ADVOCATE AURORA HEALTH, INCNon-Profit

Federal Agency: United States Department of Agriculture Food and Nutrition Service ALN: 10.557 WIC Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Pass-Through Grantor: State of Wisconsin Department of Health Services – Wisconsin Department of Health and Family Services Pass-Through Award Number: 154710 Pass-Through Award Period: 1/1/2024 to 12/31/2024 Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): Applicants for WIC program benefits are screened at WIC clinic sites to determine their WIC eligibility. To be certified eligible, they must meet the following eligibility criteria (7 CFR Sections 246.7(c), (d), (e), (g), and (l)): (a) Categorical – Eligibility is restricted to pregnant, postpartum and breastfeeding women; infants; and children up to their fifth birthday (7 CFR Sections 246.2 (definition of each category) and 246.7(c)). (b) Identity and Residency – Except in limited circumstances, WIC applicants must be physically present for eligibility screenings and must provide proof of identity. An applicant must also meet the state agency residency requirement. Except in the case of Indian state agencies, the applicant must reside in the jurisdiction of the state. Indian state agencies may require applicants to reside within their jurisdiction. (c) Income – An applicant must meet an income standard established by the state agency or be determined to be automatically (adjunctively) income-eligible based on documentation of his or her eligibility, or certain family members’ eligibility, for the following federal programs: (1) Temporary Assistance for Needy Families, (2) Medicaid, or (3) Supplemental Nutrition Assistance Program (formerly the Food Stamp Program). State agencies may also determine an individual automatically income eligible, based on documentation of his or her eligibility for certain state-administered programs. (d) Nutritional Risk – A competent professional authority (e.g., physician, nutritionist, registered nurse, or other health professional) must determine that the applicant is at nutritional risk. While the broad guidelines for determining nutritional risk are set forth in WIC legislation and regulations, the specific allowable nutritional risk criteria are defined in WIC policy guidance, which is updated periodically. Each state agency may choose which allowable nutritional risk criteria will be used to determine eligibility. When an applicant meets all eligibility criteria, he or she is determined by WIC clinic staff to be eligible for program benefits. Certification periods are assigned to each participant based on categorical status for women, infants, and children (7 CFR Section 246.7(g)). A WIC local agency assigns each eligible person a priority classification according to the classification system described in 7 CFR Section 246.7(e)(4). A person’s priority assignment reflects the severity of his or her nutritional risk. If the local agency cannot immediately place the person on the program for lack of an available caseload slot, the person is placed on a waiting list. Caseload vacancies are filled from the waiting list in priority classification order. State agencies are expected to target program outreach and caseload management efforts toward persons at greatest nutritional risk (i.e., those in the highest priority classifications). Pregnant women are certified for the duration of their pregnancies and for up to six weeks postpartum. Breastfeeding women may be certified approximately every six months, up to one year postpartum, or until the woman ceases breastfeeding, whichever occurs first (7 CFR Section 246.7(g)(1)). Infants are certified at intervals of approximately six months, except that infants under six months of age may be certified for a period extending up to the child’s first birthday, provided the quality and accessibility of health care services are not diminished. Children are certified for six-month intervals ending with the last day of the month in which the child reaches the fifth birthday. State agencies also have the option to certify children for a period of one year if the state agency ensures that the child receives the required health and nutrition assessments (7 CFR Section 246.7(g)(1)). Non-breastfeeding women are certified for up to six months postpartum. All categories of participants may be certified up to the last day of the last month of the certification period (7 CFR Section 246.7(g)(1)). Condition: Advocate Aurora Health, Inc. screens applicants for eligibility by following the State of Wisconsin guidelines as provided through the State’s ROSIE system used to enter, track, and store information about applicants. Based on guidance contained in 7 CFR Section 246, states were encouraged to move to a paperless system. Specifically, federal guidance contained in 7 CFR 246.7 (i)(4) and (5)(i) outlines acceptable documentation to be included on certification forms as (1) “a description of the document(s) used to determine residency and identity or a copy of the document(s) used or the applicant’s written statement when no documentation exists,” and (2) “a description of the document(s) used to determine income eligibility or a copy of the document(s) in the file.” The State of Wisconsin has followed that guidance and does not require Advocate Aurora Health, Inc. to retain copies of an applicant’s proof of residence, income, etc., regarding eligibility. Therefore, we were not able to test internal controls over compliance or compliance over the eligibility compliance requirement through re-performance and we have issued a qualified opinion based on the scope limitations. Cause: Advocate Aurora Health, Inc. follows a paperless system as supported by the State of Wisconsin and the U.S. Department of Agriculture. The state does not require third-party supporting documentation of eligibility determinations to be retained. Effect or potential effect: Due to the online nature of the eligibility system, the program does not have documentation available for the audit team to test compliance with the eligibility requirement. A scope limitation qualified opinion was issued for ALN 10.557 as we were unable to obtain sufficient documentation supporting the compliance of Advocate Aurora Health, Inc. regarding eligibility. Questioned Costs: None. Context: Federal expenditures reported in the schedule of expenditures of federal awards for ALN 10.557 totaled $790,899 for the year ended December 31, 2024. Identification as a repeat finding, if applicable: This is not a repeat finding. Recommendation: No further follow-up is required, as management of Advocate Aurora Health, Inc. is following the applicable guidance. Views of responsible officials and planned corrective actions: Management agrees with the finding.

Federal Agency: United States Department of Agriculture Food and Nutrition Service ALN: 16.575 Crime Victim Assistance (VOCA) Pass-Through Grantor: State of Illinois, Illinois Criminal Justice Information Authority and State of Wisconsin Department of Justice Pass-Through Award Number: 2021/2022-VO-A/VO-01-18139; 2023-VO-01-18830; 218690; 218692 Pass-Through Award Period: 10/1/2023 to 9/30/2025 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.430(g)(1)(vi) of the Uniform Guidance states that the standards for documentation of personnel expense must “Support the distribution of the employee’s salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity”. Condition: Management did not have sufficiently designed internal controls to ensure that approved changes in employees’ effort certifications for salaries and wages were accurately recorded and charged to the grant. Cause: The Organization has internal controls in place to ensure employees’ effort certifications are approved. However, the Organization did not have internal controls to ensure that changes in employees’ certified effort were recorded and charged to the grant. Effect or potential effect: Unallowable payroll costs may be charged to the federal program. Questioned costs: $707 – Grant 218692 Context: We tested a sample of 25 payroll expenses, which totaled $28,826, for the period January 1, 2024 through December 31, 2024 and identified 3 transactions, which totaled $5,848. These three transactions had a change in effort during the period that was not reflected in the labor distribution causing the Advocate Aurora Health, Inc. to overcharge the grant by $707. The total VOCA expenditures reported on the Schedule are $2,098,275 for the year ended December 31, 2024. Payroll costs totaled $1,690,963, representing 84% of the total VOCA expenditures. Identification as a repeat finding, if applicable: This is not a repeat finding. Recommendation: Management should ensure that changes in effort made as a result of effort report certifications are reflected in the general ledger. Views of responsible officials: Advocate Aurora Management will develop and implement written procedures to ensure the timely communication of discrepancies identified during the effort certification process to the Grant Accounting team for appropriate review and adjustment.

Federal Agency: United States Department of Treasury ALN: 21.027 Coronavirus State and Local Fiscal Recovery Funds Award Period: 1/1/2023 to 6/30/2025 Pass-Through Grantor Pass-Through Award Number Illinois Department of Human Services FCSDX06443, FCSDX06444, FCSDX06445 Federal Agency: United States Department of Health and Human Services Assistance Listing Federal Program Name Pass-Through Grantor Pass-Through Award Number 93.889 National Bioterrorism Hospital Preparedness Program Illinois Health and Hospital Association 197137 Illinois Department of Public Health 47280007L; 47280009L; 57280007M; and 57280009M 93.958 Block Grants for Community Mental Health Services Illinois Department of Human Services 45CCB03507 and 45CDB04209 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.430(g)(1)(vi) of the Uniform Guidance states that the standards for documentation of personnel expense must “Support the distribution of the employee’s salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity”. Condition: Management did not complete effort certifications for individuals working on multiple federal programs during the year. Cause: Management did not have sufficiently designed internal controls to ensure that effort certifications were completed for individuals working on multiple federal programs. Effect or potential effect: Unallowable payroll costs may be charged to the federal program. Questioned costs: None. Context: For Coronavirus State and Local Fiscal Recovery Funds, National Bioterrorism Hospital Preparedness Program, and Block Grants for Community Mental Health Service, Advocate Aurora Health did not have employees complete effort certifications when they were working on multiple federal programs. The total expenditures reported on the Schedule for Coronavirus State and Local Fiscal Recovery Funds, National Bioterrorism Hospital Preparedness Program, and Block Grants for Community Mental Health Service are $1,460,320, $952,593, and $926,262, respectively, for the year ended December 31, 2024. Payroll costs for Coronavirus State and Local Fiscal Recovery Fund, National Bioterrorism Hospital Preparedness Program, and Block Grants for Community Mental Health Service totaled $1,150,365, $94,265, and $752,385, respectively, representing 79%, 10%, and 81%, respectively of the total expenditures. Identification as a repeat finding, if applicable: This is not a repeat finding. Recommendation: The Organization should review its effort certification policies and procedures and implement more robust internal controls to ensure effort certifications are approved timely for all employees charging effort to the federal program. Views of responsible officials: Management agrees with the finding and will implement standardized procedures to ensure effort certifications are completed accurately and on time for all program staff.

Federal Agency: United States Department of Health and Human Services ALN: 93.788 Opioid STR Pass-Through Grantor: Illinois Department of Human Services Pass-Through Award Number: 43CCC03512 Award Period: 7/1/2023 to 6/30/2025 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Per Exhibit B of the grant agreement dated June 12, 2024 between the State of Illinois, Department of Human Services and Advocate Health & Hospitals, patients who are residents of the State of Illinois and have indicated diagnosis of Opioid Use Disorder (OUD) are eligible to receive services. Condition: Management did not accurately document and retain evidence of the state of residency for participants in the federal program. Cause: Management did not have sufficiently designed internal controls to ensure that participants in the program were eligible to receive services through the program. Effect or potential effect: Ineligible participants may participate and receive benefits from the federal program. Questioned costs: None. Context: We tested a sample of 40 participants in the federal program for the period January 1, 2024 through December 31, 2024 and identified 8 participants where eligibility could not be redetermined or established. For seven of the participants, documentation was not retained to evidence the participants’ state of residence and for one participant they were listed as a resident of another state. The total Opioid STR expenditures reported on the Schedule are $1,105,537 for the year ended December 31, 2024. Identification as a repeat finding, if applicable: This is not a repeat finding. Recommendation: The Organization should review its policies and procedures for determining and retaining evidence of participants’ eligibility and implement more robust internal controls to ensure proof of residency is confirmed and retained for participants in the federal program. Views of responsible officials: Management agrees with this finding and will develop a more robust process to verify participant eligibility. This process will include detailed steps and documentation, supported by a standardized eligibility checklist to guide staff in confirming and accurately recording participant eligibility.

Federal Agency: United States Department of Health and Human Services ALN: 93.889 National Bioterrorism Hospital Preparedness Program Pass-Through Grantor: Illinois Department of Public Health and Illinois Health and Hospital Association Pass-Through Award Number: 47280007L; 47280009L; 57280007M; 57280009M; and 197137 Award Period: 7/1/2023 to 6/30/2025 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.313(d)(1) and (2) states, “Regardless of whether equipment is acquired in part or its entirety under the Federal award, the recipient or subrecipient must manage equipment (including replacement equipment) utilizing procedures that meet the following requirements: (1) Property records must include a description of the property, a serial number or another identification number, the source of funding for the property (including the FAIN), the title holder, the acquisition date, the cost of the property, the percentage of the Federal agency contribution towards the original purchase, the location, use and condition of the property, and the disposition data including the date of disposal and sale price of the property. The recipient and subrecipient are responsible for maintaining and updating property records when there is a change in the status of the property. (2) A physical inventory of the property must be conducted, and the results must be reconciled with the property records at least once every two years.” Condition: The Organization did not retain property records documenting the appropriate criteria required by Section 200.313(d)(1) and (2), and did not conduct a physical inventory of property. Cause: The Organization did not have sufficiently designed internal controls to ensure that property records are retained in accordance with Section 200.313(d)(1) and (2), and to ensure that physical inventory procedures are conducted over property at least once every two years. Effect or potential effect: Federal equipment may not be maintained or disposed of in accordance with federal regulations. Questioned costs: None. Context: We tested a sample of 5 items from the equipment listing related to the federal program for the period January 1, 2024 through December 31, 2024. For all five items, there was no evidence that a physical inventory was performed in the last two years. For one item selected for testing the serial number listed on the listing did not match the serial number of the item selected. The total National Bioterrorism Hospital Preparedness Program expenditures reported on the Schedule are $952,593 for the year ended December 31, 2024. The net book value of all assets related to this federal program were $205,978. Identification as a repeat finding, if applicable: This is not a repeat finding. Recommendation: The Organization should implement more robust internal controls to ensure that accurate property records are maintained and physical inventory procedures over property are conducted at least once every two years. Views of responsible officials: Management agrees with the finding. Program and Fixed Asset Accounting teams will collaborate to ensure adherence to the established asset tracking and inventory management procedures. The joint effort will ensure that the subsidiary ledger is maintained, equipment acquired through federal grants is properly recorded, and physical inventories are conducted within the prescribed timelines.

Finding 2023-001 Information on the Federal Program: Federal Agency: Department of Homeland Security Assistance Listing No.: 97.036 COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (FEMA) Pass-Through: Wisconsin Emergency Management Agency Pass-Through Award Number: FEMA-4520-079-07A07-00 Pass-Through Award Period of Performance: January 20, 2020 through December 31, 2021 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Per the FEMA Project Worksheet Report #664571, under the Documentation Requirements Acknowledgement, “In accordance with 2 C.F.R. §200.333 as well as state and local record retention requirements, the Applicant acknowledges the requirement to maintain all documentation that supports this project application in its own files. This documentation will be required if the Applicant submits an appeal for additional funding, as well as in the case of any audits.” Condition: The Organization’s internal controls were not suitably designed to retain all supporting documentation over their review and approval of FEMA federal expenditures. Management did not retain supporting documentation to support the inventory usage reports used in the development of the FEMA expenditures. Cause: Management designed a process to accumulate and review expenditures related to the FEMA; however, for certain components of the review and approval the supporting documentation was not retained to evidence that the internal review was sufficiently designed and operating effectively throughout the process. Management did not retain supporting documentation to support the inventory usage reports used in the development of the FEMA expenditures. Questioned Costs: The amount of questioned costs are unknown, given the nature of this finding in which we were unable to support the underlying inventory usage reports which were a key input to the development of FEMA expenditures included on the Schedule. Context: The Organization recorded FEMA expenditures on the Schedule based on the number of units of the personal protective equipment (PPE) used during the period of performance outlined in the project worksheet times the average costs of each unit of PPE. The information used to develop the FEMA expenditures was obtained from the Organization’s inventory management system. Management did not retain supporting documentation to support the reliance on the inventory usage reports; therefore, the information from the inventory management system cannot be relied on for Uniform Guidance purposes. Management represented that they performed a review of FEMA expenditures but did not maintain evidence supporting all levels of review and approval of expenses under FEMA. We obtained the Organization’s FEMA project worksheet that reconciled to the schedule of expenditures of federal awards. We then selected a sample of 25 PPE items and agreed the items used and the average unit costs to the inventory management system. In addition, we compared the average unit cost to a third-party invoice to support the unit cost used. Management engaged a third party to perform a physical inventory of supplies at December 31, 2020 which included the PPE claimed in the FEMA obligation. The physical inventory was reconciled to the inventory management system. We selected a sample of inventory counts performed by the third-party agency and agreed the inventory counts back to the third-party records, noting no exceptions. A physical inventory was not performed at December 31, 2021. Total federal expenditures for Assistance Listing 97.036 recorded on the Schedule totaled $48,004,943 for the year ended December 31, 2023. Effect or Potential Effect: The amounts submitted for reimbursement and the FEMA reports submitted could be inaccurate or incomplete. Identification as a Repeat Finding, if Applicable: This is a repeat finding; see 2022-002. Recommendation: The Organization should design and implement internal controls that are sufficiently precise and require supporting documentation be retained over the review and approval of FEMA expenses. The Organization should retain evidence of internal controls related to access and change management over the report or a quality review process over the inventory reports. Management response: The FEMA personal protective equipment (PPE) claim covered two years, which are 2020 and 2021. As noted in the audit, the Organization engaged a third party to perform a physical inventory of supplies at December 31, 2020 which included the PPE claimed in the FEMA obligation. The physical inventory was reconciled to the inventory management system. The audit selected a sample inventory count performed by third party and agreed the inventory counts back to the third party records noting no exceptions. A physical inventory was not performed at December 31, 2021. Due to the COVID pandemic, there were unusual circumstances that precluded an annual physical inventory in 2021, due to the easy transmission of COVID-19, by breathing in air carrying droplets or aerosol particles that contain the SARS-CoV-2 virus when close to an infected person or in poorly ventilated spaces with infected persons. Noting there were no system changes to the inventory system during 2021, we relied on the prior year audits and internal control review of the inventory system to provide comfort for the Organization for reliance on the inventory usage for this FEMA claim. In addition to relying on past inventory documented audit controls, the Organization routinely reviews the supply expense generated from the inventory system.

Finding 2022-001 Information on the Federal Program: Federal Agency: United States Department of Health and Human Services Assistance Listing No.: Research and Development Cluster (various Assistance Listings) Award Periods: Various Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): The Uniform Guidance 2 CFR Section 200.303 states, ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? 45 CFR Part 75 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, Appendix IX to Part 75 ? Principles for Determining Costs Applicable to Research and Development Under Grants and Contracts with Hospitals, states: ?Charges for salaries and wages of individuals other than members of the professional staff will be supported by daily time and attendance and payroll distribution records. For members of the professional staff, current and reasonable estimates of the percentage distribution of their total effort may be used as support in the absence of actual time records. In order to qualify as current and reasonable, estimates must be made no later than one month (though not necessarily a calendar month) after the month in which the services were performed. Estimates determined before the performance of services, such as budget estimates on a monthly, quarterly, or yearly basis do not qualify as estimates of effort spent.? Section III ? Federal Award Findings and Questioned Costs (continued) Condition: Charges of salaries and wages to the R&D Cluster were not consistently reviewed by a knowledgeable individual or not certified timely. In addition, certain individuals? effort certification did not account for 100% of their effort (R&D and institutional). Cause: The Organization does have not internal controls in place to monitor that 100% of effort is certified, and the effort is certified timely and reviewed and approved by a knowledgeable individual. Effect or Potential Effect: Charges for salaries and wages were charged to the R&D Cluster for individuals who did not certify their effort or 100% of their effort. In addition, the lack of internal controls over the review and approval of effort certification could result in unallowable charges for salaries and wages to be charged to the program. Questioned Costs: None Context: We selected a sample of 40 salaries and wages totaling $68,789 for the year ended December 31, 2022. We concluded effort certifications did not include 100% effort and were not reviewed and approved for 20 selections ($40,817). We also noted one instance ($1,965) which was not reviewed and approved timely. Total salaries and wages, fringe benefits, and indirect costs related to the R&D Cluster were $2,786,348 for the year ended December 31, 2022. Total R&D expenditures recorded on the Schedule of Expenditures of Federal Awards (the Schedule) are $3,323,540 for the year ended December 31, 2022. Section III ? Federal Award Findings and Questioned Costs (continued) Identification as a Repeat Finding, if Applicable: This is a repeat finding; see 2021-002. Recommendation: The Organization should implement internal controls to require individuals to certify 100% of their effort on a monthly basis to ensure that salaries and wages are based on actual efforts spent. The Organization should design and implement internal controls to review and approve the effort certified by an individual with knowledge of the employee?s effort on a timely basis. Management?s Response: The Office of Sponsored Research (OSR) committed in the 2020 Corrective Action Plan to implement a paper format effort certification process beginning March 2022. This process was fully implemented by the end of fiscal 2022. Also in 2022, Advocate Aurora Research Institute employees were transferred and integrated under one financial system. The integration of this system supports the monitoring of 100% of total effort. The OSR will also continue to utilize a paper effort certification process. The OSR team will generate effort certification form, distribute the effort certification form to the appropriate team member for manual or electronic signature and obtain a secondary approval signature from an individual who has first-hand knowledge of the team member?s activities. All completed effort certification forms will be verified and initialed by a third individual. Effort certification logs will be maintained to ensure that all effort certifications are completed within 30 days. Completed effort certification forms will be maintained within OSR.

Finding 2022-002 Information on the Federal Program: Federal Agency: Department of Homeland Security Assistance Listing No.: 97.036 Disaster Grants ? Public Assistance (Presidentially Declared Disasters) (FEMA) Pass-Through: Illinois State Department of Health Pass-Through Award Number: PA-05-IL-4489-PW-01416(1753) Section III ? Federal Award Findings and Questioned Costs (continued) Pass-Through Award Period of Performance: January 20, 2020 through December 31, 2021 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Per the FEMA Project Worksheet Report #664845, under the Subgrant Conditions section, bullet point 1, ?As described in Title 2 Code of Federal Regulations (C.F.R.) ? 200.333, financial records, supporting documents, statistical records and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three (3) years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient.? Condition: The Organization?s internal controls were not suitably designed to retain all supporting documentation over their review and approval of FEMA federal expenditures. Management did not retain supporting documentation to support the inventory usage reports used in the development of the FEMA expenditures. Cause: Management designed a process to accumulate and review expenditures related to the FEMA; however, for certain components of the review and approval the supporting documentation was not retained to evidence that the internal review was sufficiently designed and operating effectively throughout the process. Section III ? Federal Award Findings and Questioned Costs (continued) Management did not retain supporting documentation to support the inventory usage reports used in the development of the FEMA expenditures. Questioned Costs: Unknown Context: The Organization recorded FEMA expenditures on the Schedule based on the number of units of the personal protective equipment (PPE) used during the period of performance outlined in the project worksheet times the average costs of each unit of PPE. The information used to develop the FEMA expenditures was obtained from the Organization?s inventory management system. Management did not retain supporting documentation to support the reliance on the inventory usage reports; therefore, the information from the inventory management system cannot be relied on for Uniform Guidance purposes. Management represented that they performed a review of FEMA expenditures but did not maintain evidence supporting all levels of review and approval of expenses under FEMA. We obtained the Organization?s FEMA project worksheet that reconciled to the schedule of expenditures of federal awards. We then selected a sample of 25 PPE items and agreed the items used and the average unit costs to the inventory management system. In addition, we compared the average unit cost to a third-party invoice to support the unit cost used. Management engaged a third party to perform a physical inventory of supplies at December 31, 2020 which included the PPE claimed in the SEFA obligation. The physical inventory was reconciled to the inventory management system. We selected a sample of inventory counts performed by the third-party agency and agreed the inventory counts back to the third-party records, noting no exceptions. A physical inventory was not performed at December 31, 2021. Total federal expenditures for Assistance Listing 97.036 recorded on the Schedule totaled $35,508,438 for the year ended December 31, 2022. Section III ? Federal Award Findings and Questioned Costs (continued) Effect or Potential Effect: The amounts submitted for reimbursement and the reports submitted could be inaccurate or incomplete. Identification as a Repeat Finding, if Applicable: This is not a repeat finding. Recommendation: The Organization should design and implement internal controls that are sufficiently precise and require supporting documentation be retained over the review and approval of FEMA expenses. The Organization should retain evidence of internal controls related to access and change management over the report or a quality review process over the inventory reports. Management response: The FEMA personal protective equipment (PPE) claim covered two years, which are 2020 and 2021. As noted in the audit, the Organization engaged a third party to perform a physical inventory of supplies at December 31, 2020 which included the PPE claimed in the SEFA obligation. The physical inventory was reconciled to the inventory management system. The audit selected a sample inventory count performed by third party and agreed the inventory counts back to the third party records noting no exceptions. A physical inventory was not performed at December 31, 2021. Due to the COVID pandemic, there were unusual circumstances that precluded an annual physical inventory in 2021, due to the easy transmission of COVID-19, by breathing in air carrying droplets or aerosol particles that contain the SARS-CoV-2 virus when close to an infected person or in poorly ventilated spaces with infected persons. Noting there were no system changes to the inventory system during 2021, we relied on the prior year audits and internal control review of the inventory system to provide comfort for the Organization for reliance on the inventory usage for this FEMA claim. In addition to relying on past inventory documented audit controls, the Organization routinely reviews the supply expense generated from the inventory system.

Finding 2021-001 Information on the Federal Program: Federal Agency: U.S. Department of Health and Human Services (HHS), Health Resources and Services Administration (HRSA) Assistance Listing: 93.498 COVID-19 Provider Relief Fund (PRF) Federal Award Period: January 1, 2020 ? December 31, 2021 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): The Uniform Guidance 2 CFR Section 200.303 states, ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: The internal controls over the review and approval of expenses reported in the HRSA portal were not suitably documented to ensure all expenses were reviewed for allowability. Management did not retain its documentation over the review and approval of the PRF terms and conditions (TOCs). Cause: While management designed internal controls that required PRF expenditures to be reviewed by the Vice President of each facility within the Organization, the internal control was not implemented consistently across the Organization and supporting documentation of the review process was not retained. The Organization engaged a third party to review the PRF TOCs; however, supporting documentation of the review was not retained. Effect or Potential Effect: The lack of review and approval of expenses used for PRF reporting could result in unallowable expenses being charged to the program. The lack of documentation of the PRF TOCs could result in the Organization not being in compliance with the PRF TOCs. Questioned Costs: N/A Context: We selected two facilities within the Organization to obtain supporting documentation for the review of approval of PRF expenses; supporting documentation was not retained. The total Provider Relief Fund expenditures on the SEFA are $786,506,516 for the year ended December 31, 2021. Identification as a Repeat Finding, if Applicable: This is not a repeat finding. Recommendation: Management should implement internal controls to ensure expenses charged to federal programs are reviewed and approved, and supporting documentation is retained. Going forward, management should retain supporting documentation of its review and approval of the PRF TOCs. Views of Responsible Officials: Management will ensure that a comprehensive review, approval, and document retention process is applied consistently across all affected entities for any future PRF disbursements.

GSA_MIGRATION

Finding 2020-001 Activities Allowed or Unallowed, Allowable Costs/Cost Principles and Special Tests and Provisions Information on the Federal Program: Federal Grantor: United States Department of Health and Human Services Pass-Through Entity: Various Assistance Listing No.: Various, Research and Development Cluster (R&D) Pass-Through Award Number: Various Pass-Through Award Period: Various Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): The Uniform Guidance 2 CFR Section 200.303 states, ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? 45 CFR Part 75 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, Appendix IX to Part 75 ? Principles for Determining Costs Applicable to Research and Development Under Grants and Contracts with Hospitals, states: ?Charges for salaries and wages of individuals other than members of the professional staff will be supported by daily time and attendance and payroll distribution records. For members of the professional staff, current and reasonable estimates of the percentage distribution of their total effort may be used as support in the absence of actual time records.? ?In order to qualify as current and reasonable, estimates must be made no later than one month (though not necessarily a calendar month) after the month in which the services were performed. Estimates determined before the performance of services, such as budget estimates on a monthly, quarterly, or yearly basis do not qualify as estimates of effort spent.? Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) Sections 200.308(c)(1) (ii) and (iii)) of the audit guide ? For grants and cooperative agreements, a change in the principal investigator or project director or the disengagement from the project for more than three months, or a 25% reduction in time devoted to the project, by the approved project director or principal investigator. Condition: Advocate Aurora Health (AAH) utilized annual budget estimates determined before the performance of services to charge salaries and wages and benefits to the awards for the period January through December 2020. Per 45 CFR Part 75, a monthly effort certification is required to be performed no later than one month after the month in which the services were performed in order to qualify as current and reasonable. Changes in effort were not consistently monitored for principal investigators or project directors as effort reports were not prepared or reviewed in a timely manner. Additionally, AAH?s internal controls and procedures over charges of salaries and wages do not require a knowledgeable individual to review and approve the monthly effort certifications and are not designed to ensure changes in effort are reflected in a timely manner within the general ledger system. Cause: AAH does not have a system in place to monitor that effort certifications are signed by each employee no later than one month after the services were performed. In addition, AAH?s internal controls and procedures over effort reporting do not require a knowledgeable individual to review and approve the monthly effort certifications made by employees of actual performance of services subsequent to performance of services. Effect or Potential Effect: Effort certifications were not performed monthly for salaries and wages for the fiscal period related to research grant agreements. Additionally, the fringe benefits and indirect costs related to these salaries also could not be supported. Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) Changes in key personnel and effort were not monitored consistently or in a timely manner throughout the year. As a result, AAH may not have obtained approval for changes in key personnel or effort from the appropriate federal agency. Questioned Costs: Various Assistance Listing Nos. ? $30,636 represents the salary costs and the related fringe benefits and indirect costs applied to those salary costs for research grants during 2020 within our testing where the effort certification was not completed in a timely manner. Context: We selected a sample of 60 salaries and wages totaling $103,916, including related fringe benefits and indirect expense for the year ended December 31, 2020. We concluded effort certifications were not obtained monthly for 30 selections totaling $30,636, including fringe benefits and indirect expenses. We tested a sample of 15 grants to determine if changes in level of effort or key personnel were monitored. We identified two key personnel where an effort report was not obtained. Total salaries and wages, fringe benefits, and indirect costs related to the R&D Cluster were $2,344,055 for the year ended December 31, 2020. Total R&D expenditures are $2,378,603 for the year ended December 31, 2020. Identification as a Repeat Finding, if Applicable: This is a repeat finding; see finding 2019-001. Recommendation: Individuals should certify their effort on a monthly basis to ensure that salaries and wages are based on actual effort spent. AAH should design and implement internal controls to review the effort certified by an individual with knowledge of the employee?s effort. AAH should also design and implement internal controls to ensure changes in effort are reflected in a timely manner within the general ledger system. Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.

Finding 2020-002 Activities Allowed or Unallowed/ Allowable Costs/Cost Principles Information on the Federal Program: Federal Grantor: U.S. Department of Health and Human Services ? Centers for Disease Control and Prevention Pass-Through Entities: Illinois Department of Public Health Assistance Listing No.: 93.074, Hospital Preparedness Program (HPP) and Public Health Emergency Preparedness (PHEP) Aligned Cooperative Agreements Award/Subaward Nos.: See table below Award/Subaward Years: See table below Pass-Through Grant or Contract Number Federal Grant or Contract Number Location Budget Period 07280007H Hospital Preparedness (HPP) and Public Health Emergency Preparedness (PHEP) Aligned cooperative Agreements Christ 7/01/19?6/30/20 07280009H Hospital Preparedness (HPP) and Public Health Emergency Preparedness (PHEP) Aligned cooperative Agreements Sherman 7/01/19?6/30/20 17280007I Hospital Preparedness (HPP) and Public Health Emergency Preparedness (PHEP) Aligned cooperative Agreements Christ 7/01/20?6/30/21 I72800091 Hospital Preparedness (HPP) and Public Health Emergency Preparedness (PHEP) Aligned cooperative Agreements Sherman 7/01/20?6/30/21 Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: We selected a sample of 21 expenditures totaling $138,251 and identified 11 expenditures totaling $15,327 where there was no evidence of review and approval of the expenditure. Cause: AAH did not have suitably designed internal controls in place over the review and approval of allowable activities and allowable costs charged to the programs. In addition, there are no policies or procedures in place to require documentation of the review and approval of allowable costs charged to the programs. Questioned Costs: None. Context: Total federal expenditures for the Hospital Preparedness Program (HPP) and Public Health Emergency Preparedness (PHEP) Aligned Cooperative Agreements were $1,248,907 for the year ended December 31, 2020. Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) Effect or Potential Effect: Unallowable expenditures may be charged to the program and not identified in a timely manner. Identification as a Repeat Finding, if Applicable: This is not a repeat finding. Recommendation: Management should design internal controls over allowability of expenditures charged to the Hospital Preparedness Program (HPP) and Public Health Emergency Preparedness (PHEP) Aligned Cooperative Agreements programs and retain documentation to support the performance of the internal controls. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.

Finding 2020-003 Equipment and Real Property Management Information on the Federal Program: Federal Grantor: U.S. Department of Health and Human Services ? Centers for Disease Control and Prevention Pass-Through Entities: Illinois Department of Public Health Assistance Listing No.: 93.074, Hospital Preparedness Program (HPP) and Public Health Emergency Preparedness (PHEP) Aligned Cooperative Agreements Award/Subaward Nos.: See table below Award/Subaward Years: See table below Pass-Through Grant or Contract Number Federal Grant or Contract Number Location Budget Period 07280007H Hospital Preparedness (HPP) and Public Health Emergency Preparedness (PHEP) Aligned cooperative Agreements Christ 7/01/19?6/30/20 07280009H Hospital Preparedness (HPP) and Public Health Emergency Preparedness (PHEP) Aligned cooperative Agreements Sherman 7/01/19?6/30/20 17280007I Hospital Preparedness (HPP) and Public Health Emergency Preparedness (PHEP) Aligned cooperative Agreements Christ 7/01/20?6/30/21 I72800091 Hospital Preparedness (HPP) and Public Health Emergency Preparedness (PHEP) Aligned cooperative Agreements Sherman 7/01/20?6/30/21 Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Section 200.313(d)(1) of the Uniform Guidance states ?Property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property (including the federal award identification number), who holds title, the acquisition date, cost of the property, percentage of federal participation in the project costs for the federal award under which the property was acquired, the location, use and condition of the property, and any ultimate disposition data, including the date of disposal and sales price of the property.? Section 200.313(d)(2) of the Uniform Guidance states ?A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years (2 CFR section 200.313(d)(2).? Condition: AAH did not have suitably designed internal controls in place over the maintenance of property records and the performance of a physical inventory over equipment. In addition, the property records did not contain a serial number or other identification number or location of federal equipment. Additionally, AAH did not perform a physical inventory of federal equipment within the last two years. Cause: Management does not have sufficiently designed internal controls that require equipment records to contain the required data fields outlined in Section 200.313.(d)(1) or to require a physical inventory once every two years as outlined in section 200.313(d)(2). Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) Questioned Costs: None. Context: Total federal equipment on hand as of December 31, 2020, related to Hospital Preparedness Program (HPP) and Public Health Emergency Preparedness (PHEP) Aligned Cooperative Agreements were $102,742. Total federal expenditures for the Hospital Preparedness Program (HPP) and Public Health Emergency Preparedness (PHEP) Aligned Cooperative Agreements were $1,248,907 for the year ended December 31, 2020. Effect or Potential Effect: The inventory records are not complete, which may impair AAH?s ability to safeguard assets. We were unable to perform a physical inventory over federal equipment because the equipment records did not clearly identify the physical location of the assets. Identification a Repeat Finding, if Applicable: This is not a repeat finding. Recommendation: Management should design internal controls over equipment to ensure the equipment subledger includes all the required data fields and perform a physical inventory of its federal equipment. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.

Finding 2020-004 Procurement, Suspension and Debarment Information on the Federal Program: Federal Grantor: U.S. Department of Health and Human Services ? Centers for Disease Control and Prevention Pass-Through Entities: Illinois Department of Public Health Assistance Listing No.: 93.074, Hospital Preparedness Program (HPP) and Public Health Emergency Preparedness (PHEP) Aligned Cooperative Agreements Award/Subaward Nos.: See table below Award/Subaward Years: See table below Pass-Through Grant or Contract Number Federal Grant or Contract Number Location Budget Period 07280007H Hospital Preparedness (HPP) and Public Health Emergency Preparedness (PHEP) Aligned cooperative Agreements Christ 7/01/19?6/30/20 07280009H Hospital Preparedness (HPP) and Public Health Emergency Preparedness (PHEP) Aligned cooperative Agreements Sherman 7/01/19?6/30/20 17280007I Hospital Preparedness (HPP) and Public Health Emergency Preparedness (PHEP) Aligned cooperative Agreements Christ 7/01/20?6/30/21 I72800091 Hospital Preparedness (HPP) and Public Health Emergency Preparedness (PHEP) Aligned cooperative Agreements Sherman 7/01/20?6/30/21 Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) Federal Grantor: Department of Justice Pass-Through Entities: State of Wisconsin Dept of Justice; Illinois Criminal Justice Information Authority Assistance Listing No.: 16.575, Crime Victim Assistance Award/Subaward Nos.: See table below Award/Subaward Years: See table below Pass-Through Grant or Contract Number Federal Grant or Contract Number Location Budget Period 15165 Crime Victim Assistance Wisconsin 10/1/19?9/30/20 672005 Crime Victim Assistance Illinois 5/11/20?6/30/20 217490 Crime Victim Assistance Illinois 10/1/19?9/30/20 218490 Crime Victim Assistance Illinois 10/1/20?9/30/21 218492 Crime Victim Assistance Illinois 10/1/20?9/30/21 Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Section 200.320(a) and (b) of the Uniform Guidance states ? Micro-purchases may be awarded without soliciting competitive quotations if the non-federal entity considers the price to be reasonable. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources. Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) ?For acquisitions exceeding the simplified acquisition threshold, the non-federal entity must use one of the following procurement methods: the sealed bid method if the acquisition meets the criteria in 2 CFR section 200.320(c); the competitive proposals method under the conditions specified in 2 CFR section 200.320(d); or the noncompetitive proposals method (i.e., solicit a proposal from only one source) but only when one or more of four circumstances are met, in accordance with 2 CFR section 200.320(f).? Per AAH?s procurement policy, transactions over $10,000 require a minimum of at least 3 quotes or bids from vendors, which can be obtained either online or by email. Section 180.300 of the Uniform Guidance states that when a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity with whom you intend to do business is not excluded or disqualified. This verification may be accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration (GSA), (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity. Condition: AAH does not have procurement policies and procedures in place in accordance with Section 200.320(a), (b), and (c). AAH did not obtain an adequate number of quotes or bids from its vendors for procurements over the small purchase threshold or AAH?s purchasing policy. Management did not verify the entities they did business with during fiscal 2020 were not excluded or disqualified before entering into a covered transaction. Cause: Management does not sufficiently design internal controls over procurement, suspension and debarment. Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) Questioned Costs: $360,019 ? represents the amount of procurements for the HPP/PHEP program where the appropriate federal procurement procedures were not performed and management did not verify the vendor was not excluded or disqualified. $153,999 ? represents the total amount of procurements for the Crime Victim Assistance program as there are not policies or procedures in place to ensure the appropriate suspension and debarment procedures are being performed. Context: Hospital Preparedness Program (HPP) and Public Health Emergency Preparedness (PHEP) Aligned Cooperative Agreements: We selected a sample of 31 procurement transactions for the HPP/PHEP program totaling $386,152. We identified 15 transactions totaling $210,344 above the small purchase threshold (>$3,500) and concluded the required number of quotes and bids were not obtained. We identified 1 transaction totaling $152,675 above the simplified acquisition threshold and noted sealed bids were not obtained. New vendors are checked upon setup to determine they are not excluded or debarred. However, entities were not reviewed throughout 2020 to verify they were not suspended or debarred before entering into a covered transaction. Total federal expenditures subject to the procurement, suspension and debarment process related to Hospital Preparedness Program (HPP) and Public Health Emergency Preparedness (PHEP) Aligned Cooperative Agreements were $785,580. Total federal expenditures for the Hospital Preparedness Program (HPP) and Public Health Emergency Preparedness (PHEP) Aligned Cooperative Agreements were $1,248,907 for the year ended December 31, 2020. Crime Victim Assistance: New vendors are checked upon setup to determine they are not excluded or debarred. However, entities were not reviewed throughout 2020 to verify they were not suspended or debarred before entering into a cover transaction. Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) Total federal expenditures subject to the procurement, suspension and debarment process were $153,999. Total federal expenditures for the Crime Victim Assistance program were $1,801,008 for the year ended December 31, 2020. Effect or Potential Effect: An adequate number of quotes or bids was not obtained for procurements above the small purchase threshold. Purchases may have been entered into without obtaining the most reasonable price. AAH may use a vendor who has been suspended and debarred after the initial setup. Identification a Repeat Finding, if Applicable: This is not a repeat finding. Recommendation: Management should design internal controls over procurement, suspension and debarment to be in compliance with the Uniform Guidance regulations. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.

Finding 2020-005 Allowable Costs/Cost Principles Information on the Federal Program: Federal Grantor: Department of Justice Pass-Through Entities: State of Wisconsin Dept of Justice Assistance Listing No.: 16.575, Crime Victim Assistance Award/Subaward Nos.: 15165 Award/Subaward Years: October 1, 2019 to September 30, 2020 October 1, 2020 to September 30, 2021 Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Per the State of Wisconsin Department of Justice Crime Victim Assistance grant agreement (Attachment B), AAH is required to ?certify in writing that the rental rate funded under the grant is consistent with the prevailing rate in the local area and shall maintain documentation on file to support such determination.? Condition: AAH did not maintain documentation to support its rental rate is consistent with the prevailing rate in the local area. Cause: Management did not sufficiently design internal controls over the development of the building rent charged to the grant or retain supporting documentation of the rent certification. Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) Questioned Costs: $35,721 ($34,327 represents federal portion of the rent expense and $1,484 represents the match made by AAH.) Context: Total federal expenditures for the Crime Victim Assistance award were $1,801,008, and the total federal expenditures for the State of Wisconsin portion of the Crime Victim Assistance award were $622,437 for the year ended December 31, 2020. Effect or Potential Effect: Rent charged to the grant may not be consistent with the prevailing rate in the local area. Identification a Repeat Finding, if applicable: This is not a repeat finding. Recommendation: Management should design internal controls over the development of the building rent charged to the grant and retain supporting documentation of the rent certification. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.

Finding 2020-006 Allowable Costs/Cost Principles Information on the Federal Program: Federal Grantor: United States Department of Health and Human Services Pass-Through Grantor: Various Assistance Listing No.: Various, Research and Development Cluster Pass-Through Award Number: Various Pass-Through Award Period: Various Criteria or specific requirement (including statutory, regulatory or other citation): The Uniform Guidance 2 CFR Section 200.303 states, ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: AAH does not have internal controls in place to ensure new grants are set up correctly in the research accounting system. During the grant setup process, indirect and fringe percentages are entered into the system based on the terms of the grant agreement. When salary is charged to the grant, the system automatically calculates the fringe and indirect amounts based on the percentages entered previously during the setup of the grant. Cause: AAH?s internal controls and procedures over the grant setup process are not sufficiently designed to require a knowledgeable individual to review and approve the information entered into the system. Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) Effect or Potential Effect: Information entered during the setup of the grant could be entered incorrectly causing incorrect fringe and indirect amounts charged to the grant. Questioned Costs: None. Context: There were two new grants set up in the system that were material in 2020. Total R&D expenditures were $2,344,055 for the year ended December 31, 2020. Recommendation: AAH should design and implement internal controls to review the information entered during the setup of the grant. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding

Finding 2020-007 Allowable Costs/Cost Principles and Eligibility Information on the Federal Program: Federal Grantor: United States Department of Health and Human Services Health Resources and Services Administration (HRSA) Pass-Through Grantor: N/A Assistance Listing No.: 93.461, COVID 19 Testing, Treatment and Vaccination Administration for the Uninsured (Uninsured Program) Pass-Through Award Number: N/A Pass-Through Award Period: February 4, 2020 through December 31, 2020 Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Health and Human Services (HHS) ? Health Resources and Services and Administrative (HRSA) issued Terms and Conditions for Participation in the HRSA COVID 19 Claims Reimbursement to Health Care Providers and Facilities for Testing, Treatment, and Vaccine Administration for the Uninsured Program (T&Cs) outlining requirements that recipients of funding from the COVID 19 Uninsured Program must comply with including the following sections: Testing Services, Treatment Services and Vaccine Administration, and General Provisions in FY2020 Consolidated Appropriations. Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) Per the HRSA T&Cs and further clarified in the HRSA FAQs for COVID 19 Claims Reimbursement to Health Care Providers and Facilities for Testing, Treatment and Vaccine Administration, the FAQ states the following: ?If a provider tests for COVID 19 as part of pre-operative or other medical treatment unrelated to COVID 19, is the test eligible for reimbursement? For the COVID 19 Uninsured Program, COVID 19 testing is eligible for reimbursement if one of the following diagnoses codes is included in any position on the claim: ? Z03.818 ? Encounter for observation for suspected exposure to other biological agents ruled out (possible exposure to COVID 19) ? Z11.59 ? Encounter for screening for other viral diseases (asymptomatic) ? Z20.828 ? Contact with and (suspected) exposure to other viral communicable (confirmed exposure to COVID 19) ? Z11.52 ? Encounter for screening for COVID 19 (asymptomatic) ? Z20.822 ? Contact with and (suspected) exposure to COVID 19 ? Z86.16 ? Personal history of COVID 19 Related treatment visits and services are not eligible for reimbursement given the primary reason for treatment is not COVID 19.? Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) Per the HRSA T&Cs for COVID 19 testing and testing-related items: ?FFCRA Uninsured Individuals means individuals who, as of the date of service for which Recipient seeks Payment, are not enrolled in? ? A Federal health care program (as defined under section 1128B(f) of the Social Security Act (42 U.S.C. 1320a-7b(f)), including an individual who is eligible for medical assistance only because of subsection (a)(10)(A)(ii)(XXIII) of Section 1902 of the Social Security Act; or ? A group health plan or health insurance coverage offered by a health insurance issuer in the group or individual market (as such terms are defined in section 2791 of the Public Health Service Act (42 U.S.C. 300gg-91)), or a health plan offered under chapter 89 of title 5, United States Code.? Per the HRSA T&Cs for COVID 19 treatment: Uninsured individuals are ?individuals who do not have any health care coverage at the time the services were provided.? Condition: AAH did not document its compliance with the COVID 19 Uninsured Program T&Cs. Internal controls over the determination of a patient?s uninsured/self-pay status were not operating effectively. In addition, inadequate support was retained in the patient billing and recordkeeping system related to the determination of the patient?s uninsured/self-pay status and in some instances, no support was retained. For certain emergency department and physician office visits that included COVID 19 testing, but COVID 19 was not the primary reason for the related treatment visit and services, AAH erroneously billed the COVID 19 Uninsured Program for the entire encounter, which was not in compliance with the COVID 19 Uninsured Program regulations. Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) AAH did not properly develop or retain audit evidence to support the report logic that was developed to identify patients from the patient billing system that were identified as uninsured and as having an allowable COVID 19 testing and treatment or vaccination diagnostic code with uninsured eligibility determination in accordance with the terms of the federal program. Additionally, a risk exists that the data relevant to the COVID 19 Uninsured Program stored within the patient accounting system may be inappropriately created or modified. Evidence of the operation of controls identified to address this risk during the fiscal period under audit was not retained. In addition, supporting documentation was not retained to validate who had access to modify the report script for the generation of the Uninsured report, what changes were made to the script during the fiscal year and how management validated the completeness and accuracy of the data extracted by the script. Cause: AAH did not have internal controls in place to monitor the Program T&Cs and underlying COVID 19 Uninsured Program regulations during the COVID 19 pandemic. Internal controls were not consistently performed and documented related to the determination of a patient?s uninsured/self-pay status. AAH did not have internal controls in place to formally document its compliance with the COVID 19 Uninsured Program?s allowability requirements. Outpatient encounters that included a COVID 19 testing diagnosis code, with primary treatment diagnosis code not COVID 19 related, were not reviewed prior to submission to HRSA to verify treatment costs were allowable under the COVID 19 Uninsured Program. Management did not retain sufficient supporting documentation to provide evidence that controls over report writing, data integrity, review of uninsured status, and acceptance and compliance with the terms and conditions for this major program were designed effectively and placed in operation during the period under audit. Additionally, management improperly developed the report writer to include ineligible accounts per the HRSA guidelines. Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) Effect or potential effect: AAH could be in noncompliance with the COVID 19 Uninsured Program T&Cs. A patient may not be uninsured and therefore the related encounter may be ineligible for reimbursement under the COVID 19 Uninsured Program. Certain claims submitted to the COVID 19 Uninsured Program were for unallowable activities and were therefore, not eligible for reimbursement under the COVID 19 Uninsured Program. Additionally, evidence of controls addressing the risk that data within the patient accounting system may be inappropriately created or modified was not retained. The report used to identify eligible federal program participants could be incomplete or patients could be inappropriately identified as eligible, services could be reimbursed by HRSA for unallowable charges or patients could be inappropriately billed for services that HRSA reimbursed under this program. Further, AAH could not be in compliance with terms and conditions of the program. Questioned Costs: Assistance Listing 93.461 ? $17,640 Context: We sampled 40 claims totaling $456,863 in federal expenditures (reimbursements) for services that were billed and reimbursed by the COVID 19 Uninsured Program and identified 7 selections that were inappropriately billed to HRSA representing $17,640 in reimbursement. Total federal expenditures for Assistance Listing 93.461 totaled $5,865,236 for the year ended December 31, 2020. Recommendation: AAH should implement internal controls to document its review and compliance with the COVID 19 Uninsured Program T&C?s. Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) AAH should implement sufficiently precise internal controls to review changes to the COVID 19 Uninsured Program to ensure it is administering the program in compliance with the COVID 19 Uninsured Program regulations. In addition, internal controls should be implemented to ensure claims submitted to the COVID 19 Uninsured Program meet the allowability criteria established by the COVID 19 Uninsured Program regulations before claims are submitted to HRSA for reimbursement. Standard policies, procedures, and internal controls over the review for patient insurance coverage balances should be updated to address the unique aspects of the COVID 19 Uninsured Program. Management should retain documentation of the operation of controls responsive to risks related to the data stored in their IT systems as evidence of control activities. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.

Finding 2020-008 Matching Information on the Federal Program: Federal Grantor: U.S. Department of Health and Human Services ? Centers for Disease Control and Prevention Pass-Through Entities: Illinois Department of Public Health Assistance Listing No.: 93.074, Hospital Preparedness Program (HPP) and Public Health Emergency Preparedness (PHEP) Aligned Cooperative Agreements Award/Subaward Nos.: See table below Award/Subaward Years: See table below Pass-Through Grant or Contract Number Federal Grant or Contract Number Location Budget Period 07280007H Hospital Preparedness (HPP) and Public Health Emergency Preparedness (PHEP) Aligned cooperative Agreements Christ 7/01/19?6/30/20 07280009H Hospital Preparedness (HPP) and Public Health Emergency Preparedness (PHEP) Aligned cooperative Agreements Sherman 7/01/19?6/30/20 17280007I Hospital Preparedness (HPP) and Public Health Emergency Preparedness (PHEP) Aligned cooperative Agreements Christ 7/01/20?6/30/21 I72800091 Hospital Preparedness (HPP) and Public Health Emergency Preparedness (PHEP) Aligned cooperative Agreements Sherman 7/01/20?6/30/21 Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Per the grant agreements between the State of Illinois, Department of Health, and Advocate Health and Hospitals Corporation dba Advocate Christ Medical Center, and Advocate Sherman Hospital (Grants 17280007I and 17280009I, respectively) for Hospital Preparedness ? Regional Hospital Coordinating Center, Section G.2.1.3, ?Grantee is required to claim a 10% match (cash or In Kind) as part of their budget.? For grant agreements 07280007H and 07280009H, the cost share is identified as 10% of expenditures as written in the Grant Budget Detail for Hospital Preparedness ? Regional Hospital Coordinating Center 2020 for both Advocate Christ Medical Center and Advocate Sherman Hospital. Condition: Advocate Aurora Health did not have suitably designed internal controls in place over the review of matching requirements outlined in the State grant agreement. Further, we were unable to test AAH?s compliance with the match requirement. Cause: AAH?s internal controls and procedures are not sufficiently designed to require supporting documentation be retained to ensure that the required matching contributions were met, or to ensure that the sources of matching contributions were allowable. Questioned Costs: Unknown Section III ? Federal and State of Wisconsin Award Findings and Questioned Costs (continued) Context: Total program expenditures for the Hospital Preparedness Program (HPP) and Public Health Emergency Preparedness (PHEP) Aligned Cooperative Agreements for the year ended December 31, 2020, was $1,248,907. Per the grant agreements, the match is required to be 10% per grant year. Recommendation: Management should design internal controls and retain documentation over the review of the match to ensure matching contributions are met and that sources of matching contributions are allowable. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.

Finding 2019-001 Material Weakness ? Allowable Costs/Cost Principles Research and Development Cluster Federal Grantor: United States Department of Health and Human Services Pass-Through Grantor: Various CFDA No.: Various Pass-Through Award Number: Various Pass-Through Award Period: Various Criteria or specific requirement (including statutory, regulatory or other citation): The Uniform Guidance 2 CFR Section 200.303 states, ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? 45 CFR Part 75 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, Appendix IX to Part 75 ? Principles for Determining Costs Applicable to Research and Development Under Grants and Contracts with Hospitals, states: Charges for salaries and wages of individuals other than members of the professional staff will be supported by daily time and attendance and payroll distribution records. For members of the professional staff, current and reasonable estimates of the percentage distribution of their total effort may be used as support in the absence of actual time records. In order to qualify as current and reasonable, estimates must be made no later than one month (though not necessarily a calendar month) after the month in which the services were performed. Estimates determined before the performance of services, such as budget estimates on a monthly, quarterly, or yearly basis do not qualify as estimates of effort spent. Condition: The Illinois-based research grant agreements of Advocate Aurora Health (AAH) utilized annual budget estimates determined before the performance of services to charge salaries and wages and benefits to the awards for the period January through May 2019. Per 45 CFR Part 75, a monthly effort certification is required in order to qualify as current and reasonable. The process followed by management did not meet this monthly requirement. Additionally, AAH?s internal controls and procedures over charges of salaries and wages do not require a knowledgeable individual to review and approve the monthly effort certifications. Additionally, internal controls are not designed to ensure changes in effort are reflected timely within the general ledger system. Cause: Internal controls over effort certification were not in place for the period January through May 2019 for Illinois-based research grants. AAH?s internal controls and procedures over charges of salaries and wages do not require a knowledgeable individual to review and approve the monthly effort certifications made by employees of actual performance of services subsequent to performance of services. Additionally, internal controls are not suitably designed to ensure changes in effort are reflected timely within the general ledger system. Effect or potential effect: Effort certifications were not performed monthly for salaries and wages for the period January through May 2019 for Illinois-based research grant agreements. Additionally, the fringe benefits and indirect costs related to these salaries could also not be supported. Questioned costs: Various CFDA #s ? $59,241 ? questioned costs represent the salary costs and the related fringe benefits and indirect costs applied to those salary costs for Illinois-based research grants for the period January through May 2019. Context: We selected a sample of 60 salaries and wages expenses from throughout 2019 and obtained the effort certifications. We noted effort certifications were not obtained monthly for Illinois-based research grants for January through May 2019, which represented 18 selections out of a sample of 60 transactions. Total salaries and wages, fringe benefits, and indirect costs related to the R&D Cluster were $1,749,423 of which $59,241 was related to Illinois-based research grants for January through May 2019. Identification as a repeat finding, if applicable: This is a repeat finding for the major program related to finding 2018-001 of the Advocate Health Care Network audit from the prior year. Recommendation: Individuals should certify their effort on a monthly basis to ensure that salaries and wages are based on actual efforts spent. AAH should design and implement internal controls to review the effort certified by an individual with knowledge of the employee?s effort. AAH should design and implement internal controls to ensure changes in effort are reflected timely within the general ledger system. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Finding 2019-002 ? Significant Deficiency ? Cash Management Information on the federal program: Research and Development Cluster Federal Grantor: United States Department of Health and Human Services Pass-Through Grantor: Various CFDA No.: Various Pass-Through Award Number: Various Pass-Through Award Period: Various Criteria or specific requirement (including statutory, regulatory, or other citation): The Uniform Guidance 2 CFR Section 200.303 states, ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: The Wisconsin-based research grant agreements of AAH include fixed price or fee-for-service grant agreements that are funded based on milestones achieved and/or actual production. The payments are paid by the program sponsor to AAH based on milestones achieved and/or production reported. AAH does not invoice the program sponsor. There are not internal controls to ensure the appropriateness of the cash received by AAH based on milestone achievement and/or production. Cause: Management does not have internal controls addressing the appropriateness of cash received by AAH for Wisconsin-based fixed price or fee-for-service research grant agreements that are funded to AAH based on milestones achieved and/or actual production. Effect or potential effect: Cash could be received for fixed price or fee-for-service research grant agreements that is not representative of the milestones achieved or services provided to date. Questioned costs: None. Context: Total R&D expenditures are $1,928,530 and the total amount of grants subject to fixed price or fee-for-service grant agreements is $96,834. We selected a sample of 9 payments received for fixed price and fee-for-service grant agreements. While management validated the cash received was appropriately paid for clinical trial patients served, management did not have internal controls to ensure the appropriateness of the cash received by AAH for Wisconsin-based research grant agreements that are funded to AAH based on milestones achieved and/or actual production. Identification as a repeat finding, if applicable: This is not a repeat finding. Recommendation: AAH should design and implement internal controls to review the appropriateness of the cash received by AAH for Wisconsin-based research grant agreements for which AAH is paid based on milestones achieved and/or actual production. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Finding 2019-003 ? Material Weakness ? Special Tests and Provisions Information on the federal program: Research and Development Cluster Federal Grantor: United States Department of Health and Human Services Pass-Through Grantor: Various CFDA No.: Various Pass-Through Award Number: Various Pass-Through Award Period: Various Criteria or specific requirement (including statutory, regulatory, or other citation): The Uniform Guidance 2 CFR Section 200.303 states, ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: AAH did not have a documented internal control in operation for review of changes in effort and/or continued involvement of key personnel, as required by 2 CFR Sections 200.308(c)(1) (ii) and (iii). Cause: Management does not have a documented internal control to review for changes in effort and/or continued involvement of key personnel named in cost-reimbursement grant awards. Effect or potential effect: Changes in key personnel or changes in effort may occur and not be reported timely to the federal agency providing the funding. Questioned costs: None. Context: There was no suitably designed control for reviewing changes in effort and continued involvement of key personnel. We selected a sample of 12 out of 16 cost-reimbursement grant agreements that were in place during 2019. We identified all key personnel named in the 12 agreements tested and that no changes in effort took place that were required to be reported to the applicable federal agency. Total salaries and wages, fringe benefits, and indirect costs related to the R&D Cluster were $1,749,423. Total expenditures in the R&D cluster were $1,928,530. Identification as a repeat finding, if applicable: This is not a repeat finding. Recommendation: AAH should design and implement internal controls to review planned versus actual involvement of key personnel and to obtain federal award agency approval of changes in key personnel or changes in the time commitment of key personnel as required by CFR Sections 200.308(c)(1) (ii) and (iii). Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Finding 2019-004 ? Scope Limitation ? Eligibility Information on the federal program: WIC Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Federal Grantor: United States Department of Agriculture Food and Nutrition Service Pass-Through Grantor: State of Wisconsin Department of Health Services ? Wisconsin Department of Health and Family Services CFDA No.: 10.557 Pass-Through Award Number: 154710 Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): Applicants for WIC program benefits are screened at WIC clinic sites to determine their WIC eligibility. To be certified eligible, they must meet the following eligibility criteria (7 CFR Sections 246.7(c), (d), (e), (g), and (l)): (a) Categorical ? Eligibility is restricted to pregnant, postpartum and breastfeeding women; infants; and children up to their fifth birthday (7 CFR Sections 246.2 (definition of each category) and 246.7(c)). (b) Identity and Residency ? Except in limited circumstances, WIC applicants must be physically present for eligibility screenings and must provide proof of identity. An applicant must also meet the state agency residency requirement. Except in the case of Indian state agencies, the applicant must reside in the jurisdiction of the state. Indian state agencies may require applicants to reside within their jurisdiction. (c) Income ? An applicant must meet an income standard established by the state agency or be determined to be automatically (adjunctively) income-eligible based on documentation of his or her eligibility, or certain family members? eligibility, for the following federal programs: (1) Temporary Assistance for Needy Families, (2) Medicaid, or (3) Supplemental Nutrition Assistance Program (formerly the Food Stamp Program). State agencies may also determine an individual automatically income eligible, based on documentation of his or her eligibility for certain state-administered programs. (d) Nutritional Risk ? A competent professional authority (e.g., physician, nutritionist, registered nurse, or other health professional) must determine that the applicant is at nutritional risk. While the broad guidelines for determining nutritional risk are set forth in WIC legislation and regulations, the specific allowable nutritional risk criteria are defined in WIC policy guidance, which is updated periodically. Each state agency may choose which allowable nutritional risk criteria will be used to determine eligibility. When an applicant meets all eligibility criteria, he or she is determined by WIC clinic staff to be eligible for program benefits. Certification periods are assigned to each participant based on categorical status for women, infants, and children (7 CFR Section 246.7(g)). A WIC local agency assigns each eligible person a priority classification according to the classification system described in 7 CFR Section 246.7(e)(4). A person?s priority assignment reflects the severity of his or her nutritional risk. If the local agency cannot immediately place the person on the program for lack of an available caseload slot, the person is placed on a waiting list. Caseload vacancies are filled from the waiting list in priority classification order. State agencies are expected to target program outreach and caseload management efforts toward persons at greatest nutritional risk (i.e., those in the highest priority classifications). Pregnant women are certified for the duration of their pregnancies and for up to six weeks postpartum. Breastfeeding women may be certified approximately every six months, up to one year postpartum, or until the woman ceases breastfeeding, whichever occurs first (7 CFR Section 246.7(g)(1)). Infants are certified at intervals of approximately six months, except that infants under six months of age may be certified for a period extending up to the child?s first birthday, provided the quality and accessibility of health care services are not diminished. Children are certified for six-month intervals ending with the last day of the month in which the child reaches the fifth birthday. State agencies also have the option to certify children for a period of one year if the state agency ensures that the child receives the required health and nutrition assessments (7 CFR Section 246.7(g)(1)). Non-breastfeeding women are certified for up to six months postpartum. All categories of participants may be certified up to the last day of the last month of the certification period (7 CFR Section 246.7(g)(1)). Condition: Advocate Aurora Health, Inc. screens applicants for eligibility by following the state of Wisconsin guidelines as provided through the ROSIE system used to enter, track, and store information about applicants. Based on guidance contained in 7 CFR Section 246, states were encouraged to move to a paperless system. Specifically, federal guidance contained in 7 CFR 246.7 (i)(4) and (5)(i) outlines acceptable documentation to be included on certification forms as (1) a description of the document(s) used to determine residency and identity or a copy of the document(s) used or the applicant?s written statement when no documentation exists and (2) a description of the document(s) used to determine income eligibility or a copy of the document(s) in the file. The state of Wisconsin has followed that guidance and does not require Advocate Aurora Health, Inc. to retain copies of an applicant?s proof of residence, income, etc., regarding eligibility. Therefore, we were not able to test internal controls over compliance or compliance over the eligibility compliance requirement through re-performance and we have issued a qualified opinion based on the scope limitations. Questioned Costs: None. Repeat Finding: Yes. Context: Federal expenditures reported in the schedule of expenditures of federal awards for CFDA 10.557 totaled $584,989 for the year ended December 31, 2019. Cause: Advocate Aurora Health, Inc. follows a paperless system as supported by the state of Wisconsin and the U.S. Department of Agriculture. The state does not require third-party supporting documentation of eligibility determinations to be retained. Effect: Due to the online nature of the eligibility system, the program does not have documentation available for the audit team to test compliance with the eligibility requirement. A scope limitation qualified opinion was issued for CFDA 10.557/CARS 154710 as we were unable to obtain sufficient documentation supporting the compliance of Advocate Aurora Health, Inc. regarding eligibility. Recommendation: No further follow-up is required, as management of Advocate Aurora Health, Inc. is following the applicable guidance. Views of responsible officials and planned corrective actions: Management agrees with the finding and has developed a plan to correct the finding.