Virginia Commonwealth University Health System AuthorityState Government

Identification of the Federal Program: Federal Agency and Program Name Assistance Listing # COVID-19 – Disaster Grants – Public Assistance (Presidentially Declared Disasters) (FEMA) U.S. Department of Homeland Security Pass through grantor: Virginia Department of Emergency Management Pass through award number: 4512DR-VA Award Period: 1/21/2020 – 6/30/2022 97.036 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR 200.303 requires that a non-Federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 2 CFR 200.403(h) states: “Administrative closeout costs may be incurred until the due date of the final report(s). If incurred, these costs must be liquidated prior to the due date of the final report(s) and charged to the final budget period of the award unless otherwise specified by the Federal agency. All other costs must be incurred during the approved budget period. At its discretion, the Federal agency is authorized to waive prior written approvals to carry forward unobligated balances to subsequent budget periods. See § 200.308(g)(3).” Condition: The Authority did not validate the accuracy of the cost incurred dates and identify expenditures that were incurred outside of the period of performance related to assistance listing 97.036 – COVID-19 – Disaster Grants – Public Assistances (Presidentially Declared Disasters) (FEMA) prior to submission of the non-federal entity’s project worksheet. Cause: The Authority did not have sufficient internal controls to ensure that accuracy of the cost incurred dates or expenditures were incurred within the period of performance prior to submission of the non-federal entity’s project worksheet. Effect or Potential Effect: The Authority may inappropriately obtain funding for unallowable expenses or costs incurred outside the period of performance as a result of the reporting and verification of the completeness and accuracy of the cost incurred dates and expenditures included within the submission was not sufficient. Questioned Costs: $104,434 – represents the total payroll expenditures incurred after the end of the period of performance. Context: We identified $104,434 of payroll expenditures included in the submission of two force labor FEMA projects, resulting in duplicate costs being submitted to FEMA. The $104,434 was incorrectly included in the project that ended June 30, 2022 and was appropriately included in the project that began July 1, 2022. The costs in question are the payroll expenses from the second week of the pay period (June 26, 2022 through July 9, 2022) incurred after the end of the period of performance. The total obligation of the project worksheet that had the duplicate costs was $2,278,390. Management corrected the duplicated amount of the federal expenditures reported on the Schedule, in which total FEMA expenditures are $31,901,782 for the year ended June 30, 2025. The duplicate costs represent 4.6% of the related project and approximately 0.3% of total FEMA expenditures for the fiscal year. Identification as a Repeat Finding: This is not a repeat finding. Recommendation: The Authority’s policy and procedures should be designed to strengthen the internal controls over the review of the submissions to ensure accurate reporting as required by the Uniform Guidance. Views of Responsible Officials: There is no disagreement with the audit finding and the Authority has developed a plan to correct the finding.

Criteria: In accordance with Title 2 U.S. Code of Federal Regulations, Part 200.303, Internal controls, “Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition: The Authority had not finalized the Schedule of Expenditures of Federal Awards (the Schedule) for the year ended June 30, 2023 in a timely manner. Cause: The Schedule for the year ended June 30, 2023 included a number of COVID-19 programs. Various individuals in the Authority were involved and responsible for monitoring the terms and conditions of the federal awards and reporting of the federal expenditures. COVID-19 also impacted a number of resources within the Authority causing various constraints. Management continued to enhance procedures related to preparation and assessment of the Schedule. Effect or potential effect: The reporting and verification of the completeness and accuracy of the expenditures required more time than expected due to the COVID-19 nature of the funds. Questioned Costs: None. Identification of a repeat finding: This is a repeat finding of Finding 2022-001 in the prior year. Context: The audit was not completed and the reporting submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period as required by the Uniform Guidance. Recommendation: The Authority’s policy and procedures should be designed to ensure timely reporting as required by the Uniform Guidance. View of responsible officials: There is no disagreement with the audit finding.

