Avera Health

Department of Justice Federal Financial Assistance Listing #16.582 Crime Victim Assistance Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance Department of Health and Human Services Federal Financial Assistance Listing #93.912 Rural Health Care Services Outreach, Rural Health Network Development and Small Health Care Provider Quality Improvement Activities Allowed and Allowable Costs, Period of Performance Significant Deficiency in Internal Control over Compliance Criteria: 2 CFR 200.303 (a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: Our testing over activities allowed and allowable costs and period of performance identified five employee timecards that were not reviewed and approved by an individual other than the employee. Cause: There was a lapse the internal control process which allowed the employees to approve their own timecards in these instances. Effect: The lack of a secondary review of employee timecards could result in improper expenditures being allocated to the federal award. Questioned Costs: None reported. Context: A non-statistical sample of 48 transactions was selected for testing for program 16.582, which accounted for $159,466 of $529,020 of federal program payroll expenditures. One employee timecard was not reviewed and approved by an individual other than the employee. A non-statistical sample of 60 transactions was selected for testing for program 93.912, which accounted for $109,039 of $1,092,627 of federal program payroll expenditures. four employee timecards were not reviewed and approved by an individual other than the employee. Repeat Finding from Prior Year: No Recommendation: We recommend the Organization review and strengthen the controls surrounding employee timecard approvals to ensure that all timecards are reviewed and approved by an individual other than the employee. Views of Responsible Officials: Management agrees with the finding.

Department of Justice Federal Financial Assistance Listing #16.582 Activities Allowed and Allowable Costs, Period of Performance Significant Deficiency in Internal Control over Compliance Finding Summary: Our testing over activities allowed and allowable costs and period of performance identified five employee timecards that were not reviewed and approved by an individual other than the employee. Responsible Individuals: Jamie Schaefer, John Neth Corrective Action Plan: The organization will review and strengthened the controls surrounding activities allowed and allowable costs as well as period of performance compliance. Avera Health has updated its enterprise resource planning system to Workday, which utilizes an effort certification system. Within the effort certification system, Individuals will self-report/certify their time, the certification will then route to the specific grant management staff instead of the cost center supervisor. Anticipated Completion Date: June 30, 2025

Department of Homeland Security Federal Financial Assistance Listing #97.036 Disaster Grants - Public Assistance (Presidentially Declared Disasters) Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance Criteria: 2 CFR 200.303 (a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: Our testing over activities allowed and allowable costs identified instances where the monthly census data for one of the physical locations included within the calculation of contracted labor related to COVID-19 which includes multiple locations was not able to be agreed directly to monthly census data obtained from the Organization as part of the audit process. Cause: Controls were not in place to ensure that the original monthly census data used in the calculation of contracted labor related to COVID-19 was maintained. Effect: A lack of controls related to the maintenance of the original monthly census data used in the calculation of contracted labor related to COVID-19 resulted in a reasonable possibility that the Organization would not be able to detect and correct noncompliance in a timely manner. Questioned Costs: None reported. Context: A non-statistical sample of eight months out of 36 total months were selected for testing. In four instances, the monthly census data for one location included within the calculation of contracted labor related to COVID-19 which includes multiple locations was not able to be agreed directly to monthly census data obtained from the Organization as part of the audit process. Repeat Finding from Prior Year: No Recommendation: We recommend the Organization review and strengthen the controls surrounding the maintenance of monthly census data used in the calculation of contracted labor related to COVID-19. Views of Responsible Officials: Management agrees with the finding.

