Audit 295340

Finding 2023-001 – A. Activities Allowed or Unallowed, B. Allowable Costs/Cost Principles, H. Period of Performance Identification of the federal program: Federal Agency: U.S. Department of Homeland Security Assistance Listing: 97.036 COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Pass-Through Entity: Ohio Emergency Management Agency Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: For a portion of overtime labor costs reimbursed under the program, UC Health did not retain sufficient documentation to evidence execution of internal controls that support compliance with the terms and conditions (T&Cs) of specific projects. While management has processes in place to review overtime labor costs for compliance, evidence of all key aspects and conclusions of these reviews was not consistently retained. Cause: UC Health did not retain supporting documentation over key aspects of its internal review and approval processes for overtime labor hours that were not directly approved by employee managers. Effect or potential effect: A lack of formalized documentation prepared and retained to evidence the performance of internal controls could result in non-compliance with programs T&Cs. Questioned costs: None. Context: As part of our testing procedures over UC Health’s compliance with specific project requirements, documentation to support review of overtime labor costs incurred was generally available. However, evidence was not retained of the payroll department’s review and approval of employee overtime hours that were not approved directly by employee managers. As such, EY was not able to determine that the payroll department reviews were completed or completed timely. Total overtime labor costs accounted for $468,896 of the $9,910,390 of expenditures reported under the program. Identification as a repeat finding, if applicable: Not applicable. Recommendation: Management should design and implement internal controls to formally document all key aspects of its review and approval of expenditures submitted under program projects, including appropriate document retention policies. Views of responsible officials: Management agrees with this finding and the need to update documentation policies and procedures to evidence review of compliance with program requirements.

Finding 2023-001 – A. Activities Allowed or Unallowed, B. Allowable Costs/Cost Principles, H. Period of Performance Identification of the federal program: Federal Agency: U.S. Department of Homeland Security Assistance Listing: 97.036 COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Pass-Through Entity: Ohio Emergency Management Agency Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: For a portion of overtime labor costs reimbursed under the program, UC Health did not retain sufficient documentation to evidence execution of internal controls that support compliance with the terms and conditions (T&Cs) of specific projects. While management has processes in place to review overtime labor costs for compliance, evidence of all key aspects and conclusions of these reviews was not consistently retained. Cause: UC Health did not retain supporting documentation over key aspects of its internal review and approval processes for overtime labor hours that were not directly approved by employee managers. Effect or potential effect: A lack of formalized documentation prepared and retained to evidence the performance of internal controls could result in non-compliance with programs T&Cs. Questioned costs: None. Context: As part of our testing procedures over UC Health’s compliance with specific project requirements, documentation to support review of overtime labor costs incurred was generally available. However, evidence was not retained of the payroll department’s review and approval of employee overtime hours that were not approved directly by employee managers. As such, EY was not able to determine that the payroll department reviews were completed or completed timely. Total overtime labor costs accounted for $468,896 of the $9,910,390 of expenditures reported under the program. Identification as a repeat finding, if applicable: Not applicable. Recommendation: Management should design and implement internal controls to formally document all key aspects of its review and approval of expenditures submitted under program projects, including appropriate document retention policies. Views of responsible officials: Management agrees with this finding and the need to update documentation policies and procedures to evidence review of compliance with program requirements.