, were not reviewed prior to submission to HRSA to verify treatment costs were allowable under the HRSA COVID 19 Uninsured Program. Questioned costs: $727,234.78 Context: Management performed a full analysis over claims submitted to HRSA related to services with dates of service from January 1, 2021 through December 31, 2021, indicating that 3,840 patient accounts totaling $727,235 related to certain claims that were inappropriately billed to HRSA. The $727,235 was refunded to HRSA during 2022. We sampled 60 claims (totaling $119,773 in federal expenditures) for patient services occurring from January 1, 2021 through December 31, 2021, that were billed to the HRSA COVID 19 Uninsured Program. We noted 13 emergency, physician office, and inpatient claims that were inappropriately billed to HRSA (totaling $5,396 in federal expenditures); these claims were included in the refund to HRSA noted above. Total federal expenditures for Assistance Listing 93.461 totaled $2,990,137 for the year ended June 30, 2021. Identification as a repeat finding, if applicable: Not applicable. Recommendation: VUMC should implement sufficiently precise internal controls to review changes to the HRSA COVID 19 Uninsured Program to ensure it is administering the program in compliance with the HRSA COVID 19 Uninsured Program regulations. In addition, internal controls should be implemented to ensure claims submitted to the HRSA COVID 19 Uninsured Program meet the allowability criteria established by the HRSA COVID 19 Uninsured Program regulations before claims are submitted to HRSA for reimbursement. VUMC should retain evidence of internal controls related to access and change management over the report. Management should implement a quality review process of eligible claims identified on a monthly basis to ensure that patients identified meet the required eligibility requirements. The Uninsured Program ended in 2022; therefore, developing internal controls is not required. Management should review the accounts billed in fiscal 2022 to ensure that the patient accounts billed meet the eligibility requirements of the program. Views of responsible officials: Management agrees with this finding and performed a review of claims submitted to the HRSA COVID 19 Uninsured Program identifying payments for ineligible services and refunded the entire overpayment amount. In March 2022, HRSA announced the discontinuance of the HRSA COVID 19 Uninsured Program and therefore remediation of internal controls is no longer applicable.

Identification of the federal program: Federal Agency: U.S. Department of Health and Human Services Assistance Listing No.: 93.067, Global AIDS Award Number: 6 NU2GGH001943-05-09 Award Year: 2020-2021 Criteria or specific requirement: 2 CFR 200.303 requires that a non-federal entity must (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282) (Transparency Act) that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements who make first tier subawards of $30,000 or more are required to register in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) and report subaward data through FSRS. Condition: VUMC is a prime recipient of funding from the Centers for Disease Control and Prevention related to the Global AIDS grant and made first tier subawards of greater than $30,000. VUMC filed a single report in the FSRS for the total of all its subawards instead of filing a separate report for each subaward. Cause: Policies and procedures and internal controls were not in place to ensure compliance with the Transparency Act. Effect or potential effect: VUMC did not comply with the Transparency Act and report all required information in the FSRS. Questioned costs: $0 Context: VUMC made first tier subawards to 20 subrecipients totaling $3,077,439 in federal expenditures. Total Global AIDS expenditures totaled $26,141,335. Subaward reports were not independently reported in the FSRS. Identification as a repeat finding, if applicable: Not applicable Recommendation: We recommend that VUMC implement a review process and internal controls to ensure that subrecipients are appropriately entered into the FSRS website. VUMC should make the required reporting for its subrecipient in the FSRS website to be compliant with the Transparency Act. Views of responsible officials: VUMC is a prime recipient of funding from The Centers for Disease Control and Prevention related to the Global Aids grant and made first tier subawards of greater than $30,000. VUMC reported the subaward from VUMC, the prime, to Friends in Global Health, the subrecipient as a single report in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) instead of filing a separate report for each subaward. Procedures and internal controls were in place for first tier subawards. VUMC has changed procedures and internal controls to report each Global Aid subaward separately in FSRS. All subawards have been reported in FY23 in compliance with the Transparency Act.

Finding 2021-003 Identification of the federal program: Federal Agency: U.S. Department of Health and Human Services (HHS) Health Resources and Services Administration (HRSA) Assistance Listing No.: 93.498 COVID 19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Award Year: 2020-2021 Criteria or specific requirement: 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: Management did not retain supporting documentation over its review and approval of the lost revenue calculation and expenses reported in the HHS portal. Cause: Management represented they performed a review and approval of the lost revenue calculation, COVID 19 expenses and HHS portal submission of lost revenue; however, adequate supporting documentation to evidence that the internal controls were sufficiently designed and operating effectively was not maintained. Effect or potential effect: A lack of internal controls over the review of the lost revenue calculation, COVID 19 expenses, and the data submitted in the HHS portal could result in a misstatement of the amounts reported in the HHS portal. Questioned costs: $0 Context: VUMC had a single submission to HRSA during FY21, which included expenses and lost revenue. Total federal expenditures for Assistance Listing No. 93.498 totaled $115,447,363 for the year ended June 30, 2021. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should implement internal controls over the review and approval of the data used to calculate lost revenue and expenses and the report of lost revenue on the HHS portal. Views of responsible officials: All expenditures included by VUMC Management (Management) in its submissions in the Department of Health and Human Services (HHS) portal were verified against HHS guidance to ensure allowability. Management understands that additional audit evidence must be retained at a detailed enough level to allow the auditor to meet their reperformance standard. Management believes that our control risk is mitigated by the fact that our lost revenues far exceed any provider relief funding received. However, should management need to report any future eligible expenses in the HHS portal, we will retain additional audit evidence to enable auditor reperformance of the controls regarding allowability of expenditures. Management also established appropriate review and approval controls surrounding the performance and review of the lost revenue analytic and the subsequent reporting of lost revenue in the HHS portal. Management retained documentation to support execution of this control, however, management understands that additional audit evidence supporting the reviews was not available to the auditor to evidence execution of this control. Management will retain additional audit evidence to allow the auditor to reperform execution of this control for future HHS portal submissions.

2020?001 SUSPENSION AND DEBARMENT Federal Program Information: Federal Agency and Program Name Assistance Listing # Global Aids 93.067 Grant Award 5 NU2 GGH001943-04-00 Grant Award 6 NU2 GGH001943-03-10 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? 2 CFR 200.213 states that ?Non-federal entities are subject to the non procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.? Condition: During our testing of 40 transactions, totaling $337,363 for suspension and debarment of the Global Aids program, we noted that for 11 transactions, totaling $20,269, there was a lack of supporting documentation demonstrating that management was monitoring the contractors to ensure they were not suspended or debarred when the purchase was made; this was determined to be a systemic issue. Questioned Costs: $20,269 ? Assistance Listing Number 93.067 - $20,193 related to Grant Award NU2 GGH001943-03-10 and $76 related to Grant Award NU2 GGH001943-04. Context: Total federal expenditures for the Global Aids program were $23,253,711 of which approximately $6.3 million were expenditures subject to suspension and debarment requirements for the year ended June 30, 2020. Cause: Vanderbilt University Medical Center does not have adequately designed internal controls and policies and procedures in place to ensure that contractors are being properly monitored for suspension and debarment. Effect: Vanderbilt University Medical Center is not in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Federal monies may be expended to contractors who are suspended or debarred. Recommendation: We recommend that Vanderbilt University Medical Center implement adequate internal controls and policies and procedures to ensure that all contractors are not suspended or debarred. Views of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.

2019?001 SUSPENSION AND DEBARMENT Federal Program Information: Federal Agency and Program Name CFDA # Research and Development Cluster Special Education Cluster (IDEA) Various 84.027/84.173 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.213 states that ?Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.? Condition: During our testing of 37 transactions for suspension and debarment of the Research and Development Cluster, we noted that for one transaction, for $41, of the 37 transactions tested for $2,061,516, there was a lack of supporting documentation demonstrating that management was monitoring the contractors to ensure they were not suspended or debarred when the purchase was made; this was determined to be a systemic issue. Further, management has internal controls to assess potential suspension and debarment matches it receives from its a third-party servicer who performs suspension and debarment searches for them. However, the internal controls are not precise enough to ensure a resolution has been completed for each match identified. Questioned Costs: N/A Context: Total federal expenditures for Research and Development Cluster were $337,364,315 of which approximately $25.1 million were expenditures subject to suspension and debarment requirements for the year ended June 30, 2019. Total federal expenditures for IDEA Cluster were $3,090,600 of which approximately $0.2 million were subject to suspension and debarment requirements for the year ended June 30, 2019. Management performed an assessment of 100% of the contractors and identified 65 contractors that were not monitored for suspension and debarment at the time of purchase for the year ended June 30, 2019. Cause: Vanderbilt University Medical Center does not have adequately designed internal controls and policies and procedures in place to ensure that contractors are being properly monitored for suspension and debarment. Effect: Vanderbilt University Medical Center is not in compliance with federal statutes, regulations, and the terms of the conditions of the federal award. Federal monies may be expended to contractors who are suspended or debarred. Recommendation: We recommend that Vanderbilt University Medical Center implement adequate internal controls and policies and procedures to ensure that all contractors are not suspended or debarred. In addition, adequate internal controls should be put in place to document the resolution of all suspension and debarment matches identified. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

GSA_MIGRATION