Department of Health and Human Services Federal Financial Assistance Listing #97.036 COVID-19 Provider Relief Funds and American Rescue Plan (ARP) Rural Distribution Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance Finding Summary: Our testing over activities allowed and allowable costs identified instances where the monthly census data for one of the physical locations included within the calculation of contracted labor related to COVID-19 which includes multiple locations was not able to be agreed directly to monthly census data obtained from the Organization as part of the audit process. Responsible Individuals: Jamie Schaefer, John Neth Corrective Action Plan: The organization will review and strengthen the controls surrounding activities allowed and allowable costs compliance. Specifically, Avera Health will update its process of using census data reporting in grant projects as the census data is a live data set within the Avera system. For future projects of this nature, the Organization will download a copy of the data set to a calculation support folder so that it has an exact record of the data used in the various grant calculations and the exact data can be referenced later if the live data set changes. Anticipated Completion Date: June 30, 2025

Department of Health and Human Services Federal Financial Assistance Listing #93.697 COVID-19 Testing and Mitigation for Rural Health Clinics Period of Performance Significant Deficiency in Internal Control over Compliance Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance Criteria: 2 CFR 200.303 (a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: Our testing over activities allowed and allowable costs and period of performance identified one expenditure that fell outside of the period of performance under the grant and two expenditures that did not agree to supporting documentation. Cause: There was a lapse in oversight of the internal control process ensuring the expenditures allowed under the grant did not fall outside of the period of performance for the grant and agree to supporting documentation. Effect: The Organization’s control did not detect or correct the errors identified, which resulted in expenditures being allocated to the federal award that were outside of the period of performance and did not agree to supporting documentation. Questioned Costs: None reported. Context: A non-statistical sample of 60 transactions was selected for testing, which accounted for $1,019,224 of $2,100,000 of federal program expenditures. One expenditure was outside of the period of performance and two did not agree to supporting documentation. Repeat Finding from Prior Year: No Recommendation: We recommend the Organization review and strengthen the controls surrounding the expenditures being claimed under the grant and ensuring the expenditures are within the proper period of performance and agree to supporting documentation. Views of Responsible Officials: Management agrees with the finding.

Department of Health and Human Services Federal Financial Assistance Listing #93.697 COVID-19 Testing and Mitigation for Rural Health Clinics Period of Performance Significant Deficiency in Internal Control over Compliance Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance Finding Summary: Our testing over activities allowed and allowable costs and period of performance identified one expenditure that fell outside of the period of performance under the grant and two expenditures that did not agree to supporting documentation. Responsible Individuals: Jamie Schaefer, John Neth Corrective Action Plan: The Organization will review and strengthen the controls surrounding the period of performance and activities allowed and allowable costs. There are no questioned costs related to this finding. The Organization is in the process of implementing a new enterprise resource planning software which will include a grant module. The grant module will have automated controls surrounding Period of performance evaluation and costs will be drillable to ensure cost claimed and supporting documentation are in alignment. Anticipated Completion Date: October 1, 2024

Department of Homeland Security Federal Financial Assistance Listing #97.036 Disaster Grants - Public Assistance Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance Criteria: 2 CFR 200.303 (a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: Our testing over activities allowed and allowable costs identified one instance where the internal control process failed to identify that the grant was charged at a rate of pay higher than the employee’s hourly approved rate of pay. Cause: There was a lapse in oversight of the internal control process ensuring an inaccurate rate of pay for an employee’s time being charged to the grant. Effect: The Organization’s controls did not detect or correct the error identified, which resulted in a reasonable possibility that the Organization could submit disallowed costs under the federal awards and would not be able to detect and correct noncompliance in a timely manner. Questioned Costs: None reported. Context: A non-statistical sample of 34 transactions was selected for testing, which accounted for $3,450,395 of $9,388,052 of federal program expenditures. Repeat Finding from Prior Year: No Recommendation: We recommend the Organization review and strengthen the controls surrounding the expenditures being claimed under the grant to ensure payroll is being accurately charged using the correct rate of pay for employees. Views of Responsible Officials: Management agrees with the finding.

