SAN DIEGO BLOOD BANK

2022-002 ? Time and Effort Documentation Federal Agency: Department of Health and Human Services Federal Program: Research and Development Cluster Assistance Listing Number: 93.310 ? Trans-NIH Research Support Award Period: July 1, 2021 to June 30, 2022 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or Specific Requirement: According to Code of Federal Regulations, 200 CFR 200.430(i), the minimum time and effort documentation must be supported by a system of internal controls which provides reasonable assurance that charges are accurate, allowable and allocable; be incorporated into official records; reasonably reflect total activity for which the employee is compensated; encompass all activities (federal and nonfederal); comply with established accounting policies and practices; and support distribution among specific activities or cost objectives. Condition: We noted the charges for one employee was not supported by the established time and effort documentation. This discrepancy was noted for 1 out of 35 samples tested, which was statistically valid. Questioned Costs: $1,653 (known), $16,540 (likely) Context: The employee?s time and effort accounted for $14,887 of the $816,606 total personnel expenses charged to the program audit the award period. Cause: The employee?s time and effort on the program was not captured within the Blood Bank?s timekeeping system. Effect: The condition identified led to noncompliance with federal time and effort documentation requirement. Repeat Finding: Yes, 2021-001 Recommendation: We recommend the Blood Bank implement procedures to ensure all personnel charges to the program are supported by the minimum time and effort documentation outlined within 200 CFR 200.430. Views of Responsible Officials and Planned Corrective Actions Please refer to the attached Corrective Action Plan.

2022-002 Research and Development Cluster ? Assistance Listing No. 93.310 Recommendation: We recommend the Blood Bank implement procedures to ensure all personnel charges to the program are supported by the minimum time and effort documentation outlined within 200 CFR 200.430. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Blood Bank added review and approval processes to compare actual vs budgeted vs allowable time and effort. Names of the contact persons responsible for corrective action: Bryan Eleazar, CFO; Lisa Alexander, Direct of Grant Accounting; Jeanette Lysse, Controller Planned completion date for corrective action plan: October 29, 2021

2021-001

2021-001 ? Time and Effort Documentation Federal Agency: Department of Health and Human Services Federal Program: Research and Development Cluster Assistance Listing Number: 93.310 ? Trans-NIH Research Support Award Period: July 1, 2020 to June 30, 2021 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or Specific Requirement: According to Code of Federal Regulations, 200 CFR 200.430(i), the minimum time and effort documentation must: -Be supported by a system of internal controls which provides reasonable assurance that charges are accurate, allowable and allocable -Be incorporated into official records -Reasonably reflect total activity for which the employee is compensated -Encompass all activities (federal and nonfederal) -Comply with established accounting policies and practices; and -Support distribution among specific activities or cost objectives. Condition: We noted the charges for one employee was not supported by the established time and effort documentation. This discrepancy was noted for 2 out of 43 samples tested, which was statistically valid. Questioned Costs: $10,600 (known), $16,004 (likely) Context: The employee?s time and effort accounted for $10,600 of the $644,831 total personnel expenses charged to the program audit the award period. Cause: The employee?s time and effort on the program was not captured within the Blood Bank?s timekeeping system. Effect: The condition identified led to noncompliance with federal time and effort documentation requirement. Repeat Finding: No Recommendation: We recommend the Blood Bank implement procedures to ensure all personnel charges to the program are supported by the minimum time and effort documentation outlined within 200 CFR 200.430. Views of Responsible Officials and Planned Corrective Actions Please refer to the attached Corrective Action Plan.

U.S. Department of Health & Human Services 2021-001 Research and Development Cluster ? Assistance Listing No. 93.310 Recommendation: We recommend the Blood Bank implement procedures to ensure all personnel charges to the program are supported by the minimum time and effort documentation outlined within 200 CFR 200.430. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Blood Bank added review and approval processes to compare actual vs budgeted vs allowable time and effort. Names of the contact persons responsible for corrective action: David Neal, CFO; Lisa Alexander, Direct of Grant Accounting; Jeanette Lysse, Controller Planned completion date for corrective action plan: October 29, 2021 If the U.S. Department of Health & Human Services has questions regarding this plan, please call David Neil, Chief Financial Officer, at 619-400-8235.

2020-001 Year-End Financial Close Process Criteria: Organizations should develop and adopt closing procedures that facilitate accurate and timely reporting. Condition: During the audit, there were 34 adjusting and reclassifying journal entries, 16 of which were client-provided, and four of which were prior period adjustments. Substantially all of the entries were to correct bookkeeping errors or to make accruals that should have been made by the accounting department. Context: The Blood Bank has grown over the years and is at a size which necessitates robust closing procedures in order to facilitate accurate and timely reporting. Cause: Management?s current closing procedures do not facilitate accurate and timely reporting. Effect: The results were delays in producing closing entries, reconciliations, account analyses, and other financial reports needed by management and the auditors. Recommendation: We recommend developing a more robust closing schedule that indicates which individuals will perform each procedure and when completion of each procedure is due and accomplished. Questioned Costs: None Views of Responsible Officials: Management agrees with the audit finding and a response is included in the corrective action plan.

Finding 2020-001 Year-End Financial Close Process a. Program Information: N/A b. Criteria: Organizations should develop and adopt closing procedures that facilitate accurate and timely reporting. c. Condition: During the audit, there were 34 adjusting and reclassifying journal entries, 16 of which were client-provided. Substantially all of the entries were to correct bookkeeping errors or to make accruals that should have been made by the accounting department. Response: Management acknowledges the finding and will implement additional processes and procedures to reduce the number of adjustments. Contact person(s) responsible for corrective action: 1. David W. Neal, CFO 2. Jeanette Lysse, Controller Completion date: December 31, 2020

2020-004 (Recurring) Payroll Approval Criteria: The Uniform Guidance requires that the non-Federal entity verify time charged to Federal programs. Condition: During our audit, we tested payroll attributed to the major program, and while management implemented a policy to review time charged to the major program, review and approval was not consistently documented. Context: Time charged to the major program tested was tracked, but review and approval was not consistently documented. Therefore, review and approval was not able to be verified for all pay periods under audit. Cause: Management has a policy for review and approval of time charged to Federal programs, but documentation was not consistent. Effect: The Blood Bank was not in compliance with Uniform Guidance requirements. Recommendation: We recommend that the Blood Bank develop, adopt, and implement a review process over time charged to Federal programs that is consistently documented to ensure the Blood Bank is in compliance with Uniform Guidance. Questioned Costs: None Views of Responsible Officials: Management agrees with the audit finding and a response is included in the corrective action plan.

Finding 2020-004 (Recurring) Payroll Approval a. Program Information: N/A b. Criteria: The Uniform Guidance requires that the non-Federal entity verify time charged to Federal programs. c. Condition: During our audit, we tested payroll attributed to the major program, and while management implemented a policy to review time charged to the major program, review and approval was not consistently documented. Response: Management acknowledges the finding and will augment its procedures to include higher level review of time/effort charged to the program, and for invoicing in general, to ensure consistency. Contact person(s) responsible for corrective action: 1. David W. Neal, CFO 2. Jeanette Lysse, Controller 3. Janet Villa, Director, Research Collections Completion date: December 31, 2020

2019-009

2019-001 Pension Reporting Criteria: For pension accounting in accordance with US GAAP, the discount rate selected must reflect either the market rates currently applicable to settling the benefit obligation or the rates of return on high quality fixed income securities at the measurement date. Condition: During our audit, we inquired with management regarding their discount rate assumption used in the valuation of the defined-benefit pension plan and noted it was high given the guidance for setting assumptions under ASC 715 and current market conditions. Context: Since 2015, Blood Bank management, in conjunction with its Finance Committee, has been aware of the impact of the discount rate and projected earning?s rate upon the valuation and liability presented for the defined benefit pension plan. Ongoing discussions and plans of action included a systematic annual reduction of the discount rate to bring the Plan?s valuation and liability into closer alignment with market values. The Blood Bank?s June 30, 2018 audit report included footnotes that referenced the potential underfunded liability using an advisor-recommended published discount rate that was representative at the time; a higher rate, however, was utilized for the underfunded liability included in the actual consolidated financial statements at that date. Cause: The original discount rate selected resulted in a lower projected benefit obligation (liability) than if the actuary-recommended rate was used by a material amount. Effect: The discount rate assumed results in a lower project benefit obligation (liability). Recommendation: We recommend using a discount rate that is supported by reasonable assumptions and actual market conditions and documenting the rationale to support the discount rate used. Questioned Costs: None Views of Responsible Officials: Management agrees with the audit finding and a response is included in the corrective action plan.

Finding 2019-001 Pension Reporting a. Program Information: N/A b. Criteria: For pension accounting in accordance with US GAAP, the discount rate selected must reflect either the market rates currently applicable to settling the benefit obligation or the rates of return on high quality fixed income securities at the measurement date. c. Condition: During our audit, we inquired with management regarding their discount rate assumption used in the valuation of the defined-benefit pension plan and noted it was high given the guidance for setting assumptions under ASC 715 and current market conditions. Response: Management concurs with the finding and, for the June 30, 2019 audit report, has selected a discount rate from reliable published sources of timely and representative rates that it believes more accurately represents the Plan?s valuation at the measurement date. Management intends to revisit the same or similar data sources for future valuation purposes. Contact person(s) responsible for corrective action: 1. Dr. David Wellis, CEO 2. David W. Neal, CFO Completion date: December 20, 2019

2019-002 Donor Restrictions Criteria: Per US GAAP, net assets are required to be reported based on the presence or absence of donor-imposed restrictions. Condition: During our audit, we noted that management does not have an established process to properly track donor intent when gifts are made and satisfaction of donor-imposed restrictions. Context: While a tracking system was implemented after year-end, a schedule was not maintained during the year due to employee turnover and had to be re-created based on known facts and circumstances.Cause: Management does not have an established process to properly track donor intent when gifts are made, and satisfaction of donor-imposed restrictions. Effect: Spending of donor-restricted gifts could possibly not be in alignment with donor intent. Recommendation: We recommend developing and implementing a process to properly track donor intent when gifts are made and satisfaction of donor-imposed restrictions. Questioned Costs: None Views of Responsible Officials: Management agrees with the audit finding and a response is included in the corrective action plan.

Finding 2019-002 Donor Restrictions a. Program Information: N/A b. Criteria: Per US GAAP, net assets are required to be reported based on the presence or absence of donor-imposed restrictions. c. Condition: During our audit, we noted that management does not have an established process to properly track donor intent when gifts are made and satisfaction of donor-imposed restrictions. Response: Management concurs with the finding and has established monthly meetings between the accounting department and foundation (development department) to track and reconcile new donor gifts and expenditures to ensure donor intent is followed. Management has segregated new donation activity into a separate bank account and releases those funds only upon identification of approved expenditures. New donations are categorized by fund and restriction when entered into the general ledger. Contact person(s) responsible for corrective action: 1. David W. Neal, CFO 2. Jeanette Lysse, Controller 3. Sherry Serio, VP Development Completion date: November 1, 2019

2019-003 Policies and Procedures Criteria: Organizations should adopt policies applicable to their organizational activities, should document and distribute them within their organization, and should ensure the security and accessibility of financial information. Condition: During our audit, we noted that some key policies have not been adopted, such as gift acceptance, policies and procedures are either not documented at all or not fully documented, and individual employees had the only access to key schedules supporting financial information. Context: The Blood Bank has grown over the years and is at a size which necessitates certain policies and procedures to obtain operational efficiency, security of information, and transfer of knowledge. Cause: While management may review current policies on a regular basis for continued applicability, there is not a process to review for new policies that should be adopted based on current operations. Individual employees may follow a consistent process for completing work, however, these have not been documented and standardized by management for use throughout the organization. There is not a policy in place regarding information sharing and storage of key financial schedules, so employees utilize spreadsheets independent of the accounting system which are not housed on a shared drive which would provide accessibility to other accounting staff in their absence or due to turnover. Effect: Without a gift acceptance policy, the Blood Bank may accept a gift that their infrastructure cannot currently support, one with high administrative costs, or one that is not in alignment with the mission and vision of the organization. Without documented procedures, processes were inconsistent throughout the year due to turnover. There are key financial spreadsheets that are maintained by an individual user, making transferring of roles difficult and accessibility of information limited. Support for certain requests were delayed due to the absence of the only individual who had knowledge and access to the support. Recommendation: We recommend developing, adopting, and implementing policies and procedures throughout the organization. Written procedures, instructions, and assignments of duties will prevent or reduce misunderstandings, errors, inefficient or wasted effort, duplicated or omitted procedures, and other situations that can result in inaccurate or untimely accounting records. A well-devised accounting manual can also help to ensure that all similar transactions are treated consistently, that accounting principles used are proper, and that records are produced in the form desired by management.A good accounting manual should aid in the training of new employees and possibly allow for delegation to other employees of some accounting functions management performs. In addition, identifying and documenting significant operational and accounting processes can help reduce operational inefficiencies due to the absence of key employees. Questioned Costs: None Views of Responsible Officials: Management agrees with the audit finding and a response is included in the corrective action plan.

Finding 2019-003 Policies and Procedures a. Program Information: N/A b. Criteria: Organizations should adopt policies applicable to their organizational activities, should document and distribute them within their organization, and should ensure the security and accessibility of financial information. c. Condition: During our audit, we noted that some key policies have not been adopted, such as gift acceptance, policies and procedures are either not documented at all or not fully documented, and individual employees had the only access to key schedules supporting financial information. Response: Management concurs with the finding and is developing and implementing new policies and procedures to improve upon accuracy and timeliness when recording transactions. A written manual to assist with documentation, training and cross-training will be developed and updated as policies and procedures are added. Contact person(s) responsible for corrective action: 1. David W. Neal, CFO 2. Jeanette Lysse, Controller Completion date: Partial completion at December 31, 2019; Full manual completion intended for June 30, 2020; Continuous process improvement updates, as needed.

2019-004 Cash Receipts Criteria: Duties should be segregated, where possible, to reduce the risk of errors or fraud. Condition: Duties are not segregated in the cash receipts process. Context: During review of the cash receipts process, for part of the year, we noted the accounts receivable (A/R) clerk opens mail, compiles checks, posts payments, and deposits payments. The only supervision of this process is a periodic review of the A/R aging schedule and review of a daily deposit list which does not contain detail of individual deposits. Cause: There is no policy to segregate duties for key processes. Effect: This lack of segregation of duties and oversight exposes the Blood Bank to error or fraud. Recommendation: Proper segregation is not always possible in an organization with a small accounting department, but limited segregation to the extent possible can and should be implemented to reduce the risk of errors or fraud. We recommend that cash receipts be opened and controlled by a person independent of the person responsible for the accounts receivable subsidiary ledger. The accounts payable clerk could open the mail, endorse the checks, and prepare the deposit slip and daily list of receipts. The cash and deposit slip would then be forwarded to the controller for deposit. The daily list of receipts would be forwarded to the accounts receivable clerk to post to customer's accounts. Alternatively, we also recommend that management consider using a lockbox system for processing receipts. We recommend that management review the current assignment of accounting functions and, where possible, segregate duties to reduce the risk of errors or fraud. Questioned Costs: None Views of Responsible Officials: Management agrees with the audit finding and a response is included in the corrective action plan.

Finding 2019-004 Cash Receipts a. Program Information: N/A b. Criteria: Duties should be segregated, where possible, to reduce the risk of errors or fraud. c. Condition: Duties are not segregated in the cash receipts process. Response: Management acknowledges that, for the beginning part of current fiscal year, cash receipt logging was potentially at risk due to single party processing of data. Approximately mid-year, controls were implemented to segregate those duties. The accounts payable clerk now has primary responsibility for opening mail, with posting to customer accounts by the Accounts Receivable clerk, thus maintaining an appropriate separation of duties. Further, most incoming receipts now arrive via automated clearing house (ACH) or check to an offsite bank-maintained lockbox, with images and data downloaded by the accounts receivable clerk for posting to customer accounts, and subsequently transferred by the bank to the general operating account. Activity in the lockbox and general accounts is monitored daily, and the accounts are reconciled monthly by the Controller and reviewed by the Chief Financial Officer (CFO). Contact person(s) responsible for corrective action: 1. David W. Neal, CFO 2. Jeanette Lysse, Controller Completion date: July 1, 2019

2019-005 Journal Entries Criteria: Part of a strong system of internal controls is review of journal entries as it provides segregation of duties between the individual posting the entry and the one conducting the review which can aid in preventing errors and fraud. Condition: Journal entries posted by the Controller were not reviewed.Context: Prior to the conversion of the accounting system, there was no review or approval process for journal entries. Since the conversion, Aldrich noted that within the accounting system, all journal entries posted by accountants must be reviewed and approved by the Controller, Chief Financial Officer, or Chief Executive Officer before they are posted. However, there is no review and approval process for journal entries posted by the Controller. Cause: There is no policy to review journal entries posted by the Controller. Effect: This lack of journal entry review exposes the Blood Bank to error or fraud. Recommendation: We recommend adopting a policy of reviewing journal entries posted by the Controller which can be achieved by reviewing before posting or by reviewing entries posted on a weekly, monthly, or other regular basis. Documentation of the review should also be kept. Questioned Costs: None Views of Responsible Officials: Management agrees with the audit finding and a response is included in the corrective action plan.

Finding 2019-005 Journal Entries a. Program Information: N/A b. Criteria: Part of a strong system of internal controls is review of journal entries as it provides segregation of duties between the individual posting the entry and the one conducting the review which can aid in preventing errors and fraud. c. Condition: Journal entries posted by the Controller were not reviewed.Response: Management concurs with the finding and recognizes the importance of appropriate review of entries into the general ledger. With the onboarding of a new Chief Financial Officer in December 2019 (a position vacant for 4 months) adequate staffing levels and separation duties were restored. Processes now exist for entry and approval of general ledger information at all levels of input. Contact person(s) responsible for corrective action: 1. David W. Neal, CFO 2. Jeanette Lysse, Controller Completion date: December 2, 2019

2019-006 Deferred Revenue Criteria: Per US GAAP, revenue should be recognized when realized and earned, not necessarily when received. Generally, an organization records deferred revenue when it receives consideration from a customer before achieving certain criteria that must be met for revenue to be recognized in conformity with US GAAP. Condition: During our audit, we identified a deferred revenue balance that should have been recognized as revenue in a prior period based billing, payment, and service detail for the customer. We also identified current period deferred revenues that should have been recognized by year-end. Context: Prior year balances were not reviewed for continued appropriateness. In addition, an accounting system conversion during the year did not initially correctly capture all data from the prior system, which caused confusion when applying payments to customer balances. Cause: Prepayments made by the customer were not recognized as good and services were exchanged due to delay in reconciliation. Effect: Deferred revenue for was overstated since revenue was not recognized timely in accordance with US GAAP. Recommendation: We recommend developing procedures to track customer prepayments and corresponding billings in order to align revenue recognition with when goods are provided or when services are performed. Accounts should be reconciled timely and reviewed consistently to avoid delay in recognition. Questioned Costs: None Views of Responsible Officials: Management agrees with the audit finding and a response is included in the corrective action plan.

Finding 2019-006 Deferred Revenue a. Program Information: N/A b. Criteria: Per US GAAP, revenue should be recognized when realized and earned, not necessarily when received. Generally, an organization records deferred revenue when it receives consideration from a customer before achieving certain criteria that must be met for revenue to be recognized in conformity with US GAAP. c. Condition: During our audit, we identified a deferred revenue balance that should have been recognized as revenue in a prior period based billing, payment, and service detail for the customer. We also identified current period deferred revenues that should have been recognized by year-end. Response: Management concurs with the finding and will institute a new procedure for recording and review of deferred revenue transactions and balances. Contact person(s) responsible for corrective action: 1. David W. Neal, CFO 2. Jeanette Lysse, Controller Completion date: March 31, 2020

2019-009 Payroll Approval Criteria: The Uniform Guidance requires that the non-Federal entity verify time charged to Federal programs. Condition: During our audit, we reviewed payroll attributed to the major program test and noted there was no review of time charged to the program. Context: Time charged to the major program tested was tracked, but the hours were not reviewed and approved. Cause: Management has no policy for review and approval of time charged to Federal programs. Effect: The Blood Bank was not in compliance with Uniform Guidance requirements. Recommendation: We recommend that the Blood Bank develop, adopt, and implement a review process over time charged to Federal programs to ensure the Blood Bank is in compliance with Uniform Guidance. Questioned Costs: None Views of Responsible Officials: Management agrees with the audit finding and a response is included in the corrective action plan.

Finding 2019-009 Payroll Approval a. Program Information: CFDA 93.310 Trans-NIH Research Support b. Criteria: The Uniform Guidance requires that the non-Federal entity verify time charged to Federal programs. c. Condition: During our audit, we reviewed payroll attributed to the major program test and noted there was no review of time charged to the program. Response: Management concurs with the finding and is researching the applicable standards to create a documented policy and process around review and approval of time charged to Federal programs. The research and documentation will be conducted jointly with Blood Bank?s Quality Assurance and Compliance Department to ensure conformance with the requirements. Contact person(s) responsible for corrective action: 1. David W. Neal, CFO 2. Jeanette Lysse, Controller 3. Helen Bixenman, VP Quality & Regulatory Affairs Completion date: March 31, 2020