Cedars-Sinai Health System

Internal control deficiency and noncompliance over Activities Allowed or Unallowed and Allowable Costs/Cost Principles related to salary cap limitation. Identification of the federal program: Research and Development Cluster See the Schedule of Findings and Questioned Costs for table. Criteria or specific requirement (including statutory, regulatory or other citation): Title 2, Subtitle A, Chapter II, Part 200, Subpart D, 200.303 – Internal controls. The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2, Subtitle A, Chapter II, Part 200, Subpart D, 200.300(b) – Statutory and national policy requirements: The non-Federal entity is responsible for complying with all requirements of the Federal award. The National Institutes of Health Grants Policy Statement section 4.2.10 – Salary Cap/Salary Limitation states the following: None of the funds appropriated in the governing appropriations Act for NIH (the Act), shall be used to pay the salary of an individual through a grant or other extramural mechanism at a rate in excess of that prescribed in the Act. Applications and proposals with categorical direct costs budgets reflecting direct salaries of individuals in excess of the rate prescribed in the Act will be adjusted in accordance with the legislative salary limitation. Current and historical information on the applicable salary cap for each fiscal year is on the National Institutes of Health web page. Condition: During our testing over salaries and wages expenditures, we observed management did not have effective internal controls in place to ensure individuals were not charged and reimbursed from the grantor in excess of the salary cap limitation. Cause: Management did not have effective internal controls in place over the compliance requirement as stated in the criteria or specific requirement section above. Effect or potential effect: Management was reimbursed from the grantor for salaries and wages expenditures in excess of the salary cap limitation. Questioned costs: $68 – Assistance Listing Number 93.837, Award Identification Number – 2R01HL131532-06A1 $103 – Assistance Listing Number 93.846, Award Identification Number – 5UH3AR076573-04 Questioned costs were computed by taking the difference between the salary cap limitation and the employee’s hourly rate multiplied by the hours worked and time and effort percentage. We then applied the fringe benefit and indirect cost rates on this calculated balance. Context: During our testing over salaries and wages expenditures, we obtained a listing of 34,069 salaries and wages expenditures that the entity did not tag in the system to have a reduction to the salary cap and selected a sample of 40. The total value of the 40 salaries and wages expenditures was $33,970 out of the total population of $28,569,553. There were 2 out of 40 selections where the entity was reimbursed from the grantor in excess of the salary cap limitation. Identification as a repeat finding, if applicable: No. Recommendation: We recommend management refund the questioned costs to the grantor and develop and implement effective internal controls to ensure future salaries and wages expenditures are reduced to the salary cap limitation prior to submission to the grantor for reimbursement. Views of responsible officials: In response to this finding management will implement the following: We are revising our internal controls to more frequently perform our salary cap reconciliation ensuring the appropriate sponsor invoicing for employees who are over the salary cap limitation. For the salary cap variances that were identified through the previous reconciliation process, they will be adjusted and posted by the close of our March 2024 accounting period. Lastly, we will offset our cash for the March 2024 letter of credit draw down process in the Payment Management System, and incorporate adjustments in our March 2024 invoices for federal pass-thru awards. In addition, the salary cap adjustment program in our new ERP system was designed to remove the defect experienced in our legacy system.

Internal control deficiency and noncompliance over Equipment and Real Property Management related to the physical inventory of property. Identification of the federal program: Research and Development Cluster See the Schedule of Findings and Questioned Costs for table. Criteria or specific requirement (including statutory, regulatory or other citation): Title 2, Subtitle A, Chapter II, Part 200, Subpart D, 200.303 – Internal controls. The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2, Subtitle A, Chapter II, Part 200, Subpart D, Property Standards, 200.313(d)(2) – Equipment. A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. Condition: During our testing over equipment and real property management, we observed management did not have effective internal controls in place to ensure a physical inventory of the property which must be taken and the results reconciled with property records was completed at least once every two years. Cause: Management did not have effective internal controls in place over the compliance requirement as stated in the criteria or specific requirement section above. Effect or potential effect: A physical inventory of the property which must be taken and the results reconciled with property records was not completed at least once every two years. This could potentially result in the property records not reconciling with the actual property present at the entity’s facilities. Questioned costs: None. Context: During our testing over equipment and real property management, we obtained a listing of property that had a net book value of $2,377,270. We observed management did not perform a physical inventory of this property. Identification as a repeat finding, if applicable: No. Recommendation: We recommend management develop and implement effective internal controls to ensure a physical inventory of property which must be taken and the results reconciled with property records is completed at least once every two years. Views of responsible officials: In response to this finding management will implement the following: An education session occurred on February 7, 2024, with the relevant parties across the Cedars-Sinai Research Facilities department. The session focused on the uniform guidance, more specifically the requirements to perform a physical inventory of property at least once every two years as set forth in CFR 200.313 (d) (2). We will schedule follow up sessions in March 2024 (first session scheduled for March 1st, second session TBD) to review and update existing policies and procedures to ensure future transfer of knowledge, as well as finalize a plan of action in order to complete a physical inventory of research equipment by the end of the fiscal year period, June 2024.

Finding 2023-003 Internal control deficiency and noncompliance over Procurement related to small purchases. Identification of the federal program: Research and Development Cluster See the Schedule of Findings and Questioned Costs for table. Criteria or specific requirement (including statutory, regulatory or other citation): Title 2, Subtitle A, Chapter II, Part 200, Subpart D, 200.303 – Internal controls. The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2, Subtitle A, Chapter II, Part 200, Subpart D, 200.318(i) – General procurement standards states: The non-Federal entity must maintain records sufficient to detail the history of procurement. These records will include, but are not necessarily limited to, the following: Rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. Title 2, Subtitle A, Chapter II, Part 200, Subpart D, 200.320 – Methods of procurement to be followed – the non-Federal entity must have and use documented procurements procedures, consistent with the standards of this section and 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award: (a) (2) Small purchases – (i) small purchase procedures – the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. Condition: During our testing over small purchase procurements, we observed management did not have effective internal controls in place to ensure that price or rate quotations were obtained from an adequate number of qualified sources at the time of procurement. Cause: Management did not have effective internal controls in place over the compliance requirement as stated in the criteria or specific requirement section above. Effect or potential effect: Small purchase procurements were not supported by effective internal controls and could potentially include unreasonable prices or rate. Questioned costs: $18,869 – Assistance Listing Number 93.837, Award Identification Number – R01HL151398 $17,538 – Assistance Listing Number 93.396, Award Identification Number – 1R01CA273925-01 $13,294 – Assistance Listing Number 93.853, Award Identification Number – 5U01NS117839-03 $11,498 – Assistance Listing Number 93.273, Award Identification Number – U01AA026817 $10,785 – Assistance Listing Number 93.242, Award Identification Number – 1R01MH110831-01 $10,450 – Assistance Listing Number 93.855, Award Identification Number – 1R01AI165797-01 Questioned costs were computed by taking the total small purchase procurements that were not supported by adequate documentation of $18,868 + $17,538 + $13,294 + $11,498 + $10,785 + $10,450 for a total of $82,433. Context: During our testing over small purchase procurements, we obtained a listing of small purchase procurements and selected a sample of 18. The total value of the 18 small purchase procurements selected was $435,729 out of the total population of $5,473,204. There were 6 ($82,433) out of 18 ($435,729) selections where price or rate quotations were not obtained from an adequate number of qualified sources at the time of procurement. Identification as a repeat finding, if applicable: No. Recommendation: We recommend management develop and implement effective internal controls to ensure small purchase procurements are supported by price or rate quotations from an adequate number of qualified suppliers. Views of responsible officials: In response to this finding management will implement the following: 1) We are implementing internal controls to ensure small purchase procurements are consistently supported by price and rate quotations from an adequate number of qualified suppliers. The Executive Director, or their designee, will conduct a quarterly audit of 8% of the total number of purchase orders issued to Research within a 12-month period. The Audit sample selection will be using a random algorithm that accounts for materiality to assure the documents listed for small purchase procurements are supported by price or rate quotations from an adequate number of qualifies suppliers. The results will be reviewed by the Executive Director or their designee who will address any deficiencies with the assigned buyer. These steps and controls will be updated and documented in the departmental policy. 2) An education session occurred on February 15, 2024, with the relevant parties across Cedars-Sinai Supply Chain Procurement department. This was to re-enforce our policy PUR00318 – Bid Guidelines Procedure: Purchasing detailing the procedures to follow for small purchase procurements and the role each one has to ensure the process is followed every time. The education session also highlights that all documents need to be properly stored for further review or audits.

Internal control deficiency and noncompliance over Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Reporting related to expenses attributable to coronavirus reported in the provider relief fund reports. Identification of the federal program: Assistance Listing Number 93.498 • COVID-19 – Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution • U.S. Department of Health and Human Services • Federal award identification number – Not Applicable • Federal award year: – Period 4 – January 1, 2020 to December 31, 2022 – Period 5 – January 1, 2020 to June 30, 2023 Criteria or specific requirement (including statutory, regulatory or other citation): Title 2, Subtitle A, Chapter II, Part 200, Subpart D, 200.303 – Internal controls. The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The terms and conditions of the award requires the following: • The recipient certifies that the payment will only be used to prevent, prepare for, and respond to coronavirus, and that the payment shall reimburse the recipient only for health care related expenses or lost revenues that are attributable to coronavirus. The burden of proof is on the recipient to maintain documentation that shows how expenses prevent, prepare for, and respond to coronavirus. • The recipient certifies that it will not use the payment to reimburse expenses or losses that have been reimbursed from other sources or that other sources are obligated to reimburse. • The recipient shall adhere to the reporting requirements on provider relief fund payments for payments received exceeding $10,000 in the aggregate during the payment received period. The recipient must register in the provider relief fund reporting portal and submit reports as specified by Health and Human Services. • The recipient certifies that all information it provides as part of any application for the payment, as well as all information and reports relating to the payment that it provides in the future at the request of Health and Human Services or the Health and Human Services inspector general, are true, accurate and complete, to the best of its knowledge. • The recipient shall maintain appropriate records and cost documentation including, as applicable, documentation described in 45 CFR 75.302 – financial management and 45 CFR 75.361 through 75.365 – record retention and access, and other information required by the future program instructions to substantiate the reimbursement of costs under this award. Condition: During our testing over healthcare related expenses included in the provider relief fund reports, we observed management did not have effective internal controls in place to ensure expenses complied with the terms and conditions of the award. This resulted in an overstatement of expenses included in the provider relief fund reports. Cause: Management did not have effective internal controls in place over the compliance requirement as stated in the criteria or specific requirement section above. Effective or potential effect: Expenses submitted in the provider relief fund report were not supported by adequate documentation to substantiate that these funds were used for health care-related expenses attributable to coronavirus. Questioned costs: $952,828 – Assistance Listing Number 93.498. See corresponding award identification number in the identification of federal award section above. Questioned costs were computed by taking the total expenses not supported by adequate documentation at Huntington Ambulatory Surgery Center LLC of $948,707 and Torrance Memorial Medical Center of $4,121 for a total of $952,828. Context: During our testing over health care-related expenses attributable to coronavirus at Huntington Ambulatory Surgery Center LLC, we observed management submitted $948,707 in expenses that were not supported by adequate documentation to substantiate that these funds were used for health care-related expenses attributable to coronavirus. The burden of proof is on the recipient to maintain documentation that shows how expenses prevent, prepare for, and respond to coronavirus. During our testing over health care-related expenses attributable to coronavirus at Torrance Memorial Medical Center, we observed management submitted duplicated expenses which were reimbursed in the prior period in the amount of $4,121. During our testing over health care-related expenses attributable to coronavirus at Huntington Medical Foundation, we observed management did not have evidence of internal controls regarding the review and approval of the expenses used to substantiate the payments received in the provider relief fund report. Total expenses in the provider relief fund report was $1,062,349. Identification as a repeat finding, if applicable: No. Recommendation: We recommend management develop and implement effective internal controls to ensure expenses comply with the terms and conditions of the award. This will ensure expenses submitted in the provider relief fund reports are supported by adequate documentation to substantiate that these funds are used for health care-related expenses attributable to coronavirus. Views of responsible officials: The entity has excess lost revenues to cover all payments received (excluding the expenses submitted). Therefore, no refund is required for any payments received. Since the program has ended, the management has implemented the following procedures for future grants: 1) An education session occurred on February 15, 2024, with the relevant parties across Huntington Health entities to formally implement a review process whereby the Controller will review the support files prior to filings being made related to grant applications/programs across any of Huntington’s entities. Documentation of this review will be retained in the central file repository. These steps and controls will be updated and documented in the departmental policy. 2) A central folder on the Huntington Hospital’s main accounting drive has been created. This folder will be populated with all support for filed figures related to grant applications/programs across the hospital’s various entities. The support will be validated as having been placed into this folder as part of the reporting out process by the accounting manager and Controller handling the reporting. Files will be retained in this central drive for a minimum of 7 years. These steps and controls will be updated and documented in the departmental policy.

Internal control deficiency and noncompliance over suspension and debarment. Information on the federal program: 11.619, Arrangements for Interdisciplinary Research Infrastructure, 70NANB16H252, 10/01/2019?09/30/2020. 11.420, Military Medical Research and Development, W81XWH-16-1-0190, 08/01/2018?07/31/2019. 11.420, Military Medical Research and Development, W81XWH-18-1-0593, 09/15/2019?09/14/2020. 93.286, Discovery and Applied Research for Technological Innovations to Improve Human Health, 1R01EB026094-01, 02/01/2019? 01/31/2020. 93.394, Cancer Detection and Diagnosis Research, 7R01CA198887-04,05/01/2019? 04/30/2020. 93.817, Hospital Preparedness Program (HPP) Ebola Preparedness and Response Activities, U3REP160550-01-00, 06/15/2019? 06/14/2020, California Department of Public Health. 93.837, Cardiovascular Diseases Research, 5R01HL128857-03, 05/01/2019?04/30/2020, Ohio State University.93.853, Extramural Research Programs in the Neurosciences and Neurological Disorders, 1U01NS103792-01, 09/01/2019?08/31/2020. 93.853, Extramural Research Programs in the Neurosciences and Neurological Disorders, 1UG3NS105703-01, 09/01/2018?08/31/2019. 93.853, Extramural Research Programs in the Neurosciences and Neurological Disorders, 1UG3NS105703-01, 09/01/2019?08/31/2020. Criteria or specific requirement (including statutory, regulatory or other citation): Title 2, Subtitle A Chapter II Part 200 Subpart D 200.303 Internal controls. The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2, Subtitle A Chapter I Part 180 Subpart C ? Responsibilities of Participants Regarding Transactions Doing Business With Other Persons, 180.300: What must I do before I enter into a covered transaction with another person at the next lower tier? When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. Condition: During our testing over suspension and debarment, management communicated to us that no suspension and debarment checks were done for vendors during July 2019 through January 2020, and March and May 2020. Cause: Due to changes in key personnel, and a lack of transition of knowledge and training for new personnel, suspension/debarment checks were not performed during the months mentioned above. Effect or potential effect: Transactions with vendors could have been entered into with suspended/debarred entities during the time-frame mentioned above. Questioned costs: None noted as no vendors were suspended or debarred. Context: As management noted that this control was not in place and operating for certain months of the year, an analysis was performed to see what the population of vendor transactions in excess of $25,000 was for the months of July 2019 through January 2020, and March and May 2020. We observed that the total vendors that did not have a suspension and debarment check performed during these months was $811,345. We tested a sample of vendors during the other months, when the control was operational, noting no exceptions. Identification as a repeat finding, if applicable: No. Recommendation: We recommend that management ensure all policies, procedures, and internal controls over federal grants, including over suspension and debarment, are in place and followed throughout the year. Views of responsible officials: We agree with this finding and will ensure monthly sanction checks for vendor suspension and debarment will be properly executed by providing training and instructions to the individual performing the check.

Internal control deficiency and noncompliance over procurement. Information on the federal program: 11.307, Economic Adjustment Assistance, 07-79-07449; URI; 11, 07/01/2019-06/30/2020. 93.853, Extramural Research Programs in the Neurosciences and Neurological Disorders, U01 NS088312, 07/01/2018-06/30/2019. 93.286, Discovery and Applied Research for Technological Innovations to Improve Human Health, 1R01EB028146-01, 04/01/2019- 12/31/2019. 93.866, Aging Research, 1R01AG056478-01, 06/01/2019-05/30/2020. 93.394, Cancer Detection and Diagnosis Research, 1U24CA210969-01, 9/1/2018- 08/31/2019, Van Andel Research Institute. Criteria or specific requirement (including statutory, regulatory or other citation): Title 2, Subtitle A Chapter II Part 200 Subpart D 200.303 Internal controls. The non- Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.317-327 contains the procurement standards required by Uniform Guidance. Non- federal entities must have written procedures for procurement transactions which include the requirements of the Uniform Guidance and must follow those procedures. Condition: During our testing over procurement, we noted that the Cedars-Sinai Health System procurement policy included information allowing for sole-source purchases that are not in accordance with procurement standards. Certain procurements did not maintain sufficient documentation in the procurement files to comply with the procurement standards. Cause: The procurement policy contains conflicting information not in accordance with procurement standards. Employees in charge of procuring goods/services did not follow all procurement documentation requirements for certain transactions. Effect or potential effect: The procurement policy is not in compliance with procurement standards. Certain transactions were awarded without allowing for sufficient competition or without documenting the appropriate rationale in the procurement files for sole-source procurements. Questioned costs: None noted. Context: We tested 24 procurements (totaling $1,017,334) out of a population of 119 (totaling $3,750,966). We noted that for 8 ($662,102) out of our 24 procurements, there was insufficient procurement documentation to support the method of procurement or a justifiable reason for using the sole-source procurement method. Identification as a repeat finding, if applicable: No. Recommendation: We recommend that management ensure the procurement policy is updated to comply with the procurement standards. In addition, we recommend that procedures and internal controls are in place and followed to include all required documentation in the procurement files. Views of responsible officials: We agree with this finding and will ensure that policies and work procedures are updated to include the new procurement standards. We will also ensure that proper documentation is maintained to support methods of procurement for purchases made with federal funds.