Department of Homeland Security Federal Financial Assistance Listing #97.036 Disaster Grants - Public Assistance Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance Finding Summary: Our testing over activities allowed and allowable costs identified one instance where the internal control process failed to identify that the grant was charged at a rate of pay higher than the employee’s hourly approved rate of pay. Responsible Individuals: Jamie Schaefer, John Neth Corrective Action Plan: The Organization will review and strengthen the controls surrounding activities allowed and allowable costs. There are no questioned costs related to this finding. The Organization is in the process of implementing a new enterprise resource planning software which will include a grant module. The grant module will have automated controls surrounding allocations of personnel costs. Anticipated Completion Date: October 1, 2024

Department of Health and Human Services Federal Financial Assistance Listing #10.331, 93.136, 93.243, 93.279, 93.310, 93.393, 93.837, 93.838, 93.865, and 93.898 Research and Development Cluster Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria: 2 CFR 200.303 (a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: Our testing over activities allowed and allowable costs identified one instance where an employee’s time was not properly allocated between two grants. Additionally, there were four instances where the grant was under/over-charged in our recalculation of payroll and fringe benefits. Cause: The Organization changed the process for physician time in research grants which was initially in place for Medical Directorship payments. The grant team updated to a separate grant workflow which caused for the time to be allocated to the incorrect grant. Effect: The Organization’s controls did not detect or correct the error identified, which resulted in a reasonable possibility that the Organization could submit disallowed costs under the federal awards and would not be able to detect and correct noncompliance in a timely manner. Questioned Costs: $2,126 Context: A non-statistical sample of 60 payroll transactions was selected for testing, which accounted for $152,356 of $3,424,036 of federal program expenditures. Repeat Finding from Prior Year: No Recommendation: We recommend the Organization review and strengthen the controls surrounding the allocation calculation for the research grants. Views of Responsible Officials: Management agrees with the finding.

Department of Health and Human Services Federal Financial Assistance Listing #10.331, 93.136, 93.243, 93.279, 93.310, 93.393, 93.837, 93.838, 93.865, and 93.898 Research and Development Cluster Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance and Noncompliance Finding Summary: Our testing over activities allowed and allowable costs identified one instance where an employee’s time was not properly allocated between two grants. Additionally, there were four instances where the grant was under/over-charged in our recalculation of payroll and fringe benefits. Responsible Individuals: Jamie Schaefer, John Neth Corrective Action Plan: The Organization will review and strengthen the controls surrounding activities allowed and allowable costs. $2,132.52 of questioned costs resulted from one instance where an employee’s time was not properly allocated between two grants through a submission of a personal action form. The Organization has revised its’ workflow surrounding submission of personal action forms related to grant time and related costs allowing for more control and visibility of amounts and grants being allocated to. ($6.26) of questioned costs resulted from four instances combined to an under allocation of employee benefits to a grant. The Organization is in the process of implementing a new enterprise resource planning software which will include a grant module. The grant module will have automated controls surrounding allocations of personnel costs. Anticipated Completion Date: October 1, 2024

Department of Health and Human Services Federal Financial Assistance Listing #93.498 COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance Criteria: 2 CFR 200.303 (a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: Our testing over activities allowed and allowable costs identified four instances where the supporting documentation did not agree with the expenditures claimed in the expenditure listing for the program. Cause: There was a lapse in oversight of the internal control process ensuring the expenditures claimed in the special report to HHS agreed to supporting documentation. Effect: The Organization’s controls did not detect or correct the error identified, which resulted in a reasonable possibility that the Organization could submit disallowed costs under the federal awards and would not be able to detect and correct noncompliance in a timely manner. Questioned Costs: None Reported Context: A non-statistical sample of 60 transactions was selected for testing, which accounted for $7,563,126 of $20,267,798 of federal program expenditures. Repeat Finding from Prior Year: No Recommendation: We recommend the Organization review and strengthen the controls surrounding the expenditure listings used to prepare the special reports submitted to HHS. Views of Responsible Officials: Management agrees with the finding.

Department of Health and Human Services Federal Financial Assistance Listing #93.498 COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance Finding Summary: Our testing over activities allowed and allowable costs identified four instances where the supporting documentation did not agree with the expenditures claimed in the expenditure listing for the program. Responsible Individuals: Jamie Schaefer, John Neth Corrective Action Plan: The Organization will review and strengthen the controls surrounding the period of performance and activities allowed and allowable costs. There are no questioned costs related to this finding. The Organization is in the process of implementing a new enterprise resource planning software which will include a grant module. The grant module will have automated controls surrounding period of performance evaluation and costs will be drillable to ensure cost claimed and supporting documentation exact alignment. Anticipated Completion Date: October 1, 2024

2022-002 Department of Health and Human Services CFDA #93.461 COVID-19 Uninsured COVID Testing and Treatment Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria: 2 CFR 200.303 (a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: Our testing over activities allowed and allowable costs identified three instances in which patient treatment charges were charged under federal award and COVID-19 was not the primary diagnosis. Cause: There was a lapse in oversight of the internal control process ensuring patient treatment costs without a COVID-19 primary diagnosis were not charged to the federal award. Effect: The Organization?s controls did not detect or correct the errors identified, which resulted in disallowed costs being submitted under the federal award. Questioned Costs: $264 Context: A non-statistical sample of 60 transactions was selected for testing, which accounted for $29,916 of $4,184,833 of federal program expenditures. Repeat Finding from Prior Year: Yes Recommendation: We recommend the Organization review and strengthen the controls surrounding the patient eligibility and billing. Views of Responsible Officials: Management agrees with the finding.

Finding 2022-002 Department of Health and Human Services CFDA #93.461 COVID-19 Uninsured COVID Testing and Treatment Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance and Noncompliance Finding Summary: Our testing over activities allowed and allowable costs identified three instances in which patient treatment charges were charged under federal award and COVID-19 was not the primary diagnosis. Responsible Individuals: Mary Wickersham, Amanda Schutz Corrective Action Plan: The Organization will review and strengthen the controls surrounding evaluation of diagnosis codes to include ?Z diagnosis codes? prior to the submission of claims. The Organization has since issued refunds to the federal agency related to the instances noted in the finding. Anticipated Completion Date: June 30, 2023

2021-003

2021-002 Department of Health and Human Services CFDA #93.498 COVID-19 Provider Relief Fund and American Rescue Plan Rural Distribution Applicable Federal Award Number and Year ? Period 1 Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance and Noncompliance Reporting Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria: 2 CFR 200.303 (a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: As a result of our activities allowed and allowable costs testing, we identified two payments to individuals in excess of the salary cap limitation set forth by the federal government. The errors were not detected and corrected by the internal controls in place. The Organization?s special report submitted to the Department of Health and Human Services for Period 1 included expenses above and beyond the salary cap limitation. Cause: The Organization implemented controls over the salary cap limitation; however, there were instances where the controls in place did not detect and correct errors on the tracking spreadsheet or special report submitted to the Department of Health and Human Services. Effect: The Organization?s controls did not detect or correct the error, which results in a reasonable possibility that the Organization could submit costs above the salary cap limitation under the federal awards and would not be able to detect and correct noncompliance in a timely manner. Questioned Costs: None reported. The Organization has enough additional lost revenue to cover the $108,825 of costs in question. Context: Detail and summary level testing was performed over eligible expenditures for activities allowed and unallowable and allowable costs/cost principles. A non-statistical sample of 60 transactions was selected for testing, which accounted for $7,661,178 of $76,008,680 of federal program expenditures sampled. Key line items were tested on the Period 1 Department of Health and Human Services special reports. Repeat Finding from Prior Year: No. Recommendation: We recommend the Organization review and strengthen the controls surrounding the review and approval of allowable costs. Views of Responsible Officials: Management agrees with the finding.

Finding 2021-002 Department of Health and Human Services CFDA #43.498 COVID-19 Provider Relief Fund and American Rescue Plan Rural Distribution Applicable Federal Award Number and Year ? Period 1 Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance and Noncompliance Finding Summary: As a result of our activities allowed and allowable costs testing, we identified two payments to individuals in excess of the salary cap limitation set forth by the federal government. The errors were not detected and corrected by the internal controls in place. The Organization?s special report submitted to the Department of Health and Human Services for Period 1 included expenses above and beyond the salary cap limitation. Responsible Individuals: Jamie Schaefer Corrective Action Plan: The Organization will review and strengthen the controls surrounding the review and approval of allowable costs to include an evaluation of compensation by individual to ensure costs are below the salary cap limitation. Anticipated Completion Date: December 31, 2022

2021-003 Department of Health and Human Services CFDA #93.461 COVID-19 Uninsured COVID Testing and Treatment Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria: 2 CFR 200.303 (a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: Our testing over activities allowed and allowable costs identified two instances in which patient treatment charges were charged under federal award and COVID-19 was not the primary diagnosis. Cause: There was a lapse in oversight of the internal control process ensuring patient treatment costs without a COVID-19 primary diagnosis were not charged to the federal award. Effect: The Organization?s controls did not detect or correct the errors identified, which resulted in disallowed costs being submitted under the federal award. Questioned Costs: $5,671 Context: A non-statistical sample of 60 transactions was selected for testing, which accounted for $126,905 of $3,994,776 of federal program expenditures. Repeat Finding from Prior Year: No. Recommendation: We recommend the Organization review and strengthen the controls surrounding the patient eligibility and billing. Views of Responsible Officials: Management agrees with the finding

Finding 2021-003 Department of Health and Human Services CFDA #93.461 COVID-19 Uninsured COVID Testing and Treatment Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance and Noncompliance Finding Summary: Our testing over activities allowed and allowable costs identified two instances in which patient treatment charges were charged under federal award and COVID-19 was not the primary diagnosis. Responsible Individuals: Mary Wickersham, Amanda Schutz Corrective Action Plan: The Organization will review and strengthen the controls surrounding evaluation of diagnosis prior to the submission of claims. The Organization has since issued a refunds to the federal agency related to the instance noted in the finding. Anticipated Completion Date: December 31, 2022

2020-002 Department of Health and Human Services CFDA #93.211, G25RH32402, 09/30/2018 ? 09/29/2019 CFDA #93.211, H2ARH30287, 09/01/2018 ? 08/31/2019 Telehealth Programs Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance Criteria: The Organization is required to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the Organization is managing the federal awards in compliance with Subpart E ? Cost Principles of the Uniform Guidance and terms and conditions of the federal awards; are supported by appropriate documentation; and are charged correctly as to account, amount, and period. Condition: As a result of our disbursements testing, we identified one instance where a reimbursement was erroneously missed in a transfer to the grant cost center resulting in the program being under charged and the error was not detected nor corrected by the internal controls in place. We identified one instance where sales and use tax was added to a subrecipient expenditure for personnel costs in error. The error was not detected and corrected by the internal controls in place. Cause: The Organization implemented controls over subrecipient payments and other expenditures; however, there were instances where the controls in place did not detect and correct errors. Effect: The Organization?s controls did not detect or correct the error, which results in a reasonable possibility that the Organization could submit disallowed costs under the federal awards and would not be able to detect and correct noncompliance in a timely manner. Questioned Costs: None reported. Context: A non-statistical sample of 89 of 785 payroll, nonpayroll, and subrecipient disbursement transactions was selected for testing, which accounted for $237,613 of $737,509 of federal program expenditures. Sampling was not used for indirect costs tested totaling $107,321. Repeat Finding from Prior Year: No. Recommendation: We recommend the Organization review and strengthen the controls surrounding the review and approval of allowable costs. Views of Responsible Officials: Management agrees with the finding.

Finding 2020-002 Department of Health and Human Services CFDA #93.211, G25RH32402, 09/30/2018 ? 09/29/2019 CFDA #93.211, H2ARH30287, 09/01/2018 ? 08/31/2019 Telehealth Programs Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance Finding Summary: Responsible Individuals: Corrective Action Plan: As a result of our disbursements testing, we identified one instance where a reimbursement was erroneously missed in a transfer to the grant cost center resulting in the program being under charged and the error was not detected nor corrected by the internal controls in place. We identified one instance where sales and use tax was added to a subrecipient expenditure for personnel costs in error. The error was not detected and corrected by the internal controls in place. Rachael Sherard, John Neth The Organization will review and strengthen the controls surrounding the review and approval of allowable costs to include a section in the compliance checklist that specifically identifies transfers. Anticipated Completion Date: June 30, 2021

2020-006 Department of Health and Human Services CFDA #93.393, 1R01CA240080-01, 09/01/2019 ? 08/31/2020 Research and Development Cluster Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance Criteria: The Organization is required to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the Organization is managing the federal awards in compliance with Subpart E ? Cost Principles of the Uniform Guidance and terms and conditions of the federal awards; are supported by appropriate documentation; and are charged correctly as to account, amount, and period. Condition: Through payroll testing performed, we identified one instance where the auditee did not properly allocate an employee?s time between two grants. Cause: The employee changed home cost centers halfway through the pay period. As such, rather than updating the time to be allocated to the new cost center, the time was allocated all to one grant. Effect: The Organization?s controls did not detect or correct the error identified, which resulted in a reasonable possibility that the Organization could submit disallowed costs under the federal awards and would not be able to detect and correct noncompliance in a timely manner. Questioned Costs: None reported. Context: A non-statistical sample of 60 of 1,254 payroll disbursement transactions was selected for testing. Repeat Finding from Prior Year: No. Recommendation: We recommend the Organization implement procedures and control processes to comply with the federal requirements. Views of Responsible Officials: Management agrees with the finding.

Finding 2020-006 Department of Health and Human Services CFDA #93.393, 1R01CA240080-01, 09/01/2019 ? 08/31/2020 Research and Development Cluster Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance Finding Summary: Through payroll testing performed, we identified one instance where the auditee did not properly allocate an employee?s time between two grants. Responsible Individuals: Rachael Sherard, John Neth Corrective Action Plan: The Organization implement procedures and control processes to comply with the federal requirements. Anticipated Completion Date: June 30, 2021

2019-002 Department of Health and Human Services CFDA #93.307, WFA-191862-02, 04/01/2018 ? 03/31/2019 Research and Development Cluster Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance Criteria: The Organization is required to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the Organization is managing the federal awards in compliance with Subpart E ? Cost Principles of the Uniform Guidance and terms and conditions of the federal awards; are supported by appropriate documentation; and are charged correctly as to account, amount, and period. Condition: As a result of our disbursements testing, we identified one instance where personnel costs for a contracted employee were overcharged to the program by an insignificant amount due to a calculation error. Cause: The Organization implemented controls over contracted employee personnel costs charged to the program; however, there was one instance where a calculation error in a reconciliation resulted in the program being charged an incorrect amount for the services provided. Effect: The Organization?s controls did not detect or correct the error, which results in a reasonable possibility that the Organization could submit disallowed costs under the federal awards and would not be able to detect and correct noncompliance in a timely manner. Questioned Costs: None reported. Context: A non-statistical sample of 120 of 1,895 payroll and nonpayroll disbursement transactions was selected for testing, which accounted for $170,344 of $1,883,546 of federal program expenditures. Sampling was not used for subrecipient payments and indirect costs tested totaling $1,838,561. Repeat Finding from Prior Year: No. Recommendation: We recommend the Organization review and strengthen the controls surrounding the review and approval of allowable costs. Views of Responsible Officials: Management agrees with the finding.

Finding 2019-002 Department of Health and Human Services CFDA # 93.307, WFA-191862-02, 04/01/2018 ? 03/31/2019 Research and Development Cluster Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance Finding Summary: As a result of our disbursements testing, we identified one instance where personnel costs for a contracted employee were overcharged to the program by an insignificant amount due to a calculation error. Responsible Individuals: Jim Breckenridge, Rachael Sherard, John Neth Corrective Action Plan: The Organization will review and strengthen the controls surrounding the review and approval of allowable costs. Anticipated Completion Date: December 31, 2019

2019-003 Department of Health and Human Services CFDA #93.211, G01RH32150, 09/01/2018 ? 08/31/2019 CFDA #93.211, G25RH32402, 09/30/2018 ? 09/29/2019 CFDA #93.211, H1WRH31446, 09/30/2017 ? 08/31/2018, 09/01/2018 ? 08/31/2019 CFDA #93.211, H2ARH30287, 09/01/2018 ? 08/31/2019 Telehealth Programs Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance Criteria: The Organization is required to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the Organization is managing the federal awards in compliance with Subpart E ? Cost Principles of the Uniform Guidance and terms and conditions of the federal awards; are supported by appropriate documentation; and are charged correctly as to account, amount, and period. Condition: As a result of our disbursements testing, we identified the following: 1) There were three instances where a timecard was not approved by the individual?s supervisor and payroll costs were charged to the program. 2) There were three instances where a time card was not approved by an individual other than the employee. 3) There were two instances where expenditures charged to the program did not agree with amounts supported by the employee expense reimbursement documentation. 4) There was one instance where use tax related to a different cost center was charged to the program. 5) There was one instance where documentation retained to support an expense reimbursement was not readable due to a scanning error and original documentation was not retained to support a portion of the expense reimbursement. In addition, the full expense reimbursement was charged to the program twice. Cause: The Organization implemented manual as well as automated controls over review and approval of employee time cards. If the supervisor does not approve the time cards by the payroll system approval deadline, the timecards are reviewed through payroll system automated controls, if no critical exceptions are found, the timecards are then processed by payroll. There were three instances where an employee approved her own timecard as the supervisor. The Organization implemented controls over review and approval of expense reimbursements, but the review process did not detect the inconsistencies in the supported amounts and the amounts charged or duplicate amounts charged. The Organization implemented controls over expenditures charged to the program but the control did not detect or correct the use tax being charged to the program in error. Effect: The Organization?s controls did not detect or correct the errors identified, which results in a reasonable possibility that the Organization could submit disallowed costs under the federal awards and would not be able to detect and correct noncompliance in a timely manner. Questioned Costs: Questioned costs were insignificant. Context: A non-statistical sample of 124 of 1,098 payroll, nonpayroll, and subrecipient disbursement transactions was selected for testing, which accounted for $178,367 of $991,469 of federal program expenditures. Sampling was not used for indirect costs tested totaling $130,917. Repeat Finding from Prior Year: No. Recommendation: We recommend the Organization review and strengthen the controls surrounding the review and approval of allowable costs. Views of Responsible Officials: Management agrees with the finding.

Finding 2019-003 Department of Health and Human Services CFDA # 93.211, G01RH32150, 09/01/2018 - 08/31/2019 CFDA #93.211, G25RH32402, 09/30/2018 - 09/29/2019 CFDA #93.211, H1WRH31446, 09/30/2017 - 08/31/2018, 09/01/2018 - 08/31/2019 CFDA #93.211, H2ARH30287, 09/01/2018 - 08/31/2019 Telehealth Programs Activities Allowed and Allowable Costs Significant Deficiency in Internal Control over Compliance Finding Summary: As a result of our disbursements testing, we identified the following: 1) There were three instances where a timecard was not approved by the individual?s supervisor and payroll costs were charged to the program. 2) There were three instances where a time card was not approved by an individual other than the employee. 3) There were two instances where expenditures charged to the program did not agree with amounts supported by the employee expense reimbursement documentation. 4) There was one instance where use tax related to a different cost center was charged to the program. 5) There was one instance where documentation retained to support an expense reimbursement was not readable due to a scanning error and original documentation was not retained to support a portion of the expense reimbursement. In addition, the full expense reimbursement was charged to the program twice. Responsible Individuals: Jim Breckenridge, Rachael Sherard, John Neth Corrective Action Plan: The Organization will review and strengthen the controls surrounding the review and approval of allowable costs. Anticipated Completion Date: December 31, 2019

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION