Providence St. Joseph HealthNon-Profit

Federal Program: Student Financial Assistance Cluster, ALN No. 84.063 and 84.268 Federal Agency: U.S Department of Education Federal Award Year: July 1, 2023 – June 30, 2024 and July 1, 2024 - June 30, 2025 Criteria or Requirement: Per Title 2, U.S. Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, (Subpart D, Section 200.303), the nonfederal entity must establish and maintain effective internal controls over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition found, including facts that support the deficiency identified in the finding and information to provide proper perspective for judging the prevalence and consequences of the finding: The Health System, specifically the Covenant School of Nursing and Radiography (the Nursing School), did not follow requirements relative to the Student Financial Assistance program during the year ended December 31, 2024. During our testing, the Nursing School was unable to provide documentation supporting that various eligibility, reporting, special test and provision requirements were completed in accordance with Federal requirements. The Nursing School’s risk assessment and monitoring control activities were not designed at an appropriate level of precision to ensure adequate segregation of duties or evidence of controls operation related to the following direct and material compliance areas: eligibility, reporting, and special tests and provisions including enrollment reporting, return of title IV funds, Gramm-Leach-Bliley Act – student information security, and incentive compensation. The Federal expenditures under the Student Financial Assistance cluster were $2,728,263 during the year ended December 31, 2024. Cause and possible asserted effect: The Nursing School does not have appropriate segregation of duties and documentation of key control activities and their related precision levels related to the Student Financial Assistance cluster. Without appropriate controls in place, the Health System could incur unallowable expenditures or result in noncompliance with the requirements. Identification of questioned costs and how they were computed: None Whether the sampling was a statistically valid sample: The sample was not intended to be, and was not, a statistically valid sample. Identification of whether the audit finding is a repeat of a finding in the immediately prior audit and if so, the applicable prior year finding number: No. This finding was not a finding in the immediate prior year audit. Recommendations: For eligibility, reporting, and special tests and provisions including enrollment reporting, return of title IV funds, Gramm-Leach-Bliley Act – student information security, and incentive compensation, we recommend that management design and implement internal control procedures at the Nursing School to support the compliance requirements for the program including adequate segregation of duties, reviews at a sufficient level of precision to identify noncompliance, and proper evidence of control operation. Views of responsible officals: Management concurs with KPMG’s assessment that the risk assessment and monitoring control activities were not sufficiently designed to ensure adequate segregation of duties or to provide evidence of control operation. These gaps were primarily due to limited staffing and processes that have not evolved to meet all compliance requirements. Management will implement new control policies and procedures that ensure proper segregation of duties and introduce review mechanisms at a sufficient level of precision to detect and prevent noncompliance. These policies and procedures will be implemented by December 31, 2025.

Federal Program: Student Financial Assistance Cluster, ALN No. 84.063 and 84.268 Federal Agency: U.S Department of Education Federal Award Year: July 1, 2023 – June 30, 2024 and July 1, 2024 - June 30, 2025 Criteria or Requirement: Per Title 34, U.S. Code of Federal Regulations Part 690 (34 CFR 690), Federal Pell Grant Program, (Subtitle B, Chapter VI, Subpart G, Section 690.83(b)(1)), and Part 685 (34 CFR 685) William D. Ford Federal Direct Loan Program, (Subtitle B, Chapter VI, 685.301(a)(iii)) the nonfederal entity must report the anticipated and actual disbursement dates. Per Title 34, U.S. Code of Federal Regulations Part 668 (34 CFR 668), Student Assistance General Provisions, (Subtitle B, Chapter VI, Part 668.408 (a)(2), an institution offering any group of substantially similar programs, defined as all programs in the same four-digit CIP code at an institution, with 30 or more completers in total over the four most recent award years must report to the Department—the date the student initially enrolled in the program, the student’s total cost of attendance. Condition found, including facts that support the deficiency identified in the finding and information to provide proper perspective for judging the prevalence and consequences of the finding: We tested a sample of 55 disbursements and originations for the Common Origination and Disbursement (COD) reporting. For 45 of the disbursements tested, the reported disbursement date was not the actual date disbursed. For 45 of the originations selected, the academic year or enrollment date was not reported correctly. For two of the originations, the cost of attendance was not calculated or reported correctly. Cause and possible asserted effect: The Nursing School does not have an adequate process or controls in place to ensure accurate COD reporting as it relates to the disbursement date, academic year, or cost of attendance. Identification of questioned costs and how they were computed: None Whether the sampling was a statistically valid sample: The sample was not intended to be, and was not, a statistically valid sample. Identification of whether the audit finding is a repeat of a finding in the immediately prior audit and if so, the applicable prior year finding number: No. This finding was not a finding in the immediate prior year audit. Recommendations: We recommend that the Nursing School review and enhance its current policies and procedures to ensure that all required reporting elements including the enrollment dates, disbursement dates and cost of attendance are reviewed at an appropriate level of precision, reported to COD timely and that all elements match the Nursing School’s records. al control procedures at the Nursing School to support the compliance requirements for the program including adequate segregation of duties, reviews at a sufficient level of precision to identify noncompliance, and proper evidence of control operation. Views of responsible officals: Management acknowledges the findings related to Common Origination and Disbursement (COD) reporting as identified. These discrepancies were primarily due to limitations in our current review procedures. We are revising our internal policies and procedures to include detailed guidance on verifying and documenting disbursement and enrollment dates, academic year parameters, and cost of attendance calculations prior to COD submission. This will include additional layers of review to ensure timely and accurate reporting. These policies and procedures will be implemented by December 31, 2025.

Federal Program: Student Financial Assistance Cluster, ALN No. 84.063 and 84.268 Federal Agency: U.S Department of Education Federal Award Year: July 1, 2023 – June 30, 2024 and July 1, 2024 - June 30, 2025 Criteria or Requirement: The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). Condition found, including facts that support the deficiency identified in the finding and information to provide proper perspective for judging the prevalence and consequences of the finding: While the Health System has policies in place, as it relates to the student system (Empower) used by the Nursing School, the Health System did not have a written information security program to address the eight minimum safeguards identified in 16.CFR 314.4(c)(1) – (8). Cause and possible asserted effect: The Health System did not have policies or procedures indicating its compliance with certain aspects of GLBA. As a result, the Health System did not comply with GLBA written requirements. Identification of questioned costs and how they were computed: None Whether the sampling was a statistically valid sample: The sample was not intended to be, and was not, a statistically valid sample. Identification of whether the audit finding is a repeat of a finding in the immediately prior audit and if so, the applicable prior year finding number: No. This finding was not a finding in the immediate prior year audit. Recommendations: We recommend that management update their information technology policies and procedures to address the guidelines outlined by the GLBA. Views of responsible officals: Management acknowledges the findings related to compliance with GLBA requirements. The missing elements were primarily due to existing policies and procedures not specifically covering the information technology system utilized by the School of Nursing. Management will update their information technology policies and procedures to ensure full compliance with the 7 required elements outlined by the GLBA. This will include updating risk assessment procedures, designing safeguards based on risk assessments procedures, monitoring these safeguards, and documenting the results. These policy and procedure updates will be implemented by December 31, 2025.

Federal Program: Student Financial Assistance Cluster, ALN No. 84.063 and 84.268 Federal Agency: U.S Department of Education Federal Award Year: July 1, 2023 – June 30, 2024 and July 1, 2024 - June 30, 2025 Criteria or Requirement: Per Title 34, U.S. Code of Federal Regulations Part 668 (34 CFR 668), Student Assistance General Provisions, (Subtitle B, Chapter VI, Part 668.408 (a)(3)(i)), an institution offering any group of substantially similar programs, defined as all programs in the same four-digit CIP code at an institution, with 30 or more completers in total over the four most recent award years must report to the Department—if the student completed or withdrew from the program during the award year– the date the student completed or withdrew from the program. Condition found, including facts that support the deficiency identified in the finding and information to provide proper perspective for judging the prevalence and consequences of the finding: The Nursing School did not have controls appropriately designed to ensure timely or accurate reporting of student status changes to COD Specifically, during our testing, we selected a sample of 40 student changes for enrollment reporting. For eight of the selected students, the reported date of the change did not match the Nursing School's records or the change was reported outside the 60-day requirement. Cause and possible asserted effect: The Nursing School does not have an adequate process or controls in place to ensure accurate and timely enrollment reporting. Identification of questioned costs and how they were computed: None Whether the sampling was a statistically valid sample: The sample was not intended to be, and was not, a statistically valid sample. Identification of whether the audit finding is a repeat of a finding in the immediately prior audit and if so, the applicable prior year finding number: No. This finding was not a finding in the immediate prior year audit. Recommendations: We recommend the Nursing School review and enhance its current policies and procedures to ensure all student changes are reviewed at an appropriate level of precision, reported to COD within the required 60-day time frame, and the changes, including the effective dates, match the Nursing School’s records. Views of responsible officals: Management acknowledges the audit finding regarding deficiencies in the reporting of student status changes to COD. These discrepancies were primarily due to limitations in our staffing and review procedures. We are revising our enrollment reporting policies to clearly define roles, responsibilities, and timelines for processing student status changes. This includes an additional layer of review to verify the accuracy of effective dates prior to COD submission. These additional policies and procedures will be implemented by December 31, 2025.

Federal Program: Crime Victim Assistance – ALN 16.575, National Family Caregiver Support, Title III, Part E – ALN 93.052, Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Heath or Healthcare Crises – ALN 93.391, Hospital Preparedness Program (HPP) Ebola Preparedness and Response Activities – ALN 93.817, Block Grants for Prevention and Treatment of Substance Abuse – ALN 93.959, Non-Profit Security Program – ALN 97.008 Federal Agency: U.S. Department of Justice, U.S Department of Health and Human Services, U.S. Department of Homeland Security Federal Award Year: Various Criteria or Requirement: Per 2 CFR 200.328, The recipient or subrecipient must submit financial reports as required by the Federal award. Reports submitted annually by the recipient or subrecipient must be due no later than 90 calendar days after the reporting period. Reports submitted quarterly or semiannually must be due no later than 30 calendar days after the reporting period. Per 2 CFR 200.329, The recipient or subrecipient must submit performance reports as required by the Federal award. Intervals must be no less frequent than annually nor more frequent than quarterly except if specific conditions are applied (See § 200.208). Reports submitted annually by the recipient or subrecipient must be due no later than 90 calendar days after the reporting period. Reports submitted quarterly or semiannually must be due no later than 30 calendar days after the reporting period. A subrecipient must submit a final performance report to a pass-through entity no later than 90 calendar days after the conclusion of the period of performance. Per the 2024 Compliance Supplement, non-federal entities may be required to submit special reports as required by the terms and conditions of the federal award. Per 2 CFR 200.303, the non-federal entity must establish and maintain effective internal controls over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition found, including facts that support the deficiency identified in the finding and information to provide proper perspective for judging the prevalence and consequences of the finding: Of 20 financial reports tested, 9 were either not submitted timely or documentation was not available to substantiate when the report was submitted. Of 23 performance reports tested, 12 were either not submitted timely or documentation was not available to substantiate when the report was submitted. Of 9 special reports tested, 6 were either not submitted timely or documentation was not available to substantiate when the report was submitted. Cause and possible asserted effect: The Health System does not have an effective process and control to ensure timely submission of required reports per the terms and conditions of federal awards and applicable regulations and retainage of evidence of control operation (i.e. evidence of report submission). Identification of questioned costs and how they were computed: None Whether the sampling was a statistically valid sample: The sample was not intended to be, and was not, a statistically valid sample. Identification of whether the audit finding is a repeat of a finding in the immediately prior audit and if so, the applicable prior year finding number: No. This finding was not a finding in the immediate prior year audit. Recommendations: We recommend that the Health System review and enhance its current procedures to ensure that all required reporting applicable to federal awards is accurately identified, submission deadlines are met, and documentation of submissions is properly retained. Views of responsible officals: Management acknowledges the audit finding regarding timely submission of reports and retaining documentation of submissions. We will implement a new combined monitoring and record retention internal control process for financial, performance, and special reporting requirements, to ensure timely submission and retention of supporting documentation for required sponsor reporting. This process will be implemented by December 31, 2025.

FINDING # 2022-001 Finding Criteria Discussion Program information Federal Program: COVID-19 Claims Reimbursement to Health Care Providers and Facilities for Testing, Treatment, and Vaccine Administration for the Uninsured AL Number: 93.461 Federal Award Year: 2022 Criteria or requirement: Per Title 2, U.S. Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, (Subpart D, Section 200.303), the nonfederal entity must establish and maintain effective internal controls over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition found, including facts that support the deficiency identified in the finding and information to provide proper perspective for judging the prevalence and consequences of the finding: During our testwork over allowability, we selected a sample of 60 payments for testing. Within our sample, we identified 1 selection where the charges submitted for reimbursement to HRSA were unallowable. Further, as the charges submitted were not properly reviewed this is an instance of the Health System?s internal control not operating as designed. Cause and possible asserted effect: The Health System does not have adequate processes and controls in place to ensure that all charges submitted for reimbursement under the HRSA Uninsured program are allowable. Without effective controls in place, charges could be reimbursed by the program that are considered unallowable, resulting in non-compliance with grant requirements. Identification of questioned costs and how they were computed: $347,249, representing the projected amount of unallowed charges reimbursed by HRSA Uninsured Program. Whether the sampling was a statistically valid sample: The sample was not intended to be, and was not, a statistically valid sample. Identification of whether the audit finding is a repeat of a finding in the immediately prior audit and if so, the applicable prior year finding number: No. Recommendations: We recommend that management strengthen processes and controls in place to ensure that all charges submitted to HRSA for reimbursement under the Uninsured Program are appropriately reviewed prior to submission to ensure they are allowable. Views of responsible officials: Management agrees with the finding, and notes that this was caused by an inadequate level of review performed prior and subsequent to submission to the program for reimbursement. Providence will prioritize strengthening our processes and controls before proceeding. Providence will add a layer of review for all potential new claims. All accounts will be audited by management prior to submission to ensure compliance. Providence will do a post submission audit to confirm billing compliance on paid claims.

FINDING #2020-001 Finding Criteria DiscussionProgram informationFederal program: Coronavirus Relief FundProgram information Federal program: Coronavirus Relief FundCFDA: 21.019Federal Agency: United States Department of the TreasuryPass-through entity: Alaska Community FoundationGrant Name: Lake Otis Drive ThroughGrant ID number: 89198000177Federal Award Year: 2020Criteria or requirement: Per Title 2, U.S. Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, (Subpart D, Section 200.303), the nonfederal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.Condition found, including facts that support the deficiency identified in the finding and information to provide proper perspective for judging the prevalence and consequences of the finding: Management was unable to produce evidence of review and approval of facts that support the the fringe rate used for the program.Cause and possible asserted effect: Management did not design and implement a control for the Lake Otis to review and approve the fringe rate used and to document this approval. The lack of management review may have led to unallowable costs being charged to the grant by using an inappropriate rate.Whether the sampling was a statistically valid sample: The sample was not intended to be, and was not, a statistically valid sample.Identification of questioned costs and how they were computed: NoneRecommendations: We recommend that management design and implement controls that will validate that the rates used to charge fringe costs to the federal program are reviewed and approved and that the approval is documented and retained.Views of responsible officials: Management has improved the existing process to ensure that sufficient documentation is obtained and retained as evidence that fringe benefit cost rates calculations are is being reviewed by accounting management and the approval is documented. This process has been implemented since July 2021.

FINDING #2019 001 Finding Criteria Discussion Program information Federal Program: NIH, Unobtrusive Sensing of Medication Intake (?USE-MI?) (PI Init), 15065, CFDA No. 93.242, Award No. 5R01MH109319-02, 5R01MH109319-03,5R01MH109319-04 Targeting STING in the context of chemoradiation therapy to overcome poor preexisting immunity in mouse models of pancreatic cancer, CFDA No. 93.395, Award No. 1R01CA208644-01, 5R01CA208644-02,5R01CA208644-03,5R01CA208644-04 Multicenter Selective Lymphadenectomy Trial (MSLT II) in Melanoma, CFDA No. 93.395, Award No. 5R01CA189163-05 FHCRC (NCI), ReCAPSE, 16204, CFDA No. 93.396, Award No.0000957382 Federal Agency: US Department of Health and Human Services Pass-through Entity: Fred Hutchinson Cancer Research Center Federal Award Year: Various Criteria or requirement Per Title 2, U.S. Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, (Subpart D, Section 200.303), the nonfederal entity must establish and maintain effective internal controls over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition found, including facts that support the deficiency identified in the finding and information to provide proper perspective for judging the prevalence and consequences of the finding During our testwork over benefit and indirect costs, six grants were selected for testing. For four and one of the selected grants for benefits and indirect rates, respectively, there was not sufficient documentation to evidence review of the rate prior to set up in the system. Cause and possible asserted effect The Health System does not have adequate documentation to support the review process to ensure that the indirect and benefit cost rates applied are appropriate for the respective grants. Without effective controls in place, rates could temporarily (until final reconciliation) be used that exceed the maximum allowable percentage, resulting in the Health System being out of compliance with the applicable grant agreement. Identification of questioned costs and how they were computed None. Whether the sampling was a statistically valid sample The sample was not intended to be, and was not, a statistically valid sample. Identification of whether the audit finding is a repeat of a finding in the immediately prior audit and if so, the applicable prior year finding number No. Recommendations We recommend that management design and implement internal controls that will verify that the rates used to charge indirect and benefit costs to the federal program do not exceed the maximum allowable percentage. Views of responsible officials Management will update and formally document procedures pertaining to the application and use of indirect and benefit cost rates in its financial management system to ensure that sufficient documentation is obtained and retained to evidence appropriate rates are being used for the respective grants. This will be implemented by December 31, 2020.

FINDING #2019 002 Finding Criteria Discussion Program information Federal Program: Crime Victim Assistance, CFDA No. 16.575 Federal Agency: U.S Department of Justice Pass-through Entity: State of Washington Department of Commerce Federal Award Year: Various Criteria or requirement Per Title 2, U.S. Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, (Subpart D, Section 200.303), the nonfederal entity must establish and maintain effective internal controls over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition found, including facts that support the deficiency identified in the finding and information to provide proper perspective for judging the prevalence and consequences of the finding The Health System?s risk assessment and monitoring activities did not operate to ensure adequate segregation of duties was designed into control activities related to the following compliance areas: allowable costs, cash management, reporting, matching, and period of performance. Cause and possible asserted effect Without appropriate control activities in place, the Health System could incur unallowable expenditures or be in noncompliance with the requirements. Identification of questioned costs and how they were computed None. Whether the sampling was a statistically valid sample The sample was not intended to be, and was not, a statistically valid sample. Identification of whether the audit finding is a repeat of a finding in the immediately prior audit and if so, the applicable prior year finding number No. Recommendations We recommend that management design and implement internal controls to support the compliance requirements for the program. Views of responsible officials Management agrees with the finding, and notes that this was caused by an inadequate segregation of duties within the operations grant program team that would have ensured a clear delineation between the preparation and submittal of allowable costs, and their approval. This includes inadequate oversight of the designation of costs as allowable or non-allowable. In order to address this issue, the operations finance teams will ensure a multi-step process involving a clear segregation of duties to ensure there is a thorough review of all expenses before submittal.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION