Audit 293716

2022-004 – Department of Health and Human Services CFDA #93.829 Section 223 Demonstration Programs to Improve Community Health Services (CCBHC) Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Period of Performance, and Reporting Material Weakness in Internal Control over Compliance Criteria – 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition – Rimrock Foundation’s final expenditures identified as eligible and claimed under the federal program were reviewed and approved by separate individuals outside of the preparer. However, the expense submissions for reimbursement had no evidence of review and approval by a separate individual outside of the preparer. Rimrock Foundation’s statistical reports submitted under the federal program had no evidence of review and approval by a separate individual outside of the preparer. Cause – Rimrock Foundation has multiple individuals identifying and compiling eligible costs and statistics, however, Rimrock Foundation did not have an internal control process in place to ensure evidence of a secondary review and approval of eligible expenditures and statistical data that were summarized from the underlying supporting spreadsheets to the final expenditure listing and the final statistical reports. The final expenditure listing was used to claim allowable costs under the federal program. The review and approval of the final expenditure listing and the statistical reports submitted to the Substance Abuse and Mental Health Services Administration was not performed by someone other than the preparer of the report. Effect – Without a secondary review and approval, there is a possibility that ineligible expenditures may be claimed under the program and the reports of statistical data may not be accurately completed. Questioned Costs – None reported. Context/Sampling – A nonstatistical sample of 60 expenditures was selected, from reports submitted to the Substance Abuse and Mental Health Services Administration, for testing of payroll, supplies, and equipment for activities allowed and unallowed and allowable costs/cost principles. The 20 statistical reports and forms submitted to the Substance Abuse and Mental Health Services Administration were all tested for internal controls and compliance. Repeat Finding from Prior Year – Yes. Recommendation – While we recognize that this condition is not unusual for an organization with limited staffing, it is important that Rimrock Foundation is aware of this condition for financial reporting purposes. Management and the board of directors should continually be aware of the financial accounting and reporting of Rimrock Foundation and any changes in the accounting and reporting requirements. We recommend a review and approval process which is documented in writing, by someone other than the preparer, of any reimbursement requests or any statistical reports submitted to the Substance Abuse and Mental Health Services Administration. Views of Responsible Officials – Management agrees with the finding.

2022-005 – Department of Health and Human Services CFDA #93.829 Section 223 Demonstration Programs to Improve Community Health Services (CCBHC) Procurement, Suspension and Debarment Material Weakness in Internal Control over Compliance Criteria – CFR 200.303 establishes that the entity must establish and maintain effective internal control over federal awards that provides reasonable assurance that the entity is managing the federal award in compliance with federal statutes, regulations and terms and conditions of the federal award. In addition, 2 CFR 200.302(b)(6) establishes that the financial management system of the entity must provide written procedures to implement the requirements of 2 CFR 200.305 regarding procurement. The entity should also maintain effective internal controls to determine that payments of federal awards are not made to vendors who are suspended or debarred from federal contracts. Condition – Rimrock Foundation does not have formally documented written internal control procedures over compliance with federal award programs to meet the requirements noted above regarding compliance with federal regulations for procurement, suspension and debarment. Cause – Rimrock Foundation was not aware of certain requirements under 2 CFR 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements regarding procurement for federal awards and did not implement controls to review vendors for suspension or debarment. Effect – Inadequate documentation of controls over these compliance areas may result in a reasonable possibility that Rimrock Foundation may not be able to detect and correct noncompliance with federal regulations regarding the use of federal funds in a timely manner and could contract with a vendor who has been suspended and debarred from federal contracts. Questioned Costs – None reported Context/Sampling – A nonstatistical sample of 3 contracts was selected, from expenditures in the reports submitted to the Substance Abuse and Mental Health Services Administration, for testing of controls over procurement of contracts which use federal funds. None of the contracts were reviewed for compliance with federal regulations and none of the vendors were reviewed for suspension and debarment prior to submission. Repeat Finding from Prior Year – Yes. Recommendation –Rimrock Foundation should establish and maintain effective internal control over federal awards that provides reasonable assurance that it is managing all federal awards in compliance with federal statutes, regulations and terms and conditions of the federal award. In addition, 2 CFR 200.302(b)(6) establishes that the financial management system must provide written procedures to implement the requirements of 2 CFR 200.305 regarding procurement. As part of those controls, Rimrock Foundation should also determine that payments of federal awards are not made to vendors who are suspended or debarred from federal contracts. Views of Responsible Officials – Management agrees with the finding.

2022-004 – Department of Health and Human Services CFDA #93.829 Section 223 Demonstration Programs to Improve Community Health Services (CCBHC) Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Period of Performance, and Reporting Material Weakness in Internal Control over Compliance Criteria – 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition – Rimrock Foundation’s final expenditures identified as eligible and claimed under the federal program were reviewed and approved by separate individuals outside of the preparer. However, the expense submissions for reimbursement had no evidence of review and approval by a separate individual outside of the preparer. Rimrock Foundation’s statistical reports submitted under the federal program had no evidence of review and approval by a separate individual outside of the preparer. Cause – Rimrock Foundation has multiple individuals identifying and compiling eligible costs and statistics, however, Rimrock Foundation did not have an internal control process in place to ensure evidence of a secondary review and approval of eligible expenditures and statistical data that were summarized from the underlying supporting spreadsheets to the final expenditure listing and the final statistical reports. The final expenditure listing was used to claim allowable costs under the federal program. The review and approval of the final expenditure listing and the statistical reports submitted to the Substance Abuse and Mental Health Services Administration was not performed by someone other than the preparer of the report. Effect – Without a secondary review and approval, there is a possibility that ineligible expenditures may be claimed under the program and the reports of statistical data may not be accurately completed. Questioned Costs – None reported. Context/Sampling – A nonstatistical sample of 60 expenditures was selected, from reports submitted to the Substance Abuse and Mental Health Services Administration, for testing of payroll, supplies, and equipment for activities allowed and unallowed and allowable costs/cost principles. The 20 statistical reports and forms submitted to the Substance Abuse and Mental Health Services Administration were all tested for internal controls and compliance. Repeat Finding from Prior Year – Yes. Recommendation – While we recognize that this condition is not unusual for an organization with limited staffing, it is important that Rimrock Foundation is aware of this condition for financial reporting purposes. Management and the board of directors should continually be aware of the financial accounting and reporting of Rimrock Foundation and any changes in the accounting and reporting requirements. We recommend a review and approval process which is documented in writing, by someone other than the preparer, of any reimbursement requests or any statistical reports submitted to the Substance Abuse and Mental Health Services Administration. Views of Responsible Officials – Management agrees with the finding.

2022-005 – Department of Health and Human Services CFDA #93.829 Section 223 Demonstration Programs to Improve Community Health Services (CCBHC) Procurement, Suspension and Debarment Material Weakness in Internal Control over Compliance Criteria – CFR 200.303 establishes that the entity must establish and maintain effective internal control over federal awards that provides reasonable assurance that the entity is managing the federal award in compliance with federal statutes, regulations and terms and conditions of the federal award. In addition, 2 CFR 200.302(b)(6) establishes that the financial management system of the entity must provide written procedures to implement the requirements of 2 CFR 200.305 regarding procurement. The entity should also maintain effective internal controls to determine that payments of federal awards are not made to vendors who are suspended or debarred from federal contracts. Condition – Rimrock Foundation does not have formally documented written internal control procedures over compliance with federal award programs to meet the requirements noted above regarding compliance with federal regulations for procurement, suspension and debarment. Cause – Rimrock Foundation was not aware of certain requirements under 2 CFR 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements regarding procurement for federal awards and did not implement controls to review vendors for suspension or debarment. Effect – Inadequate documentation of controls over these compliance areas may result in a reasonable possibility that Rimrock Foundation may not be able to detect and correct noncompliance with federal regulations regarding the use of federal funds in a timely manner and could contract with a vendor who has been suspended and debarred from federal contracts. Questioned Costs – None reported Context/Sampling – A nonstatistical sample of 3 contracts was selected, from expenditures in the reports submitted to the Substance Abuse and Mental Health Services Administration, for testing of controls over procurement of contracts which use federal funds. None of the contracts were reviewed for compliance with federal regulations and none of the vendors were reviewed for suspension and debarment prior to submission. Repeat Finding from Prior Year – Yes. Recommendation –Rimrock Foundation should establish and maintain effective internal control over federal awards that provides reasonable assurance that it is managing all federal awards in compliance with federal statutes, regulations and terms and conditions of the federal award. In addition, 2 CFR 200.302(b)(6) establishes that the financial management system must provide written procedures to implement the requirements of 2 CFR 200.305 regarding procurement. As part of those controls, Rimrock Foundation should also determine that payments of federal awards are not made to vendors who are suspended or debarred from federal contracts. Views of Responsible Officials – Management agrees with the finding.