Adventist Health System/West

Section III – Federal Award Findings and Questioned Costs Finding 2023-001 Internal control deficiency over Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Reporting. Identification of the Federal Program: Assistance Listing Number 93.498 • COVID-19 – Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution • U.S. Department of Health and Human Services • Federal award identification number – Not Applicable • Federal award year: Period 5 – January 1, 2023 to December 31, 2023 Criteria or specific requirement (including statutory, regulatory or other citation): Title 2, Subtitle A Chapter II Part 200 Subpart D 200.303 Internal controls. The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We observed management did not have effective internal controls in place to ensure documentation was retained in order to evidence the operating effectiveness of the internal controls. Cause: Management did not have effective internal controls in place over the compliance requirements as stated in the criteria or specific requirements section above. Effect or potential effect: Management did not retain documentation to evidence the operating effectiveness of the internal controls over the expenditures incurred and the reporting. Questioned Costs: None. Context: We did not test internal controls over the A. Activities Allowed or Unallowed, B. Allowable Costs/Cost Principles, and L. Reporting compliance requirements, as internal controls were deemed ineffective due to internal control exceptions noted in the prior year (refer to Identification as a repeat finding section below) that would not be resolved for the full period under audit for the year-ended December 31, 2023. Identification as a repeat finding, if applicable: 2022-001 Recommendation: We recommend that management develop and implement effective internal controls to ensure accurate calculation, aggregation, and reporting of expenditures and lost revenues, including supporting that expenditures were used to prevent, prepare for, and respond to coronavirus. This will ensure the expenses and lost revenue reported in the Portal are complete and accurate. Views of Responsible Officials: Adventist Health implemented an action plan and established internal controls last year, following the conclusion of 2022 UG audit. Since the program has ended, no action is required at this time. We have also worked with HRSA to address any issues and findings from previous years. In the future, similar programs will be managed by the Grants Management team, utilizing the established internal controls.