Criteria: In accordance with Title 2 U.S. Code of Federal Regulations, Part 200.303, Internal controls, “Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” The terms and conditions of the award require the recipient to submit reports to the secretary of Health and Human Services (HHS) for each reporting period to ensure compliance with conditions that are imposed on the payment, and such report shall be in such form, with such content, as specified by the secretary of HHS in program instructions directed to all recipients. Condition: Management did not have sufficiently designed internal controls to review the supporting documentation used in the lost revenue calculation and the data submitted in the HHS portal. The amount of the revenue reported to Health Resources and Services Administration (HRSA) in the HHS portal for Periods 1 through 5 did not agree to the amounts recorded in the general ledger, resulting in the Period 4 and 5 reports to have incorrect cumulative revenues for July 1, 2022 to June 30, 2023. Cause: The Authority did not retain sufficient appropriate evidence of review and approval of amounts quantified as lost revenues attributable to COVID-19 that have not been reimbursed from other sources or that other sources are not obligated to reimburse. Management entered the incorrect information into the HHS portal. Management’s internal controls over the review and approval of the HHS portal data was not sufficiently robust to identify data input errors. Effect or potential effect: A lack of internal controls over the review of the lost revenue calculation submitted in the HHS portal could results in a misstatement of the amounts reported in the HHS portal. Potential effects include inappropriate amounts of lost revenue quantified that could impact the complete and accurate reporting of such amounts submitted to HRSA’s PRF Reporting Portal and amounts ultimately received by the Authority that could result in funds ultimately being required to be returned to HRSA. Questioned costs: None. Identification of a repeat finding: This is a repeat finding of Finding 2022-002 in the prior year. Context: There was a total of 4 HHS portal submission for the year ended June 30, 2023. The lost revenue reported on the Authority’s submission to HRSA’s PRF Reporting Portal amounted to $313,560,072. The total lost revenue supported by the Authority’s underlying calculations of lost revenue amounted to $263,152,407 for the year ended June 30, 2023. Therefore, Management reported $50,407,665 more in lost revenues in the portal than their supporting calculation. This difference had no impact on the amount received by the Authority from HHS under this Program. Recommendation: We recommend that Management develop and implement effective internal controls to ensure lost revenue calculations are reviewed and approved to ensure that the report submissions are accurate. The Authority should retain sufficient supporting documentation to support the lost revenue calculation was reviewed, approved, and calculated in accordance with the terms of the federal program during the period. View of responsible officials: There is no disagreement with the audit finding.

Criteria In accordance with Title 2 U.S. Code of Federal Regulations, Part 200.303, Internal controls, “Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition The Authority had not finalized the Schedule of Expenditures of Federal Awards (the Schedule) for the year ended June 30, 2022 in a timely manner. Cause The Schedule for the year ended June 30, 2022 included a number of COVID-19 programs. Various individuals in the Authority were involved and responsible for monitoring the terms and conditions of the federal awards and reporting of the federal expenditures. COVID-19 also impacted a number of resources within the Authority causing various constraints. Management continued to enhance procedures related to preparation and assessment of the Schedule. Effect or potential effect The reporting and verification of the completeness and accuracy of the expenditures required more time than expected due to the COVID-19 nature of the funds. Questioned costs None. Context The audit was not completed and the reporting submitted within the earlier of 30 calendar days after receipt of the auditor’s reports, or nine months after the end of the audit period as required by the Uniform Guidance. Identification of a repeat finding This is a repeat finding of Finding 2021-001 in the prior year. Recommendation The Authority’s policy and procedures should be designed to ensure timely reporting as required by the Uniform Guidance. View of responsible officials There is no disagreement with the audit finding.

Criteria In accordance with Title 2 U.S. Code of Federal Regulations, Part 200.303, Internal controls, “Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” The terms and conditions of the award require the recipient to submit reports to the secretary of HHS for each reporting period to ensure compliance with conditions that are imposed on the payment, and such report shall be in such form, with such content, as specified by the secretary of HHS in program instructions directed to all recipients. Condition Management did not have sufficiently designed internal controls to review the supporting documentation used in the lost revenue calculation and the data submitted in the HHS portal. The amount of the revenue reported to HRSA in the HHS portal for Periods 2 and 3 for July 1, 2021 to June 30, 2022 did not agree to the amounts recorded in the general ledger. Cause The Authority did not retain sufficient appropriate evidence of review and approval of amounts quantified as lost revenues attributable to COVID-19 that have not been reimbursed from other sources or that other sources are not obligated to reimburse. Management entered the incorrect information into the HHS portal. Management’s internal controls over the review and approval of the HHS portal data was not sufficiently robust to identify data input errors. Effect or potential effect A lack of internal control over the review of the lost revenue calculation submitted in the HHS portal could result in a misstatement of the amounts reported in the HHS portal. Potential effects include inappropriate amounts of lost revenue quantified that could impact the complete and accurate reporting of such amounts submitted to HRSA’s PRF Reporting Portal and amounts ultimately received by the Authority that could result in funds ultimately being required to be returned to HRSA. Questioned costs None. Context There was a total of 5 HHS portal submissions for the year ended June 30, 2022. The lost revenue reported on the Authority’s submission to HRSA’s PRF Reporting Portal amounted to $299,136,237. The total lost revenue supported by the Authority’s underlying calculations of lost revenue amounted to $251,893,540 for the year ended June 30, 2022. Therefore, Management reported $47,242,697 more in lost revenues in the portal than their supporting calculation. This difference had no impact on the amount received by the Authority from HHS under this Program. Identification of a repeat finding This is a repeat finding of Finding 2021-003 in the prior year. Recommendation We recommend that Management develop and implement effective internal controls to ensure lost revenue calculations are reviewed and approved to ensure that the report submissions are accurate. The Authority should retain sufficient supporting documentation to support the lost revenue calculation was reviewed, approved, and calculated in accordance with the terms of the federal program during the period. View of responsible officials There is no disagreement with the audit finding.

Criteria In accordance with Title 2 U.S. Code of Federal Regulations, Part 200.303, Internal controls, “Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition The Authority had not finalized the Schedule of Expenditures of Federal Awards (the Schedule) for the year ended June 30, 2021 in a timely manner. Cause The Schedule for the year ended June 30, 2021 included a number of COVID-19 programs. Various individuals in the Authority were involved and responsible for monitoring the terms and conditions of the federal awards and reporting of the federal expenditures. COVID-19 also impacted a number of resources within the Authority causing various constraints. Management continued to enhance procedures related to preparation and assessment of the Schedule. However, assistance listing number 21.019 – COVID-19 – Coronavirus Relief Fund continued to cause delays, which was the primary driver in the delay in the finalization of the Schedule. Refer to finding 2021-002 for further details. Effect or potential effect The reporting and verification of the completeness and accuracy of the expenditures required more time than expected due to the COVID-19 nature of the funds. Questioned costs None. Context The audit was not completed and the reporting submitted within the earlier of 30 calendar days after receipt of the auditor’s reports, or nine months after the end of the audit period as required by the Uniform Guidance. Identification of a repeat finding This is a repeat finding of Finding 2020-001 in the prior year. Recommendation The Authority’s policy and procedures should be designed to ensure timely reporting as required by the Uniform Guidance. View of responsible officials There is no disagreement with the audit finding.

Criteria In accordance with Title 2 U.S. Code of Federal Regulations, Part 200.303, Internal controls, “Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition Management did not have sufficiently designed internal controls to review the completeness and accuracy of the expenditure schedule for the Coronavirus Relief Fund (CRF) for the year ended June 30, 2021. Management did not retain audit evidence of its internal controls over its review and approval of supporting documentation of the expenditures. Cause Management designed a process to accumulate and review COVID-19 expenditures. However, due to the various COVID-19 programs, the expenditures were segregated for different federal program reimbursements. Based on the timing of the other federal program requests, COVID-19 expenditures were modified based on the allowability provisions related to each program. As a result, management prepared various versions of the expenditure schedules for the CRF. Management’s controls over the review of the completeness and accuracy of the final CRF expenditure schedule, including reconciliation to the Schedule of Expenditures of Federal Awards (the Schedule) and review of duplication of benefits within the other federal program reimbursements, was not sufficiently designed to identify errors within the populations. Effect or potential effect A lack of review of the completeness and accuracy of the CRF expenditure schedule could result in a expenditures being reimbursed by other sources. The CRF expenditure schedule was not complete and accuracy and therefore, did not agree to the Schedule. The CRF expenditure schedule included purchase order information and did not include final invoice and related payments. As such, the expenditures were overstated from what was recorded in the general ledger. Questioned costs None. Context The CRF expenditure schedule included COVID-19 related expenditures for the periods July 1, 2020 through June 30, 2021. The expenditure schedule was revised during the audit as Management identified expenditures that were targeted for reimbursement by other federal sources. As a result, various errors were identified within the populations including lack of agreement to the Schedule and amounts that did not result in payments. The total expenditure schedule included $37,362,139 of CRF expenditures. This exceeded the expenditures reported on the Schedule and the grant approved amounts for the Authority. As such, there were no questioned costs identified as part of our testing. Identification of a repeat finding This is not a repeat finding. Recommendation We recommend that Management develop and implement effective internal controls to ensure that expenditures are reviewed for completeness and accuracy to ensure that information is reported appropriately, including on the Schedule for Uniform Guidance compliance purposes. View of responsible officials There is no disagreement with the audit finding.

Criteria In accordance with Title 2 U.S. Code of Federal Regulations, Part 200.303, Internal controls, “Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” The terms and conditions of the award require the recipient to submit reports to the secretary of HHS for each reporting period to ensure compliance with conditions that are imposed on the payment, and such report shall be in such form, with such content, as specified by the secretary of HHS in program instructions directed to all recipients. Condition Management did not have sufficiently designed internal controls to review the supporting documentation used in the Provider Relief Fund (PRF) lost revenue calculation and the data submitted in the HHS portal. The amount of the revenue reported to HRSA in the HHS portal for Period 1 for April 10, 2020 to June 30, 2021 did not agree to the amounts recorded in the general ledger. Cause The Authority did not retain sufficient appropriate evidence of review and approval of amounts quantified as lost revenues attributable to COVID-19 that have not been reimbursed from other sources or that other sources are not obligated to reimburse. Management entered the incorrect information into the HHS portal. Management’s internal controls over the review and approval of the HHS portal data was not sufficiently robust to identify data input errors. Effect or potential effect A lack of internal controls over the review of the PRF lost revenue calculation submitted in the HHS portal could result in a misstatement of the amounts reported in the HHS portal. Potential effects include inappropriate amounts of lost revenue quantified that could impact the complete and accurate reporting of such amounts submitted to HRSA’s PRF Reporting Portal and amounts ultimately received by the Authority that could result in funds ultimately being required to be returned to HRSA. Questioned costs None. Context There was a total of 4 HHS portal submission for the year ended June 30, 2021. The PRF lost revenue reported on the Authority’s submission to HRSA’s PRF Reporting Portal amounted to $284,074,950. The total lost revenue supported by the Authority’s underlying calculations of lost revenue amounted to $247,585,299 for the year ended June 30, 2021. Therefore, Management reported $36,489,651 more in lost revenues in the portal than their supporting calculation. This difference had no impact on the amount received by the Authority from HHS under this program. Identification of a repeat finding This is not a repeat finding. Recommendation We recommend that Management develop and implement effective internal controls to ensure PRF lost revenue calculations are reviewed and approved to ensure that the report submissions are accurate. The Authority should retain sufficient supporting documentation to support the lost revenue calculation was reviewed, approved, and calculated in accordance with the terms of the federal program during the period. View of responsible officials There is no disagreement with the audit finding.

Finding Reference: 2020-001 Federal Program Information Federal Agencies: Department of the Treasury Awards: Assistance Listing #21.019 ? COVID-19 ? Coronavirus Relief Fund Award Periods: 3/1/2020 ? 12/31/2020 Description: Timely Preparation of Schedule of Expenditures of Federal Awards Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria In accordance with Title 2 U.S. Code of Federal Regulations, Part 200.303, Internal controls, ?Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.? Condition The Authority had not finalized the Schedule of Expenditures of Federal Awards (the Schedule) for the year ended June 30, 2020 in a timely manner. Cause The Schedule for the year ended June 30, 2020 included a number of COVID-19 programs. Various individuals in the Authority were involved and responsible for monitoring the terms and conditions of the federal awards and reporting of the federal expenditures. COVID-19 also impacted a number of resources within the Authority causing various constraints. Effect or potential effect The reporting and verification of the completeness and accuracy of the expenditures required more time than expected due to the COVID-19 nature of the funds. Questioned costs None. Identification of a repeat finding This is not a repeat finding. Context Expenditures for the major federal program were not reported or adjusted in the Schedule in a timely manner. As such, the audit was not completed and the reporting submitted as required by the Uniform Guidance within the earlier of 30 calendar days after receipt of the auditor?s report(s), or nine months after the end of the audit period with an additional six month submission extension. Recommendation The Authority?s policy and procedures should be designed to ensure timely reporting as required by the Uniform Guidance. View of responsible officials There is no disagreement with the audit finding.