AMERICAN SAMOA MEDICAL CENTER AUTHORITYLocal Government

2 CFR 200.514 of the Uniform Guidance requires entities to have internal controls in place to monitor that expenditures are only for allowable activities and that services charged to the federal award are allowable per the applicable cost principles. In addition, a fundamental concept in a good system of internal controls is the segregation of duties; segregating access, custody, and authorization of transactions. These controls aid in mitigating risk in monitoring. Through inquiry and internal control testing, it was noted that the employees outside of the HR department have access to employee information within the system. This includes potential access to pay rates and other protected information inside the system. Payroll costs represent the majority of Federal award expenditures for the Medical Center.

Criteria: 2 CFR 200.514 of the Uniform Guidance requires entities to have internal controls in place to monitor that expenditures are only for allowable activities and that services charged to the federal award are allowable per the applicable cost principles. In addition, a fundamental concept in a good system of internal controls is the segragation of duties; segregating access, costody and authorization of transactions. These controls aid in mitigating risk in monitoring. Condition and Context: Through inquiry and internal control testing, it was noted that the employees outside of the HR department have access to employee information within the system. This includes potential access to pay rates and other protected information inside the system. Payroll costs represent the majority of Federal award expenditures for the Medical Center. Questioned Costs: None Cause/effect: No questioned costs or errors were identified during testing of the award expenditures, however, the lack of separation of duties related to access to employee information and pay rates within the system increases the risk of unallowable costs being charged to the federal program. Repeat Finding: Yes Recommendation: WIth the implementation of a new system, we recommend that user access for management and staff be limited to their assigned duties. Until such systems are finalized and placed in service, periodic reviews of employee information and transactions should be performed. Any and all unauthorized changes should be documented and evidence should be retained in a secure location.

Criteria: 2 CFR 200.514 of the Uniform Guidance requires entities to have internal controls in place to monitor that expenditures are only for allowable activities and that services charged to the federal award are allowable per the applicable cost principles. In addition, a fundamental concept in a good system of internal controls is the segregation of duties; segregating access, custody, and authorization of transactions. These controls aid in mitigating risk in monitoring. Condition and context: Through inquiry and internal control testing, it was noted that the employees outside of the HR department have access to employee information within the system. This includes potential access to pay rates and other protected information inside the system. Payroll costs represent the majority of Federal award expenditures for the Medical Center. Questioned costs: None Cause/effect: No questioned costs or errors were identified during testing of the award expenditures, however, the lack of separation of duties related to access to employee information and pay rates within the system increases the risk of unallowable costs being charged to the federal program. Recommendation: With the implementation of a new system, we recommend that user access for management and staff be limited to their assigned duties. Until such systems are finalized and placed in service, periodic reviews of employee information and transactions should be performed. Any and all unauthorized changes should be documented and evidence should be retained in a secure location. View of responsible officials and corrective action plan: Management should fully integrate new system (Microsoft Dynamics – GP) by the end of this fiscal year. The new system will have the capability to limit user access according to assigned duties.

Criteria: 2 CFR 200.514 of the uniform guidance requires entities to have internal controls in place to monitor that expenditures are only for allowable activities and that services charged to the federal award are allowable per the applicable cost principles. In addition, a fundamental concept in a good system of internal controls is the segregation of duties; segregating access, custody, and authorization of transactions. These controls aid in mitigating risk in monitoring. Condition and context: Through inquiry and internal control testing, it was noted that the employees outside of the HR department have access to employee information within the system. This includes potential access to pay rates and other protected information inside the system. Payroll costs represent the majority of federal award expenditures for the medical center. Questioned costs: none. Cause/Effect: No questioned costs or errors were identified during testing of the award expenditures, however, the lack of separation of duties related to access to employee information and pay rates within the system increases the risk of unallowable costs being charged to the federal program. Repeat finding: yes; refer to finding 2021-003. Recommendation: With the implementation of a new system, we recommend that user access for management and staff be limited to their assigned duties. Until such systems are finalized and placed in service, periodic reviews of employee information and transactions should be performed. Any and all unauthorized changes should be documented and evidence should be retained in a secure location. View of responsible officials and corrective action plan: Management should fully integrate new system (Microsoft Dynamics-GP) by the end of this fiscal year. The new system will have the capability to limit user access according to assigned duties.

Criteria ? A fundamental concept in a good system of internal control is the segregation of duties: in particular, segregating access, custody, and authorization of transactions. 2 CFR 200.514 of the Uniform Guidance requires institutions to have internal controls in place to monitor that expenditures are only for allowable activities and that services charged to the federal award are allowable per the applicable cost principles. Condition/Context ? While performing our internal control testing surrounding payroll it was noted that the finance office has access to employee demographic information and pay rates in the system. Payroll costs represent the most significant type of Federal award expenditures for the Medical Center. Questioned Cost ? None to be reported. Cause/Effect ? No questioned costs or errors were identified during testing; however, the identified segregation of duties issue related to access to employee demographic information and pay rates in the payroll process increases the risk of unallowable costs being charged to the federal program. Repeat Finding ? Yes; refer to finding 2019-010. Recommendation ? If the finance office?s access to employee demographic information and pay rates cannot be removed in the system, we recommend that a monthly review to check for unauthorized payroll changes be implemented. The related procedure should be documented, and evidence of review maintained. Further, the IT department?s reviews of user account privileges, privileged access, or segregation of duties should be performed periodically, and that review should be documented. Any supervisor access should only be granted by the IT department, and access for terminated employees should be removed timely. Views of Responsible Officials and Planned Corrective Actions ? The Medical Center will consistently perform and document the monitoring procedure noted above if Human Resources is not able to obtain the necessary system access to help with the segregation of duties.

Criteria ? 2 CFR 200.313 of the Uniform Guidance require grantees conduct a physical inventory of assets purchased with federal funds at least once every two years. Condition/Context ? The Medical Center does not have documentation for the required physical inventory of all applicable capital assets in the last two years. The Medical Center designed a process to track capital assets purchased with federal funds starting in fiscal year 2020. Questioned Cost ? None to be reported. Cause/Effect ? Without fully implementing a process to perform a physical inventory of capital assets purchased with federal funds, it is possible that assets could be misappropriated without detection. Repeat Finding ? Yes; refer to finding 2019-011. Recommendation ? The capital asset listing that identifies assets purchased with federal funds should be updated throughout the year as assets are purchased and disposed. Additionally, a physical inventory of all capital assets should be conducted, documented, and reconciled to the general ledger at least every two years. Views of Responsible Officials and Planned Corrective Actions ? The Medical Center is establishing a policy and procedure to follow. This process is a collaborative effort between finance and procurement departments with the property manager.

Criteria ? The Uniform Guidance requires institutions to have internal controls in place to monitor that expenditures are only for allowable activities and that services charged to the Federal award are allowable per the applicable cost principles. Condition/Context ? Refer to 2019-008. Questioned Cost ? None to be reported. Cause/Effect ? Refer to 2019-008. The lack of segregation of duties identified for payroll may result in unallowable costs being charged to the Federal program. Repeat Finding ? Yes, refer to finding 2018-003 (previously reported as 2014-008 in the September 30, 2018 Schedule of Findings and Questioned Costs). Recommendation ? Refer to 2019-008. Views of Responsible Officials and Planned Corrective Actions ? The Medical Center will consistently perform and document the monitoring procedure noted above if Human Resources is not able to obtain the necessary system access to help with the segregation of duties.

Criteria ? Federal regulations require grantees that have purchased capital equipment with federal funding to conduct a physical inventory of assets purchased with federal funds at least once every two years. Condition/Context ? The Medical Center does not have documentation for the required physical inventory of all applicable capital assets in the last two years. In addition, we noted that the Medical Center?s capital asset listing did not identify which assets were purchased using federal funds. The Medical Center performed a physical inventory count for the year ended September 30, 2019, however that count was not complete and was not reconciled to the general ledger. Questioned Cost ? None to be reported. Cause/Effect ?Without a physical inventory of capital assets with separate identification of assets purchased with federal funds, it is possible that assets could be misappropriated without detection. Repeat Finding ? Yes, refer to finding 2018-011 (previously reported as 2015-001 in the September 30, 2018 Schedule of Findings and Questioned Costs). Recommendation ? The capital asset listing should separately identify assets purchased with federal funds and it should be updated throughout the year as assets are purchased and disposed. Additionally, a physical inventory of all capital assets should be conducted, documented and reconciled to the general ledger at least every two years. Views of Responsible Officials and Planned Corrective Actions ? The Medical Center is establishing a policy and procedure to follow. This process is a collaborative effort between finance and procurement departments with the property manager.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION