Audit 310163

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Subrecipient Monitoring Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.RDC, 12.300, 93.393, 93.396, 93.847, 93.853, 93.859 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.332(d) of the Uniform Guidance states: “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that the subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity.” Furthermore, it is the Clinic’s policy for principal investigators to complete a subaward monitoring checklist as part of the monthly/quarterly reviews of subrecipient performance. Condition: Subaward monitoring checklists were not consistently completed or retained to evidence the results of the monitoring performed over subrecipients by principal investigators during the fiscal year. Cause: Established internal controls over the completion of the subaward monitoring checklist as part of the monthly/quarterly reviews were not followed during the fiscal year. Effect or potential effect: Subrecipients may not be monitored timely. Subaward may not be used for authorized purposes, or performance goals may not be achieved by the subrecipient. Questioned costs: None. Context: We sampled 40 subaward monitoring checklists required to be completed during fiscal year 2023 by various principal investigators and noted the following related to the subaward monitoring checklist: • Not included with the monthly/quarterly review materials (2 instances), • Not completed due to retirement of the principal investigator (1 instance), • Not completed timely during fiscal year 2023 (10 instances) o Subaward monitoring checklists are included in regular financial reviews which were delayed due to implementation of a new general ledger system effective April 1, 2023. Various Q3 and Q4 2023 subaward monitoring checklists were not completed until Q1 2024. Subrecipient expenditures are $54,435,304, representing 12.2% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: The Clinic should ensure that the subrecipient monitoring checklist is completed timely and documentation is retained to support the operating effectiveness of established internal controls. Views of responsible officials: Subaward monitoring checklists are included in monthly/quarterly reviews, which were delayed during the last half of 2023 due to the implementation of a new general ledger system effective April 1, 2023. Monthly/quarterly reviews resumed in January 2024. Communication has occurred to reiterate control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Procurement, Suspension and Debarment Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Pass-Through Entity: The University of Texas Health (93.853, NS119834) Assistance Listing Nos.: 12.420, 93.310, 93.353, 93.393, and 93.853 Award Numbers: W81XWH-15-1-0292 (12.420), OD23121 (93.310), CA246568 (93.353), CA259201 (93.393), NS119834 (93.853), NS122096 (93.853) Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.320(a)(2)(i) of the Uniform Guidance states the following regarding small purchases: “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed: “When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with § 200.319 or paragraph (c) of this section.” Section 200.214 of the Uniform Guidance states “Non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.” The Clinic procurement justification form for procurements more than $25,000 requires completion of the rationale for the procurement and a search of the federal government’s exclusion list to be performed and documented at the time of the procurement. On a monthly basis, Supply Chain Management performs a review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures. Condition: Internal Control For five (56%) of nine procurement transactions tested for operating effectiveness of internal controls, the procurement justification form used by the Clinic to document the history of the procurement and compliance with Uniform Guidance CFR 200.303, was not completed until after the purchase order was created and/or invoice received from the vendor. In addition, for these same five procurement transactions, the Clinic did not timely document its suspension and debarment check at the time of procurement as required by its procurement justification form. In addition, for four (44%) of nine procurement transactions tested for operating effectiveness of internal controls (two of which relate to the five cited above), the procurement justification form used by the Clinic to document the procurement transaction’s compliance with policies, procedures and the Uniform Guidance was outdated. Furthermore, the monthly review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures was not operating effectively. Compliance For one (9%) of 11 procurement transactions tested for compliance, the procurement was an add-on purchase related to a larger procurement of the same product under a prior purchase order. The prior procurement was above the simplified acquisition threshold and the Clinic’s competitive bid threshold. The Clinic did not complete a procurement justification form for the add-on purchase (which was a small purchase), and the original procurement did not have adequate support to evidence that it had been competitively bid. As such, adequate documentation did not exist for the procurement in accordance with Uniform Guidance Section 230.320(a)(2)(i) and(b). In addition, for five procurement transactions, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Cause: While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures and Uniform Guidance CFR 200.320, the review of the procurement justification form is not robust enough to identify errors and there is not a process in place to ensure the form is completed prior to the purchase. Effect or potential effect: The Clinic’s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to small purchases and noncompetitive procurements. Questioned costs: $53,482, determined as the amount of the procurement expenditures included in the schedule of expenditures of federal awards for the year ended December 31, 2023, for the one procurement transaction that had inadequate support for compliance with CFR 200.320 at the time of procurement, as follows: • Assistance Listing No. 93.310, OD023121 – $53,482 Context: Internal Control We sampled nine federal procurements over $25,000 to test operating effectiveness of internal controls, totaling $962,393, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For seven of the 11 federal procurements tested totaling $770,093, procurement controls were not operating effectively. • For five of 11 procurement transactions tested totaling $529,273, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately two to eight months later. Compliance We sampled 11 federal procurements over $25,000 to test compliance, totaling $1,736,844, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For one of 11 federal procurements tested totaling $53,482, documentation retained was not adequate to support that the procurement transaction was executed in accordance with the Uniform Guidance Sections 200.320(a)(2)(i) and (b). • For five of 11 procurement transactions tested totaling $529,273, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Procurement-related expenditures are approximately 9% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is not a repeat of the finding of the prior year. Recommendation: The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures, and internal controls to comply with the Uniform Guidance procurement standards and that the procurement justification form is reviewed prior to entering into the purchase transaction. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with the Clinic documented policies, procedures, and internal controls. Views of responsible officials: Management will reinforce education and training to the research community and procurement teams regarding the procurement requirements, Justification of Source Selection Checklist/Form, and timely completion of the required documentation. The Clinic utilizes a third party, Visual Compliance, to execute daily supplier sanction and debarment checks for all Mayo Clinic vendors. All third party suspension and debarment match alerts are reviewed and adjudicated as needed. Going forward, the Clinic will supplement this daily review by periodically validating a sample of vendors who are not flagged with an alert by Visual Compliance.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Subrecipient Monitoring Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.RDC, 12.300, 93.393, 93.396, 93.847, 93.853, 93.859 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.332(d) of the Uniform Guidance states: “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that the subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity.” Furthermore, it is the Clinic’s policy for principal investigators to complete a subaward monitoring checklist as part of the monthly/quarterly reviews of subrecipient performance. Condition: Subaward monitoring checklists were not consistently completed or retained to evidence the results of the monitoring performed over subrecipients by principal investigators during the fiscal year. Cause: Established internal controls over the completion of the subaward monitoring checklist as part of the monthly/quarterly reviews were not followed during the fiscal year. Effect or potential effect: Subrecipients may not be monitored timely. Subaward may not be used for authorized purposes, or performance goals may not be achieved by the subrecipient. Questioned costs: None. Context: We sampled 40 subaward monitoring checklists required to be completed during fiscal year 2023 by various principal investigators and noted the following related to the subaward monitoring checklist: • Not included with the monthly/quarterly review materials (2 instances), • Not completed due to retirement of the principal investigator (1 instance), • Not completed timely during fiscal year 2023 (10 instances) o Subaward monitoring checklists are included in regular financial reviews which were delayed due to implementation of a new general ledger system effective April 1, 2023. Various Q3 and Q4 2023 subaward monitoring checklists were not completed until Q1 2024. Subrecipient expenditures are $54,435,304, representing 12.2% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: The Clinic should ensure that the subrecipient monitoring checklist is completed timely and documentation is retained to support the operating effectiveness of established internal controls. Views of responsible officials: Subaward monitoring checklists are included in monthly/quarterly reviews, which were delayed during the last half of 2023 due to the implementation of a new general ledger system effective April 1, 2023. Monthly/quarterly reviews resumed in January 2024. Communication has occurred to reiterate control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Procurement, Suspension and Debarment Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Pass-Through Entity: The University of Texas Health (93.853, NS119834) Assistance Listing Nos.: 12.420, 93.310, 93.353, 93.393, and 93.853 Award Numbers: W81XWH-15-1-0292 (12.420), OD23121 (93.310), CA246568 (93.353), CA259201 (93.393), NS119834 (93.853), NS122096 (93.853) Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.320(a)(2)(i) of the Uniform Guidance states the following regarding small purchases: “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed: “When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with § 200.319 or paragraph (c) of this section.” Section 200.214 of the Uniform Guidance states “Non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.” The Clinic procurement justification form for procurements more than $25,000 requires completion of the rationale for the procurement and a search of the federal government’s exclusion list to be performed and documented at the time of the procurement. On a monthly basis, Supply Chain Management performs a review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures. Condition: Internal Control For five (56%) of nine procurement transactions tested for operating effectiveness of internal controls, the procurement justification form used by the Clinic to document the history of the procurement and compliance with Uniform Guidance CFR 200.303, was not completed until after the purchase order was created and/or invoice received from the vendor. In addition, for these same five procurement transactions, the Clinic did not timely document its suspension and debarment check at the time of procurement as required by its procurement justification form. In addition, for four (44%) of nine procurement transactions tested for operating effectiveness of internal controls (two of which relate to the five cited above), the procurement justification form used by the Clinic to document the procurement transaction’s compliance with policies, procedures and the Uniform Guidance was outdated. Furthermore, the monthly review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures was not operating effectively. Compliance For one (9%) of 11 procurement transactions tested for compliance, the procurement was an add-on purchase related to a larger procurement of the same product under a prior purchase order. The prior procurement was above the simplified acquisition threshold and the Clinic’s competitive bid threshold. The Clinic did not complete a procurement justification form for the add-on purchase (which was a small purchase), and the original procurement did not have adequate support to evidence that it had been competitively bid. As such, adequate documentation did not exist for the procurement in accordance with Uniform Guidance Section 230.320(a)(2)(i) and(b). In addition, for five procurement transactions, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Cause: While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures and Uniform Guidance CFR 200.320, the review of the procurement justification form is not robust enough to identify errors and there is not a process in place to ensure the form is completed prior to the purchase. Effect or potential effect: The Clinic’s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to small purchases and noncompetitive procurements. Questioned costs: $53,482, determined as the amount of the procurement expenditures included in the schedule of expenditures of federal awards for the year ended December 31, 2023, for the one procurement transaction that had inadequate support for compliance with CFR 200.320 at the time of procurement, as follows: • Assistance Listing No. 93.310, OD023121 – $53,482 Context: Internal Control We sampled nine federal procurements over $25,000 to test operating effectiveness of internal controls, totaling $962,393, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For seven of the 11 federal procurements tested totaling $770,093, procurement controls were not operating effectively. • For five of 11 procurement transactions tested totaling $529,273, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately two to eight months later. Compliance We sampled 11 federal procurements over $25,000 to test compliance, totaling $1,736,844, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For one of 11 federal procurements tested totaling $53,482, documentation retained was not adequate to support that the procurement transaction was executed in accordance with the Uniform Guidance Sections 200.320(a)(2)(i) and (b). • For five of 11 procurement transactions tested totaling $529,273, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Procurement-related expenditures are approximately 9% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is not a repeat of the finding of the prior year. Recommendation: The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures, and internal controls to comply with the Uniform Guidance procurement standards and that the procurement justification form is reviewed prior to entering into the purchase transaction. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with the Clinic documented policies, procedures, and internal controls. Views of responsible officials: Management will reinforce education and training to the research community and procurement teams regarding the procurement requirements, Justification of Source Selection Checklist/Form, and timely completion of the required documentation. The Clinic utilizes a third party, Visual Compliance, to execute daily supplier sanction and debarment checks for all Mayo Clinic vendors. All third party suspension and debarment match alerts are reviewed and adjudicated as needed. Going forward, the Clinic will supplement this daily review by periodically validating a sample of vendors who are not flagged with an alert by Visual Compliance.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Procurement, Suspension and Debarment Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Pass-Through Entity: The University of Texas Health (93.853, NS119834) Assistance Listing Nos.: 12.420, 93.310, 93.353, 93.393, and 93.853 Award Numbers: W81XWH-15-1-0292 (12.420), OD23121 (93.310), CA246568 (93.353), CA259201 (93.393), NS119834 (93.853), NS122096 (93.853) Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.320(a)(2)(i) of the Uniform Guidance states the following regarding small purchases: “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed: “When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with § 200.319 or paragraph (c) of this section.” Section 200.214 of the Uniform Guidance states “Non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.” The Clinic procurement justification form for procurements more than $25,000 requires completion of the rationale for the procurement and a search of the federal government’s exclusion list to be performed and documented at the time of the procurement. On a monthly basis, Supply Chain Management performs a review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures. Condition: Internal Control For five (56%) of nine procurement transactions tested for operating effectiveness of internal controls, the procurement justification form used by the Clinic to document the history of the procurement and compliance with Uniform Guidance CFR 200.303, was not completed until after the purchase order was created and/or invoice received from the vendor. In addition, for these same five procurement transactions, the Clinic did not timely document its suspension and debarment check at the time of procurement as required by its procurement justification form. In addition, for four (44%) of nine procurement transactions tested for operating effectiveness of internal controls (two of which relate to the five cited above), the procurement justification form used by the Clinic to document the procurement transaction’s compliance with policies, procedures and the Uniform Guidance was outdated. Furthermore, the monthly review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures was not operating effectively. Compliance For one (9%) of 11 procurement transactions tested for compliance, the procurement was an add-on purchase related to a larger procurement of the same product under a prior purchase order. The prior procurement was above the simplified acquisition threshold and the Clinic’s competitive bid threshold. The Clinic did not complete a procurement justification form for the add-on purchase (which was a small purchase), and the original procurement did not have adequate support to evidence that it had been competitively bid. As such, adequate documentation did not exist for the procurement in accordance with Uniform Guidance Section 230.320(a)(2)(i) and(b). In addition, for five procurement transactions, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Cause: While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures and Uniform Guidance CFR 200.320, the review of the procurement justification form is not robust enough to identify errors and there is not a process in place to ensure the form is completed prior to the purchase. Effect or potential effect: The Clinic’s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to small purchases and noncompetitive procurements. Questioned costs: $53,482, determined as the amount of the procurement expenditures included in the schedule of expenditures of federal awards for the year ended December 31, 2023, for the one procurement transaction that had inadequate support for compliance with CFR 200.320 at the time of procurement, as follows: • Assistance Listing No. 93.310, OD023121 – $53,482 Context: Internal Control We sampled nine federal procurements over $25,000 to test operating effectiveness of internal controls, totaling $962,393, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For seven of the 11 federal procurements tested totaling $770,093, procurement controls were not operating effectively. • For five of 11 procurement transactions tested totaling $529,273, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately two to eight months later. Compliance We sampled 11 federal procurements over $25,000 to test compliance, totaling $1,736,844, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For one of 11 federal procurements tested totaling $53,482, documentation retained was not adequate to support that the procurement transaction was executed in accordance with the Uniform Guidance Sections 200.320(a)(2)(i) and (b). • For five of 11 procurement transactions tested totaling $529,273, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Procurement-related expenditures are approximately 9% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is not a repeat of the finding of the prior year. Recommendation: The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures, and internal controls to comply with the Uniform Guidance procurement standards and that the procurement justification form is reviewed prior to entering into the purchase transaction. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with the Clinic documented policies, procedures, and internal controls. Views of responsible officials: Management will reinforce education and training to the research community and procurement teams regarding the procurement requirements, Justification of Source Selection Checklist/Form, and timely completion of the required documentation. The Clinic utilizes a third party, Visual Compliance, to execute daily supplier sanction and debarment checks for all Mayo Clinic vendors. All third party suspension and debarment match alerts are reviewed and adjudicated as needed. Going forward, the Clinic will supplement this daily review by periodically validating a sample of vendors who are not flagged with an alert by Visual Compliance.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Subrecipient Monitoring Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.RDC, 12.300, 93.393, 93.396, 93.847, 93.853, 93.859 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.332(d) of the Uniform Guidance states: “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that the subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity.” Furthermore, it is the Clinic’s policy for principal investigators to complete a subaward monitoring checklist as part of the monthly/quarterly reviews of subrecipient performance. Condition: Subaward monitoring checklists were not consistently completed or retained to evidence the results of the monitoring performed over subrecipients by principal investigators during the fiscal year. Cause: Established internal controls over the completion of the subaward monitoring checklist as part of the monthly/quarterly reviews were not followed during the fiscal year. Effect or potential effect: Subrecipients may not be monitored timely. Subaward may not be used for authorized purposes, or performance goals may not be achieved by the subrecipient. Questioned costs: None. Context: We sampled 40 subaward monitoring checklists required to be completed during fiscal year 2023 by various principal investigators and noted the following related to the subaward monitoring checklist: • Not included with the monthly/quarterly review materials (2 instances), • Not completed due to retirement of the principal investigator (1 instance), • Not completed timely during fiscal year 2023 (10 instances) o Subaward monitoring checklists are included in regular financial reviews which were delayed due to implementation of a new general ledger system effective April 1, 2023. Various Q3 and Q4 2023 subaward monitoring checklists were not completed until Q1 2024. Subrecipient expenditures are $54,435,304, representing 12.2% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: The Clinic should ensure that the subrecipient monitoring checklist is completed timely and documentation is retained to support the operating effectiveness of established internal controls. Views of responsible officials: Subaward monitoring checklists are included in monthly/quarterly reviews, which were delayed during the last half of 2023 due to the implementation of a new general ledger system effective April 1, 2023. Monthly/quarterly reviews resumed in January 2024. Communication has occurred to reiterate control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Procurement, Suspension and Debarment Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Pass-Through Entity: The University of Texas Health (93.853, NS119834) Assistance Listing Nos.: 12.420, 93.310, 93.353, 93.393, and 93.853 Award Numbers: W81XWH-15-1-0292 (12.420), OD23121 (93.310), CA246568 (93.353), CA259201 (93.393), NS119834 (93.853), NS122096 (93.853) Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.320(a)(2)(i) of the Uniform Guidance states the following regarding small purchases: “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed: “When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with § 200.319 or paragraph (c) of this section.” Section 200.214 of the Uniform Guidance states “Non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.” The Clinic procurement justification form for procurements more than $25,000 requires completion of the rationale for the procurement and a search of the federal government’s exclusion list to be performed and documented at the time of the procurement. On a monthly basis, Supply Chain Management performs a review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures. Condition: Internal Control For five (56%) of nine procurement transactions tested for operating effectiveness of internal controls, the procurement justification form used by the Clinic to document the history of the procurement and compliance with Uniform Guidance CFR 200.303, was not completed until after the purchase order was created and/or invoice received from the vendor. In addition, for these same five procurement transactions, the Clinic did not timely document its suspension and debarment check at the time of procurement as required by its procurement justification form. In addition, for four (44%) of nine procurement transactions tested for operating effectiveness of internal controls (two of which relate to the five cited above), the procurement justification form used by the Clinic to document the procurement transaction’s compliance with policies, procedures and the Uniform Guidance was outdated. Furthermore, the monthly review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures was not operating effectively. Compliance For one (9%) of 11 procurement transactions tested for compliance, the procurement was an add-on purchase related to a larger procurement of the same product under a prior purchase order. The prior procurement was above the simplified acquisition threshold and the Clinic’s competitive bid threshold. The Clinic did not complete a procurement justification form for the add-on purchase (which was a small purchase), and the original procurement did not have adequate support to evidence that it had been competitively bid. As such, adequate documentation did not exist for the procurement in accordance with Uniform Guidance Section 230.320(a)(2)(i) and(b). In addition, for five procurement transactions, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Cause: While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures and Uniform Guidance CFR 200.320, the review of the procurement justification form is not robust enough to identify errors and there is not a process in place to ensure the form is completed prior to the purchase. Effect or potential effect: The Clinic’s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to small purchases and noncompetitive procurements. Questioned costs: $53,482, determined as the amount of the procurement expenditures included in the schedule of expenditures of federal awards for the year ended December 31, 2023, for the one procurement transaction that had inadequate support for compliance with CFR 200.320 at the time of procurement, as follows: • Assistance Listing No. 93.310, OD023121 – $53,482 Context: Internal Control We sampled nine federal procurements over $25,000 to test operating effectiveness of internal controls, totaling $962,393, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For seven of the 11 federal procurements tested totaling $770,093, procurement controls were not operating effectively. • For five of 11 procurement transactions tested totaling $529,273, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately two to eight months later. Compliance We sampled 11 federal procurements over $25,000 to test compliance, totaling $1,736,844, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For one of 11 federal procurements tested totaling $53,482, documentation retained was not adequate to support that the procurement transaction was executed in accordance with the Uniform Guidance Sections 200.320(a)(2)(i) and (b). • For five of 11 procurement transactions tested totaling $529,273, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Procurement-related expenditures are approximately 9% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is not a repeat of the finding of the prior year. Recommendation: The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures, and internal controls to comply with the Uniform Guidance procurement standards and that the procurement justification form is reviewed prior to entering into the purchase transaction. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with the Clinic documented policies, procedures, and internal controls. Views of responsible officials: Management will reinforce education and training to the research community and procurement teams regarding the procurement requirements, Justification of Source Selection Checklist/Form, and timely completion of the required documentation. The Clinic utilizes a third party, Visual Compliance, to execute daily supplier sanction and debarment checks for all Mayo Clinic vendors. All third party suspension and debarment match alerts are reviewed and adjudicated as needed. Going forward, the Clinic will supplement this daily review by periodically validating a sample of vendors who are not flagged with an alert by Visual Compliance.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Subrecipient Monitoring Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.RDC, 12.300, 93.393, 93.396, 93.847, 93.853, 93.859 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.332(d) of the Uniform Guidance states: “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that the subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity.” Furthermore, it is the Clinic’s policy for principal investigators to complete a subaward monitoring checklist as part of the monthly/quarterly reviews of subrecipient performance. Condition: Subaward monitoring checklists were not consistently completed or retained to evidence the results of the monitoring performed over subrecipients by principal investigators during the fiscal year. Cause: Established internal controls over the completion of the subaward monitoring checklist as part of the monthly/quarterly reviews were not followed during the fiscal year. Effect or potential effect: Subrecipients may not be monitored timely. Subaward may not be used for authorized purposes, or performance goals may not be achieved by the subrecipient. Questioned costs: None. Context: We sampled 40 subaward monitoring checklists required to be completed during fiscal year 2023 by various principal investigators and noted the following related to the subaward monitoring checklist: • Not included with the monthly/quarterly review materials (2 instances), • Not completed due to retirement of the principal investigator (1 instance), • Not completed timely during fiscal year 2023 (10 instances) o Subaward monitoring checklists are included in regular financial reviews which were delayed due to implementation of a new general ledger system effective April 1, 2023. Various Q3 and Q4 2023 subaward monitoring checklists were not completed until Q1 2024. Subrecipient expenditures are $54,435,304, representing 12.2% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: The Clinic should ensure that the subrecipient monitoring checklist is completed timely and documentation is retained to support the operating effectiveness of established internal controls. Views of responsible officials: Subaward monitoring checklists are included in monthly/quarterly reviews, which were delayed during the last half of 2023 due to the implementation of a new general ledger system effective April 1, 2023. Monthly/quarterly reviews resumed in January 2024. Communication has occurred to reiterate control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Subrecipient Monitoring Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.RDC, 12.300, 93.393, 93.396, 93.847, 93.853, 93.859 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.332(d) of the Uniform Guidance states: “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that the subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity.” Furthermore, it is the Clinic’s policy for principal investigators to complete a subaward monitoring checklist as part of the monthly/quarterly reviews of subrecipient performance. Condition: Subaward monitoring checklists were not consistently completed or retained to evidence the results of the monitoring performed over subrecipients by principal investigators during the fiscal year. Cause: Established internal controls over the completion of the subaward monitoring checklist as part of the monthly/quarterly reviews were not followed during the fiscal year. Effect or potential effect: Subrecipients may not be monitored timely. Subaward may not be used for authorized purposes, or performance goals may not be achieved by the subrecipient. Questioned costs: None. Context: We sampled 40 subaward monitoring checklists required to be completed during fiscal year 2023 by various principal investigators and noted the following related to the subaward monitoring checklist: • Not included with the monthly/quarterly review materials (2 instances), • Not completed due to retirement of the principal investigator (1 instance), • Not completed timely during fiscal year 2023 (10 instances) o Subaward monitoring checklists are included in regular financial reviews which were delayed due to implementation of a new general ledger system effective April 1, 2023. Various Q3 and Q4 2023 subaward monitoring checklists were not completed until Q1 2024. Subrecipient expenditures are $54,435,304, representing 12.2% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: The Clinic should ensure that the subrecipient monitoring checklist is completed timely and documentation is retained to support the operating effectiveness of established internal controls. Views of responsible officials: Subaward monitoring checklists are included in monthly/quarterly reviews, which were delayed during the last half of 2023 due to the implementation of a new general ledger system effective April 1, 2023. Monthly/quarterly reviews resumed in January 2024. Communication has occurred to reiterate control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Subrecipient Monitoring Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.RDC, 12.300, 93.393, 93.396, 93.847, 93.853, 93.859 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.332(d) of the Uniform Guidance states: “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that the subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity.” Furthermore, it is the Clinic’s policy for principal investigators to complete a subaward monitoring checklist as part of the monthly/quarterly reviews of subrecipient performance. Condition: Subaward monitoring checklists were not consistently completed or retained to evidence the results of the monitoring performed over subrecipients by principal investigators during the fiscal year. Cause: Established internal controls over the completion of the subaward monitoring checklist as part of the monthly/quarterly reviews were not followed during the fiscal year. Effect or potential effect: Subrecipients may not be monitored timely. Subaward may not be used for authorized purposes, or performance goals may not be achieved by the subrecipient. Questioned costs: None. Context: We sampled 40 subaward monitoring checklists required to be completed during fiscal year 2023 by various principal investigators and noted the following related to the subaward monitoring checklist: • Not included with the monthly/quarterly review materials (2 instances), • Not completed due to retirement of the principal investigator (1 instance), • Not completed timely during fiscal year 2023 (10 instances) o Subaward monitoring checklists are included in regular financial reviews which were delayed due to implementation of a new general ledger system effective April 1, 2023. Various Q3 and Q4 2023 subaward monitoring checklists were not completed until Q1 2024. Subrecipient expenditures are $54,435,304, representing 12.2% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: The Clinic should ensure that the subrecipient monitoring checklist is completed timely and documentation is retained to support the operating effectiveness of established internal controls. Views of responsible officials: Subaward monitoring checklists are included in monthly/quarterly reviews, which were delayed during the last half of 2023 due to the implementation of a new general ledger system effective April 1, 2023. Monthly/quarterly reviews resumed in January 2024. Communication has occurred to reiterate control process expectations.

Procurement, Suspension and Debarment Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Pass-Through Entity: The University of Texas Health (93.853, NS119834) Assistance Listing Nos.: 12.420, 93.310, 93.353, 93.393, and 93.853 Award Numbers: W81XWH-15-1-0292 (12.420), OD23121 (93.310), CA246568 (93.353), CA259201 (93.393), NS119834 (93.853), NS122096 (93.853) Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.320(a)(2)(i) of the Uniform Guidance states the following regarding small purchases: “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed: “When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with § 200.319 or paragraph (c) of this section.” Section 200.214 of the Uniform Guidance states “Non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.” The Clinic procurement justification form for procurements more than $25,000 requires completion of the rationale for the procurement and a search of the federal government’s exclusion list to be performed and documented at the time of the procurement. On a monthly basis, Supply Chain Management performs a review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures. Condition: Internal Control For five (56%) of nine procurement transactions tested for operating effectiveness of internal controls, the procurement justification form used by the Clinic to document the history of the procurement and compliance with Uniform Guidance CFR 200.303, was not completed until after the purchase order was created and/or invoice received from the vendor. In addition, for these same five procurement transactions, the Clinic did not timely document its suspension and debarment check at the time of procurement as required by its procurement justification form. In addition, for four (44%) of nine procurement transactions tested for operating effectiveness of internal controls (two of which relate to the five cited above), the procurement justification form used by the Clinic to document the procurement transaction’s compliance with policies, procedures and the Uniform Guidance was outdated. Furthermore, the monthly review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures was not operating effectively. Compliance For one (9%) of 11 procurement transactions tested for compliance, the procurement was an add-on purchase related to a larger procurement of the same product under a prior purchase order. The prior procurement was above the simplified acquisition threshold and the Clinic’s competitive bid threshold. The Clinic did not complete a procurement justification form for the add-on purchase (which was a small purchase), and the original procurement did not have adequate support to evidence that it had been competitively bid. As such, adequate documentation did not exist for the procurement in accordance with Uniform Guidance Section 230.320(a)(2)(i) and(b). In addition, for five procurement transactions, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Cause: While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures and Uniform Guidance CFR 200.320, the review of the procurement justification form is not robust enough to identify errors and there is not a process in place to ensure the form is completed prior to the purchase. Effect or potential effect: The Clinic’s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to small purchases and noncompetitive procurements. Questioned costs: $53,482, determined as the amount of the procurement expenditures included in the schedule of expenditures of federal awards for the year ended December 31, 2023, for the one procurement transaction that had inadequate support for compliance with CFR 200.320 at the time of procurement, as follows: • Assistance Listing No. 93.310, OD023121 – $53,482 Context: Internal Control We sampled nine federal procurements over $25,000 to test operating effectiveness of internal controls, totaling $962,393, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For seven of the 11 federal procurements tested totaling $770,093, procurement controls were not operating effectively. • For five of 11 procurement transactions tested totaling $529,273, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately two to eight months later. Compliance We sampled 11 federal procurements over $25,000 to test compliance, totaling $1,736,844, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For one of 11 federal procurements tested totaling $53,482, documentation retained was not adequate to support that the procurement transaction was executed in accordance with the Uniform Guidance Sections 200.320(a)(2)(i) and (b). • For five of 11 procurement transactions tested totaling $529,273, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Procurement-related expenditures are approximately 9% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is not a repeat of the finding of the prior year. Recommendation: The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures, and internal controls to comply with the Uniform Guidance procurement standards and that the procurement justification form is reviewed prior to entering into the purchase transaction. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with the Clinic documented policies, procedures, and internal controls. Views of responsible officials: Management will reinforce education and training to the research community and procurement teams regarding the procurement requirements, Justification of Source Selection Checklist/Form, and timely completion of the required documentation. The Clinic utilizes a third party, Visual Compliance, to execute daily supplier sanction and debarment checks for all Mayo Clinic vendors. All third party suspension and debarment match alerts are reviewed and adjudicated as needed. Going forward, the Clinic will supplement this daily review by periodically validating a sample of vendors who are not flagged with an alert by Visual Compliance.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Subrecipient Monitoring Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.RDC, 12.300, 93.393, 93.396, 93.847, 93.853, 93.859 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.332(d) of the Uniform Guidance states: “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that the subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity.” Furthermore, it is the Clinic’s policy for principal investigators to complete a subaward monitoring checklist as part of the monthly/quarterly reviews of subrecipient performance. Condition: Subaward monitoring checklists were not consistently completed or retained to evidence the results of the monitoring performed over subrecipients by principal investigators during the fiscal year. Cause: Established internal controls over the completion of the subaward monitoring checklist as part of the monthly/quarterly reviews were not followed during the fiscal year. Effect or potential effect: Subrecipients may not be monitored timely. Subaward may not be used for authorized purposes, or performance goals may not be achieved by the subrecipient. Questioned costs: None. Context: We sampled 40 subaward monitoring checklists required to be completed during fiscal year 2023 by various principal investigators and noted the following related to the subaward monitoring checklist: • Not included with the monthly/quarterly review materials (2 instances), • Not completed due to retirement of the principal investigator (1 instance), • Not completed timely during fiscal year 2023 (10 instances) o Subaward monitoring checklists are included in regular financial reviews which were delayed due to implementation of a new general ledger system effective April 1, 2023. Various Q3 and Q4 2023 subaward monitoring checklists were not completed until Q1 2024. Subrecipient expenditures are $54,435,304, representing 12.2% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: The Clinic should ensure that the subrecipient monitoring checklist is completed timely and documentation is retained to support the operating effectiveness of established internal controls. Views of responsible officials: Subaward monitoring checklists are included in monthly/quarterly reviews, which were delayed during the last half of 2023 due to the implementation of a new general ledger system effective April 1, 2023. Monthly/quarterly reviews resumed in January 2024. Communication has occurred to reiterate control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Subrecipient Monitoring Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.RDC, 12.300, 93.393, 93.396, 93.847, 93.853, 93.859 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.332(d) of the Uniform Guidance states: “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that the subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity.” Furthermore, it is the Clinic’s policy for principal investigators to complete a subaward monitoring checklist as part of the monthly/quarterly reviews of subrecipient performance. Condition: Subaward monitoring checklists were not consistently completed or retained to evidence the results of the monitoring performed over subrecipients by principal investigators during the fiscal year. Cause: Established internal controls over the completion of the subaward monitoring checklist as part of the monthly/quarterly reviews were not followed during the fiscal year. Effect or potential effect: Subrecipients may not be monitored timely. Subaward may not be used for authorized purposes, or performance goals may not be achieved by the subrecipient. Questioned costs: None. Context: We sampled 40 subaward monitoring checklists required to be completed during fiscal year 2023 by various principal investigators and noted the following related to the subaward monitoring checklist: • Not included with the monthly/quarterly review materials (2 instances), • Not completed due to retirement of the principal investigator (1 instance), • Not completed timely during fiscal year 2023 (10 instances) o Subaward monitoring checklists are included in regular financial reviews which were delayed due to implementation of a new general ledger system effective April 1, 2023. Various Q3 and Q4 2023 subaward monitoring checklists were not completed until Q1 2024. Subrecipient expenditures are $54,435,304, representing 12.2% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: The Clinic should ensure that the subrecipient monitoring checklist is completed timely and documentation is retained to support the operating effectiveness of established internal controls. Views of responsible officials: Subaward monitoring checklists are included in monthly/quarterly reviews, which were delayed during the last half of 2023 due to the implementation of a new general ledger system effective April 1, 2023. Monthly/quarterly reviews resumed in January 2024. Communication has occurred to reiterate control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Procurement, Suspension and Debarment Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Pass-Through Entity: The University of Texas Health (93.853, NS119834) Assistance Listing Nos.: 12.420, 93.310, 93.353, 93.393, and 93.853 Award Numbers: W81XWH-15-1-0292 (12.420), OD23121 (93.310), CA246568 (93.353), CA259201 (93.393), NS119834 (93.853), NS122096 (93.853) Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.320(a)(2)(i) of the Uniform Guidance states the following regarding small purchases: “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed: “When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with § 200.319 or paragraph (c) of this section.” Section 200.214 of the Uniform Guidance states “Non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.” The Clinic procurement justification form for procurements more than $25,000 requires completion of the rationale for the procurement and a search of the federal government’s exclusion list to be performed and documented at the time of the procurement. On a monthly basis, Supply Chain Management performs a review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures. Condition: Internal Control For five (56%) of nine procurement transactions tested for operating effectiveness of internal controls, the procurement justification form used by the Clinic to document the history of the procurement and compliance with Uniform Guidance CFR 200.303, was not completed until after the purchase order was created and/or invoice received from the vendor. In addition, for these same five procurement transactions, the Clinic did not timely document its suspension and debarment check at the time of procurement as required by its procurement justification form. In addition, for four (44%) of nine procurement transactions tested for operating effectiveness of internal controls (two of which relate to the five cited above), the procurement justification form used by the Clinic to document the procurement transaction’s compliance with policies, procedures and the Uniform Guidance was outdated. Furthermore, the monthly review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures was not operating effectively. Compliance For one (9%) of 11 procurement transactions tested for compliance, the procurement was an add-on purchase related to a larger procurement of the same product under a prior purchase order. The prior procurement was above the simplified acquisition threshold and the Clinic’s competitive bid threshold. The Clinic did not complete a procurement justification form for the add-on purchase (which was a small purchase), and the original procurement did not have adequate support to evidence that it had been competitively bid. As such, adequate documentation did not exist for the procurement in accordance with Uniform Guidance Section 230.320(a)(2)(i) and(b). In addition, for five procurement transactions, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Cause: While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures and Uniform Guidance CFR 200.320, the review of the procurement justification form is not robust enough to identify errors and there is not a process in place to ensure the form is completed prior to the purchase. Effect or potential effect: The Clinic’s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to small purchases and noncompetitive procurements. Questioned costs: $53,482, determined as the amount of the procurement expenditures included in the schedule of expenditures of federal awards for the year ended December 31, 2023, for the one procurement transaction that had inadequate support for compliance with CFR 200.320 at the time of procurement, as follows: • Assistance Listing No. 93.310, OD023121 – $53,482 Context: Internal Control We sampled nine federal procurements over $25,000 to test operating effectiveness of internal controls, totaling $962,393, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For seven of the 11 federal procurements tested totaling $770,093, procurement controls were not operating effectively. • For five of 11 procurement transactions tested totaling $529,273, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately two to eight months later. Compliance We sampled 11 federal procurements over $25,000 to test compliance, totaling $1,736,844, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For one of 11 federal procurements tested totaling $53,482, documentation retained was not adequate to support that the procurement transaction was executed in accordance with the Uniform Guidance Sections 200.320(a)(2)(i) and (b). • For five of 11 procurement transactions tested totaling $529,273, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Procurement-related expenditures are approximately 9% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is not a repeat of the finding of the prior year. Recommendation: The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures, and internal controls to comply with the Uniform Guidance procurement standards and that the procurement justification form is reviewed prior to entering into the purchase transaction. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with the Clinic documented policies, procedures, and internal controls. Views of responsible officials: Management will reinforce education and training to the research community and procurement teams regarding the procurement requirements, Justification of Source Selection Checklist/Form, and timely completion of the required documentation. The Clinic utilizes a third party, Visual Compliance, to execute daily supplier sanction and debarment checks for all Mayo Clinic vendors. All third party suspension and debarment match alerts are reviewed and adjudicated as needed. Going forward, the Clinic will supplement this daily review by periodically validating a sample of vendors who are not flagged with an alert by Visual Compliance.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

N2 Disbursements to or on Behalf of Students Identification of the federal program: Federal Agency: United States Department of Education Federal Cluster: Student Financial Assistance Assistance Listing No.: 84.268, Federal Direct Student Loans (Direct Loans) Award Periods: July 1, 2022 through June 30, 2023; July 1, 2023 through June 30, 2024 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: When Direct Loans are being credited to a student’s account, an institution must notify the student, or parent, in writing of (1) the date and amount of the disbursement; (2) the student’s right, or parent’s right, to cancel all or a portion of that loan or loan disbursement and have the loan proceeds returned to the holder of that loan; and (3) the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan. In order to identify these students, Mayo Clinic (“the Clinic”) utilizes a disbursement report that is run from a script housed in SAP Business Objects. Information technology general controls (ITGCs) over the SAP Business Objects disbursement report was not tested by the Clinic during 2023 to ensure the accuracy and completeness of the disbursement report. Cause: Information technology general controls were not tested for SAP Business Objects in 2023. Effect or potential effect: The disbursement report may be inaccurate or incomplete and as a result a student may not be timely notified of the date and amount of the disbursement; the student/parent’s right to cancel; and the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel. Questioned costs: None. Context: Total expenditures for the Student Financial Assistance Cluster were $18,084,644 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: The Clinic should implement internal controls to ensure SAP Business Objects ITGCs are tested or implement compensating controls to ensure the disbursement report is accurate and complete. Views of responsible officials: The Clinic has internal controls over access and change management procedures in place over Business Objects. Management will ensure these controls are tested annually.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Subrecipient Monitoring Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.RDC, 12.300, 93.393, 93.396, 93.847, 93.853, 93.859 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.332(d) of the Uniform Guidance states: “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that the subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity.” Furthermore, it is the Clinic’s policy for principal investigators to complete a subaward monitoring checklist as part of the monthly/quarterly reviews of subrecipient performance. Condition: Subaward monitoring checklists were not consistently completed or retained to evidence the results of the monitoring performed over subrecipients by principal investigators during the fiscal year. Cause: Established internal controls over the completion of the subaward monitoring checklist as part of the monthly/quarterly reviews were not followed during the fiscal year. Effect or potential effect: Subrecipients may not be monitored timely. Subaward may not be used for authorized purposes, or performance goals may not be achieved by the subrecipient. Questioned costs: None. Context: We sampled 40 subaward monitoring checklists required to be completed during fiscal year 2023 by various principal investigators and noted the following related to the subaward monitoring checklist: • Not included with the monthly/quarterly review materials (2 instances), • Not completed due to retirement of the principal investigator (1 instance), • Not completed timely during fiscal year 2023 (10 instances) o Subaward monitoring checklists are included in regular financial reviews which were delayed due to implementation of a new general ledger system effective April 1, 2023. Various Q3 and Q4 2023 subaward monitoring checklists were not completed until Q1 2024. Subrecipient expenditures are $54,435,304, representing 12.2% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: The Clinic should ensure that the subrecipient monitoring checklist is completed timely and documentation is retained to support the operating effectiveness of established internal controls. Views of responsible officials: Subaward monitoring checklists are included in monthly/quarterly reviews, which were delayed during the last half of 2023 due to the implementation of a new general ledger system effective April 1, 2023. Monthly/quarterly reviews resumed in January 2024. Communication has occurred to reiterate control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Procurement, Suspension and Debarment Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Pass-Through Entity: The University of Texas Health (93.853, NS119834) Assistance Listing Nos.: 12.420, 93.310, 93.353, 93.393, and 93.853 Award Numbers: W81XWH-15-1-0292 (12.420), OD23121 (93.310), CA246568 (93.353), CA259201 (93.393), NS119834 (93.853), NS122096 (93.853) Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.320(a)(2)(i) of the Uniform Guidance states the following regarding small purchases: “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed: “When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with § 200.319 or paragraph (c) of this section.” Section 200.214 of the Uniform Guidance states “Non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.” The Clinic procurement justification form for procurements more than $25,000 requires completion of the rationale for the procurement and a search of the federal government’s exclusion list to be performed and documented at the time of the procurement. On a monthly basis, Supply Chain Management performs a review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures. Condition: Internal Control For five (56%) of nine procurement transactions tested for operating effectiveness of internal controls, the procurement justification form used by the Clinic to document the history of the procurement and compliance with Uniform Guidance CFR 200.303, was not completed until after the purchase order was created and/or invoice received from the vendor. In addition, for these same five procurement transactions, the Clinic did not timely document its suspension and debarment check at the time of procurement as required by its procurement justification form. In addition, for four (44%) of nine procurement transactions tested for operating effectiveness of internal controls (two of which relate to the five cited above), the procurement justification form used by the Clinic to document the procurement transaction’s compliance with policies, procedures and the Uniform Guidance was outdated. Furthermore, the monthly review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures was not operating effectively. Compliance For one (9%) of 11 procurement transactions tested for compliance, the procurement was an add-on purchase related to a larger procurement of the same product under a prior purchase order. The prior procurement was above the simplified acquisition threshold and the Clinic’s competitive bid threshold. The Clinic did not complete a procurement justification form for the add-on purchase (which was a small purchase), and the original procurement did not have adequate support to evidence that it had been competitively bid. As such, adequate documentation did not exist for the procurement in accordance with Uniform Guidance Section 230.320(a)(2)(i) and(b). In addition, for five procurement transactions, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Cause: While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures and Uniform Guidance CFR 200.320, the review of the procurement justification form is not robust enough to identify errors and there is not a process in place to ensure the form is completed prior to the purchase. Effect or potential effect: The Clinic’s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to small purchases and noncompetitive procurements. Questioned costs: $53,482, determined as the amount of the procurement expenditures included in the schedule of expenditures of federal awards for the year ended December 31, 2023, for the one procurement transaction that had inadequate support for compliance with CFR 200.320 at the time of procurement, as follows: • Assistance Listing No. 93.310, OD023121 – $53,482 Context: Internal Control We sampled nine federal procurements over $25,000 to test operating effectiveness of internal controls, totaling $962,393, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For seven of the 11 federal procurements tested totaling $770,093, procurement controls were not operating effectively. • For five of 11 procurement transactions tested totaling $529,273, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately two to eight months later. Compliance We sampled 11 federal procurements over $25,000 to test compliance, totaling $1,736,844, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For one of 11 federal procurements tested totaling $53,482, documentation retained was not adequate to support that the procurement transaction was executed in accordance with the Uniform Guidance Sections 200.320(a)(2)(i) and (b). • For five of 11 procurement transactions tested totaling $529,273, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Procurement-related expenditures are approximately 9% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is not a repeat of the finding of the prior year. Recommendation: The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures, and internal controls to comply with the Uniform Guidance procurement standards and that the procurement justification form is reviewed prior to entering into the purchase transaction. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with the Clinic documented policies, procedures, and internal controls. Views of responsible officials: Management will reinforce education and training to the research community and procurement teams regarding the procurement requirements, Justification of Source Selection Checklist/Form, and timely completion of the required documentation. The Clinic utilizes a third party, Visual Compliance, to execute daily supplier sanction and debarment checks for all Mayo Clinic vendors. All third party suspension and debarment match alerts are reviewed and adjudicated as needed. Going forward, the Clinic will supplement this daily review by periodically validating a sample of vendors who are not flagged with an alert by Visual Compliance.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Subrecipient Monitoring Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.RDC, 12.300, 93.393, 93.396, 93.847, 93.853, 93.859 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.332(d) of the Uniform Guidance states: “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that the subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity.” Furthermore, it is the Clinic’s policy for principal investigators to complete a subaward monitoring checklist as part of the monthly/quarterly reviews of subrecipient performance. Condition: Subaward monitoring checklists were not consistently completed or retained to evidence the results of the monitoring performed over subrecipients by principal investigators during the fiscal year. Cause: Established internal controls over the completion of the subaward monitoring checklist as part of the monthly/quarterly reviews were not followed during the fiscal year. Effect or potential effect: Subrecipients may not be monitored timely. Subaward may not be used for authorized purposes, or performance goals may not be achieved by the subrecipient. Questioned costs: None. Context: We sampled 40 subaward monitoring checklists required to be completed during fiscal year 2023 by various principal investigators and noted the following related to the subaward monitoring checklist: • Not included with the monthly/quarterly review materials (2 instances), • Not completed due to retirement of the principal investigator (1 instance), • Not completed timely during fiscal year 2023 (10 instances) o Subaward monitoring checklists are included in regular financial reviews which were delayed due to implementation of a new general ledger system effective April 1, 2023. Various Q3 and Q4 2023 subaward monitoring checklists were not completed until Q1 2024. Subrecipient expenditures are $54,435,304, representing 12.2% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: The Clinic should ensure that the subrecipient monitoring checklist is completed timely and documentation is retained to support the operating effectiveness of established internal controls. Views of responsible officials: Subaward monitoring checklists are included in monthly/quarterly reviews, which were delayed during the last half of 2023 due to the implementation of a new general ledger system effective April 1, 2023. Monthly/quarterly reviews resumed in January 2024. Communication has occurred to reiterate control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Procurement, Suspension and Debarment Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Pass-Through Entity: The University of Texas Health (93.853, NS119834) Assistance Listing Nos.: 12.420, 93.310, 93.353, 93.393, and 93.853 Award Numbers: W81XWH-15-1-0292 (12.420), OD23121 (93.310), CA246568 (93.353), CA259201 (93.393), NS119834 (93.853), NS122096 (93.853) Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.320(a)(2)(i) of the Uniform Guidance states the following regarding small purchases: “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed: “When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with § 200.319 or paragraph (c) of this section.” Section 200.214 of the Uniform Guidance states “Non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.” The Clinic procurement justification form for procurements more than $25,000 requires completion of the rationale for the procurement and a search of the federal government’s exclusion list to be performed and documented at the time of the procurement. On a monthly basis, Supply Chain Management performs a review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures. Condition: Internal Control For five (56%) of nine procurement transactions tested for operating effectiveness of internal controls, the procurement justification form used by the Clinic to document the history of the procurement and compliance with Uniform Guidance CFR 200.303, was not completed until after the purchase order was created and/or invoice received from the vendor. In addition, for these same five procurement transactions, the Clinic did not timely document its suspension and debarment check at the time of procurement as required by its procurement justification form. In addition, for four (44%) of nine procurement transactions tested for operating effectiveness of internal controls (two of which relate to the five cited above), the procurement justification form used by the Clinic to document the procurement transaction’s compliance with policies, procedures and the Uniform Guidance was outdated. Furthermore, the monthly review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures was not operating effectively. Compliance For one (9%) of 11 procurement transactions tested for compliance, the procurement was an add-on purchase related to a larger procurement of the same product under a prior purchase order. The prior procurement was above the simplified acquisition threshold and the Clinic’s competitive bid threshold. The Clinic did not complete a procurement justification form for the add-on purchase (which was a small purchase), and the original procurement did not have adequate support to evidence that it had been competitively bid. As such, adequate documentation did not exist for the procurement in accordance with Uniform Guidance Section 230.320(a)(2)(i) and(b). In addition, for five procurement transactions, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Cause: While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures and Uniform Guidance CFR 200.320, the review of the procurement justification form is not robust enough to identify errors and there is not a process in place to ensure the form is completed prior to the purchase. Effect or potential effect: The Clinic’s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to small purchases and noncompetitive procurements. Questioned costs: $53,482, determined as the amount of the procurement expenditures included in the schedule of expenditures of federal awards for the year ended December 31, 2023, for the one procurement transaction that had inadequate support for compliance with CFR 200.320 at the time of procurement, as follows: • Assistance Listing No. 93.310, OD023121 – $53,482 Context: Internal Control We sampled nine federal procurements over $25,000 to test operating effectiveness of internal controls, totaling $962,393, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For seven of the 11 federal procurements tested totaling $770,093, procurement controls were not operating effectively. • For five of 11 procurement transactions tested totaling $529,273, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately two to eight months later. Compliance We sampled 11 federal procurements over $25,000 to test compliance, totaling $1,736,844, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For one of 11 federal procurements tested totaling $53,482, documentation retained was not adequate to support that the procurement transaction was executed in accordance with the Uniform Guidance Sections 200.320(a)(2)(i) and (b). • For five of 11 procurement transactions tested totaling $529,273, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Procurement-related expenditures are approximately 9% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is not a repeat of the finding of the prior year. Recommendation: The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures, and internal controls to comply with the Uniform Guidance procurement standards and that the procurement justification form is reviewed prior to entering into the purchase transaction. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with the Clinic documented policies, procedures, and internal controls. Views of responsible officials: Management will reinforce education and training to the research community and procurement teams regarding the procurement requirements, Justification of Source Selection Checklist/Form, and timely completion of the required documentation. The Clinic utilizes a third party, Visual Compliance, to execute daily supplier sanction and debarment checks for all Mayo Clinic vendors. All third party suspension and debarment match alerts are reviewed and adjudicated as needed. Going forward, the Clinic will supplement this daily review by periodically validating a sample of vendors who are not flagged with an alert by Visual Compliance.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Procurement, Suspension and Debarment Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Pass-Through Entity: The University of Texas Health (93.853, NS119834) Assistance Listing Nos.: 12.420, 93.310, 93.353, 93.393, and 93.853 Award Numbers: W81XWH-15-1-0292 (12.420), OD23121 (93.310), CA246568 (93.353), CA259201 (93.393), NS119834 (93.853), NS122096 (93.853) Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.320(a)(2)(i) of the Uniform Guidance states the following regarding small purchases: “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed: “When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with § 200.319 or paragraph (c) of this section.” Section 200.214 of the Uniform Guidance states “Non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.” The Clinic procurement justification form for procurements more than $25,000 requires completion of the rationale for the procurement and a search of the federal government’s exclusion list to be performed and documented at the time of the procurement. On a monthly basis, Supply Chain Management performs a review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures. Condition: Internal Control For five (56%) of nine procurement transactions tested for operating effectiveness of internal controls, the procurement justification form used by the Clinic to document the history of the procurement and compliance with Uniform Guidance CFR 200.303, was not completed until after the purchase order was created and/or invoice received from the vendor. In addition, for these same five procurement transactions, the Clinic did not timely document its suspension and debarment check at the time of procurement as required by its procurement justification form. In addition, for four (44%) of nine procurement transactions tested for operating effectiveness of internal controls (two of which relate to the five cited above), the procurement justification form used by the Clinic to document the procurement transaction’s compliance with policies, procedures and the Uniform Guidance was outdated. Furthermore, the monthly review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures was not operating effectively. Compliance For one (9%) of 11 procurement transactions tested for compliance, the procurement was an add-on purchase related to a larger procurement of the same product under a prior purchase order. The prior procurement was above the simplified acquisition threshold and the Clinic’s competitive bid threshold. The Clinic did not complete a procurement justification form for the add-on purchase (which was a small purchase), and the original procurement did not have adequate support to evidence that it had been competitively bid. As such, adequate documentation did not exist for the procurement in accordance with Uniform Guidance Section 230.320(a)(2)(i) and(b). In addition, for five procurement transactions, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Cause: While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures and Uniform Guidance CFR 200.320, the review of the procurement justification form is not robust enough to identify errors and there is not a process in place to ensure the form is completed prior to the purchase. Effect or potential effect: The Clinic’s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to small purchases and noncompetitive procurements. Questioned costs: $53,482, determined as the amount of the procurement expenditures included in the schedule of expenditures of federal awards for the year ended December 31, 2023, for the one procurement transaction that had inadequate support for compliance with CFR 200.320 at the time of procurement, as follows: • Assistance Listing No. 93.310, OD023121 – $53,482 Context: Internal Control We sampled nine federal procurements over $25,000 to test operating effectiveness of internal controls, totaling $962,393, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For seven of the 11 federal procurements tested totaling $770,093, procurement controls were not operating effectively. • For five of 11 procurement transactions tested totaling $529,273, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately two to eight months later. Compliance We sampled 11 federal procurements over $25,000 to test compliance, totaling $1,736,844, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For one of 11 federal procurements tested totaling $53,482, documentation retained was not adequate to support that the procurement transaction was executed in accordance with the Uniform Guidance Sections 200.320(a)(2)(i) and (b). • For five of 11 procurement transactions tested totaling $529,273, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Procurement-related expenditures are approximately 9% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is not a repeat of the finding of the prior year. Recommendation: The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures, and internal controls to comply with the Uniform Guidance procurement standards and that the procurement justification form is reviewed prior to entering into the purchase transaction. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with the Clinic documented policies, procedures, and internal controls. Views of responsible officials: Management will reinforce education and training to the research community and procurement teams regarding the procurement requirements, Justification of Source Selection Checklist/Form, and timely completion of the required documentation. The Clinic utilizes a third party, Visual Compliance, to execute daily supplier sanction and debarment checks for all Mayo Clinic vendors. All third party suspension and debarment match alerts are reviewed and adjudicated as needed. Going forward, the Clinic will supplement this daily review by periodically validating a sample of vendors who are not flagged with an alert by Visual Compliance.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Subrecipient Monitoring Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.RDC, 12.300, 93.393, 93.396, 93.847, 93.853, 93.859 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.332(d) of the Uniform Guidance states: “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that the subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity.” Furthermore, it is the Clinic’s policy for principal investigators to complete a subaward monitoring checklist as part of the monthly/quarterly reviews of subrecipient performance. Condition: Subaward monitoring checklists were not consistently completed or retained to evidence the results of the monitoring performed over subrecipients by principal investigators during the fiscal year. Cause: Established internal controls over the completion of the subaward monitoring checklist as part of the monthly/quarterly reviews were not followed during the fiscal year. Effect or potential effect: Subrecipients may not be monitored timely. Subaward may not be used for authorized purposes, or performance goals may not be achieved by the subrecipient. Questioned costs: None. Context: We sampled 40 subaward monitoring checklists required to be completed during fiscal year 2023 by various principal investigators and noted the following related to the subaward monitoring checklist: • Not included with the monthly/quarterly review materials (2 instances), • Not completed due to retirement of the principal investigator (1 instance), • Not completed timely during fiscal year 2023 (10 instances) o Subaward monitoring checklists are included in regular financial reviews which were delayed due to implementation of a new general ledger system effective April 1, 2023. Various Q3 and Q4 2023 subaward monitoring checklists were not completed until Q1 2024. Subrecipient expenditures are $54,435,304, representing 12.2% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: The Clinic should ensure that the subrecipient monitoring checklist is completed timely and documentation is retained to support the operating effectiveness of established internal controls. Views of responsible officials: Subaward monitoring checklists are included in monthly/quarterly reviews, which were delayed during the last half of 2023 due to the implementation of a new general ledger system effective April 1, 2023. Monthly/quarterly reviews resumed in January 2024. Communication has occurred to reiterate control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Procurement, Suspension and Debarment Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Pass-Through Entity: The University of Texas Health (93.853, NS119834) Assistance Listing Nos.: 12.420, 93.310, 93.353, 93.393, and 93.853 Award Numbers: W81XWH-15-1-0292 (12.420), OD23121 (93.310), CA246568 (93.353), CA259201 (93.393), NS119834 (93.853), NS122096 (93.853) Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.320(a)(2)(i) of the Uniform Guidance states the following regarding small purchases: “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed: “When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with § 200.319 or paragraph (c) of this section.” Section 200.214 of the Uniform Guidance states “Non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.” The Clinic procurement justification form for procurements more than $25,000 requires completion of the rationale for the procurement and a search of the federal government’s exclusion list to be performed and documented at the time of the procurement. On a monthly basis, Supply Chain Management performs a review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures. Condition: Internal Control For five (56%) of nine procurement transactions tested for operating effectiveness of internal controls, the procurement justification form used by the Clinic to document the history of the procurement and compliance with Uniform Guidance CFR 200.303, was not completed until after the purchase order was created and/or invoice received from the vendor. In addition, for these same five procurement transactions, the Clinic did not timely document its suspension and debarment check at the time of procurement as required by its procurement justification form. In addition, for four (44%) of nine procurement transactions tested for operating effectiveness of internal controls (two of which relate to the five cited above), the procurement justification form used by the Clinic to document the procurement transaction’s compliance with policies, procedures and the Uniform Guidance was outdated. Furthermore, the monthly review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures was not operating effectively. Compliance For one (9%) of 11 procurement transactions tested for compliance, the procurement was an add-on purchase related to a larger procurement of the same product under a prior purchase order. The prior procurement was above the simplified acquisition threshold and the Clinic’s competitive bid threshold. The Clinic did not complete a procurement justification form for the add-on purchase (which was a small purchase), and the original procurement did not have adequate support to evidence that it had been competitively bid. As such, adequate documentation did not exist for the procurement in accordance with Uniform Guidance Section 230.320(a)(2)(i) and(b). In addition, for five procurement transactions, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Cause: While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures and Uniform Guidance CFR 200.320, the review of the procurement justification form is not robust enough to identify errors and there is not a process in place to ensure the form is completed prior to the purchase. Effect or potential effect: The Clinic’s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to small purchases and noncompetitive procurements. Questioned costs: $53,482, determined as the amount of the procurement expenditures included in the schedule of expenditures of federal awards for the year ended December 31, 2023, for the one procurement transaction that had inadequate support for compliance with CFR 200.320 at the time of procurement, as follows: • Assistance Listing No. 93.310, OD023121 – $53,482 Context: Internal Control We sampled nine federal procurements over $25,000 to test operating effectiveness of internal controls, totaling $962,393, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For seven of the 11 federal procurements tested totaling $770,093, procurement controls were not operating effectively. • For five of 11 procurement transactions tested totaling $529,273, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately two to eight months later. Compliance We sampled 11 federal procurements over $25,000 to test compliance, totaling $1,736,844, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For one of 11 federal procurements tested totaling $53,482, documentation retained was not adequate to support that the procurement transaction was executed in accordance with the Uniform Guidance Sections 200.320(a)(2)(i) and (b). • For five of 11 procurement transactions tested totaling $529,273, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Procurement-related expenditures are approximately 9% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is not a repeat of the finding of the prior year. Recommendation: The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures, and internal controls to comply with the Uniform Guidance procurement standards and that the procurement justification form is reviewed prior to entering into the purchase transaction. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with the Clinic documented policies, procedures, and internal controls. Views of responsible officials: Management will reinforce education and training to the research community and procurement teams regarding the procurement requirements, Justification of Source Selection Checklist/Form, and timely completion of the required documentation. The Clinic utilizes a third party, Visual Compliance, to execute daily supplier sanction and debarment checks for all Mayo Clinic vendors. All third party suspension and debarment match alerts are reviewed and adjudicated as needed. Going forward, the Clinic will supplement this daily review by periodically validating a sample of vendors who are not flagged with an alert by Visual Compliance.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Subrecipient Monitoring Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.RDC, 12.300, 93.393, 93.396, 93.847, 93.853, 93.859 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.332(d) of the Uniform Guidance states: “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that the subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity.” Furthermore, it is the Clinic’s policy for principal investigators to complete a subaward monitoring checklist as part of the monthly/quarterly reviews of subrecipient performance. Condition: Subaward monitoring checklists were not consistently completed or retained to evidence the results of the monitoring performed over subrecipients by principal investigators during the fiscal year. Cause: Established internal controls over the completion of the subaward monitoring checklist as part of the monthly/quarterly reviews were not followed during the fiscal year. Effect or potential effect: Subrecipients may not be monitored timely. Subaward may not be used for authorized purposes, or performance goals may not be achieved by the subrecipient. Questioned costs: None. Context: We sampled 40 subaward monitoring checklists required to be completed during fiscal year 2023 by various principal investigators and noted the following related to the subaward monitoring checklist: • Not included with the monthly/quarterly review materials (2 instances), • Not completed due to retirement of the principal investigator (1 instance), • Not completed timely during fiscal year 2023 (10 instances) o Subaward monitoring checklists are included in regular financial reviews which were delayed due to implementation of a new general ledger system effective April 1, 2023. Various Q3 and Q4 2023 subaward monitoring checklists were not completed until Q1 2024. Subrecipient expenditures are $54,435,304, representing 12.2% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: The Clinic should ensure that the subrecipient monitoring checklist is completed timely and documentation is retained to support the operating effectiveness of established internal controls. Views of responsible officials: Subaward monitoring checklists are included in monthly/quarterly reviews, which were delayed during the last half of 2023 due to the implementation of a new general ledger system effective April 1, 2023. Monthly/quarterly reviews resumed in January 2024. Communication has occurred to reiterate control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Subrecipient Monitoring Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.RDC, 12.300, 93.393, 93.396, 93.847, 93.853, 93.859 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.332(d) of the Uniform Guidance states: “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that the subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity.” Furthermore, it is the Clinic’s policy for principal investigators to complete a subaward monitoring checklist as part of the monthly/quarterly reviews of subrecipient performance. Condition: Subaward monitoring checklists were not consistently completed or retained to evidence the results of the monitoring performed over subrecipients by principal investigators during the fiscal year. Cause: Established internal controls over the completion of the subaward monitoring checklist as part of the monthly/quarterly reviews were not followed during the fiscal year. Effect or potential effect: Subrecipients may not be monitored timely. Subaward may not be used for authorized purposes, or performance goals may not be achieved by the subrecipient. Questioned costs: None. Context: We sampled 40 subaward monitoring checklists required to be completed during fiscal year 2023 by various principal investigators and noted the following related to the subaward monitoring checklist: • Not included with the monthly/quarterly review materials (2 instances), • Not completed due to retirement of the principal investigator (1 instance), • Not completed timely during fiscal year 2023 (10 instances) o Subaward monitoring checklists are included in regular financial reviews which were delayed due to implementation of a new general ledger system effective April 1, 2023. Various Q3 and Q4 2023 subaward monitoring checklists were not completed until Q1 2024. Subrecipient expenditures are $54,435,304, representing 12.2% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: The Clinic should ensure that the subrecipient monitoring checklist is completed timely and documentation is retained to support the operating effectiveness of established internal controls. Views of responsible officials: Subaward monitoring checklists are included in monthly/quarterly reviews, which were delayed during the last half of 2023 due to the implementation of a new general ledger system effective April 1, 2023. Monthly/quarterly reviews resumed in January 2024. Communication has occurred to reiterate control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Subrecipient Monitoring Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.RDC, 12.300, 93.393, 93.396, 93.847, 93.853, 93.859 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.332(d) of the Uniform Guidance states: “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that the subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity.” Furthermore, it is the Clinic’s policy for principal investigators to complete a subaward monitoring checklist as part of the monthly/quarterly reviews of subrecipient performance. Condition: Subaward monitoring checklists were not consistently completed or retained to evidence the results of the monitoring performed over subrecipients by principal investigators during the fiscal year. Cause: Established internal controls over the completion of the subaward monitoring checklist as part of the monthly/quarterly reviews were not followed during the fiscal year. Effect or potential effect: Subrecipients may not be monitored timely. Subaward may not be used for authorized purposes, or performance goals may not be achieved by the subrecipient. Questioned costs: None. Context: We sampled 40 subaward monitoring checklists required to be completed during fiscal year 2023 by various principal investigators and noted the following related to the subaward monitoring checklist: • Not included with the monthly/quarterly review materials (2 instances), • Not completed due to retirement of the principal investigator (1 instance), • Not completed timely during fiscal year 2023 (10 instances) o Subaward monitoring checklists are included in regular financial reviews which were delayed due to implementation of a new general ledger system effective April 1, 2023. Various Q3 and Q4 2023 subaward monitoring checklists were not completed until Q1 2024. Subrecipient expenditures are $54,435,304, representing 12.2% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: The Clinic should ensure that the subrecipient monitoring checklist is completed timely and documentation is retained to support the operating effectiveness of established internal controls. Views of responsible officials: Subaward monitoring checklists are included in monthly/quarterly reviews, which were delayed during the last half of 2023 due to the implementation of a new general ledger system effective April 1, 2023. Monthly/quarterly reviews resumed in January 2024. Communication has occurred to reiterate control process expectations.

Procurement, Suspension and Debarment Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Pass-Through Entity: The University of Texas Health (93.853, NS119834) Assistance Listing Nos.: 12.420, 93.310, 93.353, 93.393, and 93.853 Award Numbers: W81XWH-15-1-0292 (12.420), OD23121 (93.310), CA246568 (93.353), CA259201 (93.393), NS119834 (93.853), NS122096 (93.853) Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.320(a)(2)(i) of the Uniform Guidance states the following regarding small purchases: “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed: “When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with § 200.319 or paragraph (c) of this section.” Section 200.214 of the Uniform Guidance states “Non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.” The Clinic procurement justification form for procurements more than $25,000 requires completion of the rationale for the procurement and a search of the federal government’s exclusion list to be performed and documented at the time of the procurement. On a monthly basis, Supply Chain Management performs a review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures. Condition: Internal Control For five (56%) of nine procurement transactions tested for operating effectiveness of internal controls, the procurement justification form used by the Clinic to document the history of the procurement and compliance with Uniform Guidance CFR 200.303, was not completed until after the purchase order was created and/or invoice received from the vendor. In addition, for these same five procurement transactions, the Clinic did not timely document its suspension and debarment check at the time of procurement as required by its procurement justification form. In addition, for four (44%) of nine procurement transactions tested for operating effectiveness of internal controls (two of which relate to the five cited above), the procurement justification form used by the Clinic to document the procurement transaction’s compliance with policies, procedures and the Uniform Guidance was outdated. Furthermore, the monthly review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures was not operating effectively. Compliance For one (9%) of 11 procurement transactions tested for compliance, the procurement was an add-on purchase related to a larger procurement of the same product under a prior purchase order. The prior procurement was above the simplified acquisition threshold and the Clinic’s competitive bid threshold. The Clinic did not complete a procurement justification form for the add-on purchase (which was a small purchase), and the original procurement did not have adequate support to evidence that it had been competitively bid. As such, adequate documentation did not exist for the procurement in accordance with Uniform Guidance Section 230.320(a)(2)(i) and(b). In addition, for five procurement transactions, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Cause: While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures and Uniform Guidance CFR 200.320, the review of the procurement justification form is not robust enough to identify errors and there is not a process in place to ensure the form is completed prior to the purchase. Effect or potential effect: The Clinic’s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to small purchases and noncompetitive procurements. Questioned costs: $53,482, determined as the amount of the procurement expenditures included in the schedule of expenditures of federal awards for the year ended December 31, 2023, for the one procurement transaction that had inadequate support for compliance with CFR 200.320 at the time of procurement, as follows: • Assistance Listing No. 93.310, OD023121 – $53,482 Context: Internal Control We sampled nine federal procurements over $25,000 to test operating effectiveness of internal controls, totaling $962,393, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For seven of the 11 federal procurements tested totaling $770,093, procurement controls were not operating effectively. • For five of 11 procurement transactions tested totaling $529,273, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately two to eight months later. Compliance We sampled 11 federal procurements over $25,000 to test compliance, totaling $1,736,844, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For one of 11 federal procurements tested totaling $53,482, documentation retained was not adequate to support that the procurement transaction was executed in accordance with the Uniform Guidance Sections 200.320(a)(2)(i) and (b). • For five of 11 procurement transactions tested totaling $529,273, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Procurement-related expenditures are approximately 9% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is not a repeat of the finding of the prior year. Recommendation: The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures, and internal controls to comply with the Uniform Guidance procurement standards and that the procurement justification form is reviewed prior to entering into the purchase transaction. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with the Clinic documented policies, procedures, and internal controls. Views of responsible officials: Management will reinforce education and training to the research community and procurement teams regarding the procurement requirements, Justification of Source Selection Checklist/Form, and timely completion of the required documentation. The Clinic utilizes a third party, Visual Compliance, to execute daily supplier sanction and debarment checks for all Mayo Clinic vendors. All third party suspension and debarment match alerts are reviewed and adjudicated as needed. Going forward, the Clinic will supplement this daily review by periodically validating a sample of vendors who are not flagged with an alert by Visual Compliance.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Subrecipient Monitoring Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.RDC, 12.300, 93.393, 93.396, 93.847, 93.853, 93.859 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.332(d) of the Uniform Guidance states: “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that the subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity.” Furthermore, it is the Clinic’s policy for principal investigators to complete a subaward monitoring checklist as part of the monthly/quarterly reviews of subrecipient performance. Condition: Subaward monitoring checklists were not consistently completed or retained to evidence the results of the monitoring performed over subrecipients by principal investigators during the fiscal year. Cause: Established internal controls over the completion of the subaward monitoring checklist as part of the monthly/quarterly reviews were not followed during the fiscal year. Effect or potential effect: Subrecipients may not be monitored timely. Subaward may not be used for authorized purposes, or performance goals may not be achieved by the subrecipient. Questioned costs: None. Context: We sampled 40 subaward monitoring checklists required to be completed during fiscal year 2023 by various principal investigators and noted the following related to the subaward monitoring checklist: • Not included with the monthly/quarterly review materials (2 instances), • Not completed due to retirement of the principal investigator (1 instance), • Not completed timely during fiscal year 2023 (10 instances) o Subaward monitoring checklists are included in regular financial reviews which were delayed due to implementation of a new general ledger system effective April 1, 2023. Various Q3 and Q4 2023 subaward monitoring checklists were not completed until Q1 2024. Subrecipient expenditures are $54,435,304, representing 12.2% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: The Clinic should ensure that the subrecipient monitoring checklist is completed timely and documentation is retained to support the operating effectiveness of established internal controls. Views of responsible officials: Subaward monitoring checklists are included in monthly/quarterly reviews, which were delayed during the last half of 2023 due to the implementation of a new general ledger system effective April 1, 2023. Monthly/quarterly reviews resumed in January 2024. Communication has occurred to reiterate control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Subrecipient Monitoring Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.RDC, 12.300, 93.393, 93.396, 93.847, 93.853, 93.859 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.332(d) of the Uniform Guidance states: “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that the subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity.” Furthermore, it is the Clinic’s policy for principal investigators to complete a subaward monitoring checklist as part of the monthly/quarterly reviews of subrecipient performance. Condition: Subaward monitoring checklists were not consistently completed or retained to evidence the results of the monitoring performed over subrecipients by principal investigators during the fiscal year. Cause: Established internal controls over the completion of the subaward monitoring checklist as part of the monthly/quarterly reviews were not followed during the fiscal year. Effect or potential effect: Subrecipients may not be monitored timely. Subaward may not be used for authorized purposes, or performance goals may not be achieved by the subrecipient. Questioned costs: None. Context: We sampled 40 subaward monitoring checklists required to be completed during fiscal year 2023 by various principal investigators and noted the following related to the subaward monitoring checklist: • Not included with the monthly/quarterly review materials (2 instances), • Not completed due to retirement of the principal investigator (1 instance), • Not completed timely during fiscal year 2023 (10 instances) o Subaward monitoring checklists are included in regular financial reviews which were delayed due to implementation of a new general ledger system effective April 1, 2023. Various Q3 and Q4 2023 subaward monitoring checklists were not completed until Q1 2024. Subrecipient expenditures are $54,435,304, representing 12.2% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: The Clinic should ensure that the subrecipient monitoring checklist is completed timely and documentation is retained to support the operating effectiveness of established internal controls. Views of responsible officials: Subaward monitoring checklists are included in monthly/quarterly reviews, which were delayed during the last half of 2023 due to the implementation of a new general ledger system effective April 1, 2023. Monthly/quarterly reviews resumed in January 2024. Communication has occurred to reiterate control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Procurement, Suspension and Debarment Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Pass-Through Entity: The University of Texas Health (93.853, NS119834) Assistance Listing Nos.: 12.420, 93.310, 93.353, 93.393, and 93.853 Award Numbers: W81XWH-15-1-0292 (12.420), OD23121 (93.310), CA246568 (93.353), CA259201 (93.393), NS119834 (93.853), NS122096 (93.853) Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.320(a)(2)(i) of the Uniform Guidance states the following regarding small purchases: “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed: “When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with § 200.319 or paragraph (c) of this section.” Section 200.214 of the Uniform Guidance states “Non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.” The Clinic procurement justification form for procurements more than $25,000 requires completion of the rationale for the procurement and a search of the federal government’s exclusion list to be performed and documented at the time of the procurement. On a monthly basis, Supply Chain Management performs a review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures. Condition: Internal Control For five (56%) of nine procurement transactions tested for operating effectiveness of internal controls, the procurement justification form used by the Clinic to document the history of the procurement and compliance with Uniform Guidance CFR 200.303, was not completed until after the purchase order was created and/or invoice received from the vendor. In addition, for these same five procurement transactions, the Clinic did not timely document its suspension and debarment check at the time of procurement as required by its procurement justification form. In addition, for four (44%) of nine procurement transactions tested for operating effectiveness of internal controls (two of which relate to the five cited above), the procurement justification form used by the Clinic to document the procurement transaction’s compliance with policies, procedures and the Uniform Guidance was outdated. