Audit 300523

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Head Start Cluster: Assistance Listing Number 93.600 Federal Agency Department of Health and Human Services Pass-through Entity Not applicable, direct award Federal Award Year September 30, 2021 – September 29, 2023 Criteria or Requirement The requirements for reporting are contained in 2 CFR 200.328 which states unless otherwise approved by OMB, the Federal awarding agency must solicit only the OMB-approved governmentwide data elements for collection of financial information (at time of publication the Federal Financial Report or such future, OMB- approved, governmentwide data elements available from the OMB-designated standards lead). This information must be collected with the frequency required by the terms and conditions of the Federal award. Condition Found, including perspective The semi-annual Federal Financial Report (FFR) and Annual Federal Financial Report (AFFR), which are due 30 and 90 days, respectively, after the budget end period, detail cumulative program information that is required to be reported. We sampled two FFRs and the one AFFR for testing, and both of the FFRs were submitted late. The budget end period for project ID #136677 was September 29, 2022; however, the FFR was not submitted until December 9, 2022, 40 days late. The budget end period for project ID #138397 was April 30, 2023; however, the FFR was not submitted until May 2, 2023, 2 days late. Additionally, the FFR for project ID #138397 required information to be reported for the six-month period of September 29, 2023 to March 29, 2023; however, only 5 months of activity was reported. Cause Required program information for project ID #136677 was not made available within HHS’ Payment Management System (PMS) by the Sponsor for the University to prepare the FFR until December 2, 2022. This was 33 days after the due date of October 30, 2022. Further, due to human oversight, the FFR for project ID #138397 erroneously excluded data (5 months submitted vs. 6 months required) and was not submitted prior to the April 30, 2023 due date. Effect Failure to properly submit accurate and timely reporting submissions may prevent the University from being in compliance with the requirements set forth by the Uniform Guidance. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University enhance the design and implementation of internal controls to ensure that all required reports are submitted accurately and timely. Views of Responsible Officials Management agrees with the finding. The University takes seriously its responsibility to meet all financial terms and conditions of grants, contracts, and other agreements including reporting. Reporting requirements are flagged in the University’s financial systems and manually tracked for completion where sponsor systems do not provide systematic alerts of pending and delinquent reports. The Early Head Start program reporting requirements are tracked via the U.S. Department of Health and Human Services Payment Management System (PMS). The Grants Management Specialist (GMS) for the applicable awards has informed the University that technical issues within PMS are preventing reports from automatically being made available for preparation and subsequent certification. The GMS requested the University institute a procedure to request report access when identified as unavailable. The appropriate staff in Sponsored Projects Accounting have been informed of the PMS technical issue resulting in reports not being released for preparation and instructed to contact the GMS immediately to release the reports, if they are not readily available.

Federal Program Head Start Cluster: Assistance Listing Number 93.600 Federal Agency Department of Health and Human Services Pass-through Entity Not applicable, direct award Federal Award Year September 30, 2021 – September 29, 2023 Criteria or Requirement The requirements for reporting are contained in 2 CFR 200.328 which states unless otherwise approved by OMB, the Federal awarding agency must solicit only the OMB-approved governmentwide data elements for collection of financial information (at time of publication the Federal Financial Report or such future, OMB- approved, governmentwide data elements available from the OMB-designated standards lead). This information must be collected with the frequency required by the terms and conditions of the Federal award. Condition Found, including perspective The semi-annual Federal Financial Report (FFR) and Annual Federal Financial Report (AFFR), which are due 30 and 90 days, respectively, after the budget end period, detail cumulative program information that is required to be reported. We sampled two FFRs and the one AFFR for testing, and both of the FFRs were submitted late. The budget end period for project ID #136677 was September 29, 2022; however, the FFR was not submitted until December 9, 2022, 40 days late. The budget end period for project ID #138397 was April 30, 2023; however, the FFR was not submitted until May 2, 2023, 2 days late. Additionally, the FFR for project ID #138397 required information to be reported for the six-month period of September 29, 2023 to March 29, 2023; however, only 5 months of activity was reported. Cause Required program information for project ID #136677 was not made available within HHS’ Payment Management System (PMS) by the Sponsor for the University to prepare the FFR until December 2, 2022. This was 33 days after the due date of October 30, 2022. Further, due to human oversight, the FFR for project ID #138397 erroneously excluded data (5 months submitted vs. 6 months required) and was not submitted prior to the April 30, 2023 due date. Effect Failure to properly submit accurate and timely reporting submissions may prevent the University from being in compliance with the requirements set forth by the Uniform Guidance. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University enhance the design and implementation of internal controls to ensure that all required reports are submitted accurately and timely. Views of Responsible Officials Management agrees with the finding. The University takes seriously its responsibility to meet all financial terms and conditions of grants, contracts, and other agreements including reporting. Reporting requirements are flagged in the University’s financial systems and manually tracked for completion where sponsor systems do not provide systematic alerts of pending and delinquent reports. The Early Head Start program reporting requirements are tracked via the U.S. Department of Health and Human Services Payment Management System (PMS). The Grants Management Specialist (GMS) for the applicable awards has informed the University that technical issues within PMS are preventing reports from automatically being made available for preparation and subsequent certification. The GMS requested the University institute a procedure to request report access when identified as unavailable. The appropriate staff in Sponsored Projects Accounting have been informed of the PMS technical issue resulting in reports not being released for preparation and instructed to contact the GMS immediately to release the reports, if they are not readily available.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Research and Development Cluster ALNs 12.RD, 81.087, 93.RD, 93.173, 93.273, 93.336, 93.837, 93.839, 93.847, 93.855, 93.865, 93.866 Federal Agencies Department of Defense, Department of Energy, Department of Health and Human Services Pass-through Entity Various Federal Award Year Ranges from September 23, 2016 – September 30, 2025 Criteria or Requirement 2 CFR 200.320(a)(2)(i) states that small purchase procedures for non-Federal entities includes the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. The University's procurement policies and procedures for small purchases requires the University's purchaser to conduct and select a supplier through a competitive bidding process for items ranging between $10,000 and $50,000. The University's procurement policies state that competitive bidding is not required when purchasing goods or services from a University contracted supplier or for directed sole source purchases. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to comply with the University's purchasing policies and procedures. Condition Found, including perspective University purchasers have the ability to request payment for goods or services purchased by submitting a requisition in Panther Express for the order to be routed to the Purchasing Department for review and approval, or an other payment request (OPR) specialty form is completed and submitted with the invoice in Panther Express which bypasses the Purchasing Department to Payment Processing for review and check processing. We identified one out of the 40 procurements sampled for testing did not have the required competitive bidding documentation for purchases ranging between $10,000 and $50,000 because the University purchaser utilized the OPR form bypassing the Purchasing Department review. The Purchasing Department subsequently ran queries from its system for a list of all Research and Development cluster (R&D) expenditures exceeding $10,000 that utilized the OPR form that did not have the required competitive bidding documentation and identified 24 purchases (including our sampled item) from multiple University purchasers totaling approximately $402,000, which is 0.04% of total R&D expenditures. None of these purchases were from a University contracted supplier, and there was no directed or sole source documentation filed, which is a violation of the University procurement policies. Cause University purchasers did not follow University payment procedures for procurements exceeding $10,000 to be reviewed and approved by the Purchasing Department prior to disbursement. Effect Failure to properly follow University payment and procurement policies could result in noncompliance and/or the use of an inappropriate vendor. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University reinforce its procurement policies and procedures to all departments to ensure all the University’s procurement policies are being followed. Views of Responsible Officials Management agrees with the finding and the following corrective actions are being taken to minimize future risks. First, although all purchasers are required to complete training on purchasing and payment policies prior to obtaining system access, a refresher policy training will be provided to the 13 departments in which exceptions were discovered along with a reminder communication to all the approximately 4,300 department purchasers. This will be completed by June 30, 2024. Second, for certain types of purchases such as those involving intellectual property rights, suppliers may complete work in good faith and request payment in the absence of a purchase order or contract. A new procedure has been instituted requiring the department/supplier to execute a contract prior to payment in order to minimize legal risks to the University and its funding agencies. This new procedure is complete. Finally, we are analyzing legitimate uses of the OPRS form and evaluating whether placing a maximum dollar limit, such as $5,000, for the use of the form will further strengthen internal controls. The evaluation will be completed by June 30, 2024. Implementing maximum dollar limits on the OPRS form will require IT changes, and therefore implementation will not occur until December 31, 2024.

Federal Program Head Start Cluster: Assistance Listing Number 93.600 Federal Agency Department of Health and Human Services Pass-through Entity Not applicable, direct award Federal Award Year September 30, 2021 – September 29, 2023 Criteria or Requirement The requirements for reporting are contained in 2 CFR 200.328 which states unless otherwise approved by OMB, the Federal awarding agency must solicit only the OMB-approved governmentwide data elements for collection of financial information (at time of publication the Federal Financial Report or such future, OMB- approved, governmentwide data elements available from the OMB-designated standards lead). This information must be collected with the frequency required by the terms and conditions of the Federal award. Condition Found, including perspective The semi-annual Federal Financial Report (FFR) and Annual Federal Financial Report (AFFR), which are due 30 and 90 days, respectively, after the budget end period, detail cumulative program information that is required to be reported. We sampled two FFRs and the one AFFR for testing, and both of the FFRs were submitted late. The budget end period for project ID #136677 was September 29, 2022; however, the FFR was not submitted until December 9, 2022, 40 days late. The budget end period for project ID #138397 was April 30, 2023; however, the FFR was not submitted until May 2, 2023, 2 days late. Additionally, the FFR for project ID #138397 required information to be reported for the six-month period of September 29, 2023 to March 29, 2023; however, only 5 months of activity was reported. Cause Required program information for project ID #136677 was not made available within HHS’ Payment Management System (PMS) by the Sponsor for the University to prepare the FFR until December 2, 2022. This was 33 days after the due date of October 30, 2022. Further, due to human oversight, the FFR for project ID #138397 erroneously excluded data (5 months submitted vs. 6 months required) and was not submitted prior to the April 30, 2023 due date. Effect Failure to properly submit accurate and timely reporting submissions may prevent the University from being in compliance with the requirements set forth by the Uniform Guidance. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University enhance the design and implementation of internal controls to ensure that all required reports are submitted accurately and timely. Views of Responsible Officials Management agrees with the finding. The University takes seriously its responsibility to meet all financial terms and conditions of grants, contracts, and other agreements including reporting. Reporting requirements are flagged in the University’s financial systems and manually tracked for completion where sponsor systems do not provide systematic alerts of pending and delinquent reports. The Early Head Start program reporting requirements are tracked via the U.S. Department of Health and Human Services Payment Management System (PMS). The Grants Management Specialist (GMS) for the applicable awards has informed the University that technical issues within PMS are preventing reports from automatically being made available for preparation and subsequent certification. The GMS requested the University institute a procedure to request report access when identified as unavailable. The appropriate staff in Sponsored Projects Accounting have been informed of the PMS technical issue resulting in reports not being released for preparation and instructed to contact the GMS immediately to release the reports, if they are not readily available.

Federal Program Head Start Cluster: Assistance Listing Number 93.600 Federal Agency Department of Health and Human Services Pass-through Entity Not applicable, direct award Federal Award Year September 30, 2021 – September 29, 2023 Criteria or Requirement The requirements for reporting are contained in 2 CFR 200.328 which states unless otherwise approved by OMB, the Federal awarding agency must solicit only the OMB-approved governmentwide data elements for collection of financial information (at time of publication the Federal Financial Report or such future, OMB- approved, governmentwide data elements available from the OMB-designated standards lead). This information must be collected with the frequency required by the terms and conditions of the Federal award. Condition Found, including perspective The semi-annual Federal Financial Report (FFR) and Annual Federal Financial Report (AFFR), which are due 30 and 90 days, respectively, after the budget end period, detail cumulative program information that is required to be reported. We sampled two FFRs and the one AFFR for testing, and both of the FFRs were submitted late. The budget end period for project ID #136677 was September 29, 2022; however, the FFR was not submitted until December 9, 2022, 40 days late. The budget end period for project ID #138397 was April 30, 2023; however, the FFR was not submitted until May 2, 2023, 2 days late. Additionally, the FFR for project ID #138397 required information to be reported for the six-month period of September 29, 2023 to March 29, 2023; however, only 5 months of activity was reported. Cause Required program information for project ID #136677 was not made available within HHS’ Payment Management System (PMS) by the Sponsor for the University to prepare the FFR until December 2, 2022. This was 33 days after the due date of October 30, 2022. Further, due to human oversight, the FFR for project ID #138397 erroneously excluded data (5 months submitted vs. 6 months required) and was not submitted prior to the April 30, 2023 due date. Effect Failure to properly submit accurate and timely reporting submissions may prevent the University from being in compliance with the requirements set forth by the Uniform Guidance. Questioned Costs No questioned costs were identified. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No. Recommendation We recommend that the University enhance the design and implementation of internal controls to ensure that all required reports are submitted accurately and timely. Views of Responsible Officials Management agrees with the finding. The University takes seriously its responsibility to meet all financial terms and conditions of grants, contracts, and other agreements including reporting. Reporting requirements are flagged in the University’s financial systems and manually tracked for completion where sponsor systems do not provide systematic alerts of pending and delinquent reports. The Early Head Start program reporting requirements are tracked via the U.S. Department of Health and Human Services Payment Management System (PMS). The Grants Management Specialist (GMS) for the applicable awards has informed the University that technical issues within PMS are preventing reports from automatically being made available for preparation and subsequent certification. The GMS requested the University institute a procedure to request report access when identified as unavailable. The appropriate staff in Sponsored Projects Accounting have been informed of the PMS technical issue resulting in reports not being released for preparation and instructed to contact the GMS immediately to release the reports, if they are not readily available.