Arkansas Children's Hospital

Statistically Valid Sample The sample was not intended to be, and was not, a statistically valid sample. Identification of whether the audit finding is a repeat of a finding in the immediately prior audit. This is not a repeat finding. Recommendation We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred. Management’s Response During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles. As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes. These controls support the review and approval of expenditures monthly to verify that they are allowable, incurred within the designated period of performance and incurred prior to reimbursement.

Findings and Questioned Costs Relating to Federal Rewards Finding 2021-001 Management?s review of allowable payroll costs Federal Programs: COVID-19 Coronavirus Relief Fund ALN: 21.019 Federal Agency: U.S. Department of Treasury Federal Award Years: 2021 Criteria 45 CFR section 75.303 (a) states the non-federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government,? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 45 CFR section 75.303 (b) states the non-federal entity must: Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. Recipients of coronavirus relief funds must support all expenses with adequate documentation and maintain proper control documentation to substantiate that these funds were used for coronavirus-related expenses. Condition Management reviews monthly COVID cost center reports to ensure compliance with the laws and regulations of the federal programs, specifically the allowability of the related payroll expenditures. There was no evidence of manual review of the COVID cost center payroll reports. Management relied on approvals by authorized individuals of time clocked to the COVID cost center by employees within the automated time and attendance system used by Arkansas Children?s. However, reliance upon an automated time and attendance tracking system cannot be used to meet the control requirement as the system was not subject to internal control testing by the auditor. Cause and Effect While Arkansas Children?s maintains that some manual review did take place, controls were not designed or implemented effectively to maintain evidence of management's manual review. Such reviews took place verbally over phone calls, online meeting platforms, and emails, which were not recorded or retained. Questioned Cost None. Statistically Valid Sample The sample was not intended to be, and was not, a statistically valid sample. Identification of whether the audit finding is a repeat of a finding in the immediately prior audit. This is not a repeat finding. Recommendation We recommend that management implement appropriate controls and processes to ensure that evidence of the manual review is maintained once all costs incurred by the grant are properly reviewed for allowability at the employee or department level. Management?s Response Arkansas Children?s will implement controls and processes to ensure all costs are manually reviewed and approved to ensure allowability under the grant and that evidence of review is maintained.