Gundersen Health System

Finding 2020-001 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Effort Reporting) Information on the federal program: U.S. Department of Health and Human Services Pass-Through Entity: Marshfield Clinic Research Institute U.S. Department of Defense Research and Development (R&D) Cluster CFDA Nos.: 93.310, 93.395 and 93.399 Award Years: Various Award Nos.: Various Criteria or specific requirement (including statutory, regulatory, or other citation): The Uniform Guidance 2 CFR section 200.303 states, ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Sections I.2.g(2) and (3) of 45 CFR Part 75, Appendix IX, Principles for Determining Costs Applicable to Research and Development Under Grants and Contracts with Hospitals (Hospital Cost Principles), state: ?(2) Payroll Distribution Amounts charged to organized research for personal services, regardless of whether treated as direct costs or allocated as indirect costs, will be based on hospital payrolls which have been approved and documented in accordance with generally accepted hospital practices. In order to develop necessary direct and indirect allocations of cost, supplementary data on time or effort as provided in paragraph (3) below, normally need be required only for individuals whose compensation is properly chargeable to two or more research agreements or to two or more of the following broad functional categories: (i) Patient care; (ii) organized research; (iii) instruction and training; (iv) indirect activities as defined in paragraph E.1.; or (v) other hospital activities as defined in paragraph B.5. (3) Reporting Time or Effort Charges for salaries and wages of individuals other than members of the professional staff will be supported by daily time and attendance and payroll distribution records. For members of the professional staff, current and reasonable estimates of the percentage distribution of their total effort may be used as support in the absence of actual time records. The term professional staff for purposes of this section includes physicians, research associates, and other personnel performing work at responsible levels of activities. These personnel normally fulfill duties, the competent performance of which usually requires persons possessing degrees from accredited institutions of higher learning and/or state licensure. In order to qualify as current and reasonable, estimates must be made no later than one month (though not necessarily a calendar month) after the month in which the services were performed.? Condition: For certain professional staff, effort reports supporting payroll expenditures charged to the R&D Cluster were not certified monthly in accordance with Hospital Cost Principles. Additionally, the review and approval of effort reports by an individual knowledgeable of the professional staff activities was not performed on a timely basis. We further noted, for one employee who charged his time between a federal and nonfederal research grant, effort reports were not prepared during the fiscal year as required by Hospital Cost Principles. Cause: Although Gundersen Health System has designed internal controls over effort reporting, including an effort reporting form that is required to be submitted to Accounting by the second business day after month-end, submission of certified effort reports was not monitored to ensure they were submitted timely. Questioned costs: $16,890 (Assistance Listing 93.310 ? $6,238; Assistance Listing 93.395 ? $2,936; Assistance Listing 93.399 ? $7,716) Context: We selected 40 payroll transactions (totaling $171,987 in salaries/wages and benefits) for testing of allowability of payroll expenditures related to the R&D Cluster major program. Of these payroll transactions, eight payroll transactions (totaling $16,890 in salaries/wages and benefits) had exceptions as follows: ? Five payroll transactions had an associated monthly effort report that was not certified within one month after the month in which the services were performed. Certification was completed between four months and nine months after the month for which the effort report covered. ? Three payroll transactions related to the same employee did not have an effort report. Total personnel costs for the R&D Cluster are $1,049,395, representing 65% of the total R&D Cluster expenditures of $1,625,797 for the year ended December 31, 2020. Effect or potential effect: Payroll and benefit expenses were charged to the R&D Cluster that were not supported by monthly effort reports. Identification as a repeat finding, if applicable: This is a repeat finding. Recommendation: Gundersen Health System should review its internal controls over effort reporting and strengthen existing procedures over the preparation and timely certification of effort reports to support the allowability of expenditures to comply with the federal allowable costs/cost principles compliance requirement. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2020-002 ? Internal Controls Over Testing for the Uninsured Identification of the federal program: Assistance Listing: 93.461 Program Name: COVID-19 Testing, Treatment and Vaccination for the Uninsured Program (Uninsured Program) Federal Agency: Department of Health and Human Services Criteria or specific requirement (including statutory, regulatory, or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: Gundersen did not retain audit evidence to support the report logic that was developed to identify patients from the patient billing system who were identified as uninsured and as having an allowable COVID-19 testing and treatment or vaccination in accordance with the terms of the federal program. A risk exists that the data relevant to the COVID-19 Uninsured Program stored within the patient accounting system may be inappropriately created or modified. Evidence of the operation of controls identified to address this risk during the fiscal period under audit was not retained. In addition, supporting documentation was not retained to validate who had access to modify the report script, what changes were made to the script during the fiscal year, and how management validated the completeness and accuracy of the data extracted by the script. Cause: Management did not retain sufficient supporting documentation to provide evidence that controls over data integrity for this major program were designed effectively and placed in operation during the period under audit. Effect or potential effect: Evidence of controls addressing the risk that data within the patient accounting system may be inappropriately created or modified was not retained. The report used to identify eligible federal program participants could be inaccurate or incomplete or patients could be inappropriately identified as eligible, services could be reimbursed by HRSA for unallowable charges, or patients could be inappropriately billed for services that HRSA reimbursed under this program. Questioned costs: None. Context: Total federal expenditures for Assistance Listing 93.461 totaled $450,815 for the year ended December 31, 2020. Identification as a repeat finding, if applicable: The is not a repeat finding. Recommendation: Management should retain documentation of the operation of controls responsive to risks related to the data stored in its IT systems as evidence of control activities. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Finding 2019-001 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Effort Reporting) Information on the Federal Program: U.S. Department of Health and Human Services Pass-Through Entity: Marshfield Clinic Research Institute U.S. Department of Defense Research and Development (R&D) Cluster CFDA Nos.: 12.420, 93.310 and 93.395 Award Years: Various Award Nos.: Various Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): The Uniform Guidance 2 CFR section 200.303 states, ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Sections I.2.g(2) and (3) of 45 CFR Part 75, Appendix IX, Principles for Determining Costs Applicable to Research and Development Under Grants and Contracts with Hospitals (Hospital Cost Principles), state: (2) Payroll Distribution Amounts charged to organized research for personal services, regardless of whether treated as direct costs or allocated as indirect costs, will be based on hospital payrolls which have been approved and documented in accordance with generally accepted hospital practices. In order to develop necessary direct and indirect allocations of cost, supplementary data on time or effort as provided in paragraph (3) below, normally need be required only for individuals whose compensation is properly chargeable to two or more research agreements or to two or more of the following broad functional categories: (i) Patient care; (ii) organized research; (iii) instruction and training; (iv) indirect activities as defined in paragraph E.1.; or (v) other hospital activities as defined in paragraph B.5. (3) Reporting Time or Effort Charges for salaries and wages of individuals other than members of the professional staff will be supported by daily time and attendance and payroll distribution records. For members of the professional staff, current and reasonable estimates of the percentage distribution of their total effort may be used as support in the absence of actual time records. The term professional staff for purposes of this section includes physicians, research associates, and other personnel performing work at responsible levels of activities. These personnel normally fulfill duties, the competent performance of which usually requires persons possessing degrees from accredited institutions of higher learning and/or state licensure. In order to qualify as current and reasonable, estimates must be made no later than one month (though not necessarily a calendar month) after the month in which the services were performed.? Condition: For certain professional staff, effort reports supporting payroll expenditures charged to the R&D Cluster were not certified monthly in accordance with Hospital Cost Principles. Additionally, the review and approval of effort reports by an individual knowledgeable of the professional staff activities was not performed on a timely basis. We further noted, for one employee that charged his time between a federal and nonfederal research grant, effort reports were not prepared during the fiscal year as required by Hospital Cost Principles. Cause: Although Gundersen Health System has designed internal controls over effort reporting including, an effort reporting form that is required to be submitted to Accounting by the second business day after month-end, submission of certified effort reports was not monitored to ensure they were submitted timely. Questioned Costs: $17,924 (CFDA No. 12.420 ? $8,053; CFDA No. 93.310 ? $8,050; CFDA No. 93.395 ? $1,821) Context: We selected 40 payroll transactions (totaling $121,929 in salaries/wages and benefits) for testing of allowability of payroll expenditures related to the R&D Cluster major program. Of these payroll transactions, eight payroll transactions (totaling $17,924 in salaries/wages and benefits) had exceptions as follows: ? Six payroll transactions had an associated monthly effort report that was not certified within one month after the month in which the services were performed. Certification were completed between four months and nine months after the month for which the effort report covered. ? Two payroll transactions related to the same employee did not have an effort report prepared. Total personnel costs for the R&D Cluster was $741,569, representing 73% of total R&D Cluster expenditures of $1,011,961 for the year ended December 31, 2019. Effect or Potential Effect: Payroll and benefit expenses were charged to the R&D Cluster that was not supported by monthly effort reports. Identification as a repeat finding, if applicable: This is not a repeat finding. Recommendation: Gundersen Health System should review its internal controls over effort reporting and strengthen existing procedures over the preparation and timely certification of effort reports to support the allowability of expenditures to comply with the federal allowable costs/cost principles compliance requirement. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.