BAY AREA HOSPITAL DISTRICT

FINDING 2023-001 – Material Weakness in Internal Controls over Compliance and Material Noncompliance Federal award: U.S. Department of Health and Human Services Provider Relief Fund and American Rescue Plan Rural Distribution – Assistance Listing Number 93.498 Criteria: According to the Single Audit Act and the Office of Management and Budget (OMB) Uniform Guidance (2 CFR §200.501), non-federal entities that expend $750,000 of more in federal awards in a year are required to have a single audit. Schedule of Expenditures of Federal Awards (SEFA) reporting amounts for the Provider Relief Fund (PRF) and American Rescue Plan (ARP) Rural Distribution program are based upon the PRF report that is required to be submitted to the HRSA reporting portal. The last day a provider can use the funds drives inclusion of the PRF amount on the SEFA (OMB Compliance Supplement 2023 4-93.498-9.) Condition: The Hospital omitted $6,955,649 of Period 4 Provider Relief Funds in its draft SEFA for the year-ended June 30, 2023. The Hospital did not engage an auditor to perform a single audit of the June 30, 2023 financial statements in a timely manner because the SEFA omissions led it to believe its federal expenditures were below the threshold that required a single audit. Cause: The Hospital's current accounting team was unaware of the PRF funds, as they had been fully expended in a prior fiscal year under a different accounting team and the employee responsible for monitoring the funds had departed. The team's unfamiliarity with the unique SEFA reporting requirements for PRF funds, which differ from most other federal programs, led to the oversight. Effect: The Hospital did not engage an auditor to perform a single audit within the timeline required for timely single audit submission. Questioned Costs: None. Context: The Hospital's staff accountants not aware of the PRF funds, as they had been entirely spent in a previous fiscal year by a previous accounting team. Unfamiliar with the unique SEFA reporting requirements for PRF funds, the current team didn't consider reviewing prior year expenditures for potential inclusion in the current year's SEFA. Typically, federal programs are reported on the SEFA in the year of expenditure, but PRF funds are an exception, needing to be reported on the last day a provider could use the funds. The 2023 SEFA draft, prepared by staff accountants without senior management review and without knowledge of the PRF reporting requirement, led the Hospital to mistakenly believe they were under the threshold for single audit reporting for the year-ended June 30, 2023. Repeat finding: No. Recommendation: We recommend that the Hospital implement controls to review the SEFA prepared by lower-level accounting staff. We also recommend that the Hospital monitor reporting requirements for awards of federal funds through the entire life of the award, including identifying changes in reporting requirements and special reporting requirements imposed by the federal government, and ensuring those reporting requirements are communicated to those responsible for reviewing the SEFA and determining whether a Single Audit is required. Views of responsible officials: Management concurs with the finding and has developed a corrective action plan.

FINDING 2023-002 – Reporting – Material Weakness in Internal Controls over Compliance and Material Noncompliance Federal award: U.S. Department of Health and Human Services Provider Relief Fund and American Rescue Plan Rural Distribution – Assistance Listing Number 93.498 Criteria: Non-federal entities must maintain internal control to provide reasonable assurance of compliance with laws, regulations and the provisions of grant agreements and contracts, including reporting requirements (2 CFR §200.303.) Recipients of Provider Relief Fund payments must submit reports and maintain documentation as the Secretary determines are needed to ensure compliance with conditions that are imposed by the Terms and Conditions for the General and Targeted Distributions, the Coronavirus Aid, relief and Economic Security Act (P.L. 116-136), the Paycheck Protection Program and Health Care Enhancement Act (P.L. 116-136), and the Consolidated Appropriations Act (Division M of P.L. 116-260.) Condition: The Hospital’s internal controls over compliance did not consider continuity when key personnel responsible for performing controls depart. As a result, the Hospital did not timely file the PRF report for Period 4 PRF funds. Effect: The Hospital submitted the Period 4 PRF report after the reporting deadline. Cause: The Hospital’s internal controls over compliance were not designed to ensure continuity of controls when key personnel departed. Questioned costs: None. Context: The CFO was the authorized reporter for the PRF funds and departed the Hospital before filing the PRF report. There was no process in place to monitor the PRF reporting requirements after the departure of the authorized reporter. A backup control to monitor the email of former employees for important emails failed when the personnel responsible for that control also departed. As a result, the Hospital did not file the Period 4 PRF report and was unaware of the missed deadline until February 2, 2024 when it received two letters of non-compliance from the Health Resources and Services Administration (HRSA) with a demand for repayment. The Hospital submitted the Phase 4 submission late on April 30, 2024 and after review, the HRSA rescinded its demand for repayment. Repeat finding: No. Recommendation: We recommend the Hospital redesign its internal controls to consider continuity of controls when key personnel depart. Views of responsible officials: Management concurs with the finding and has developed a corrective action plan.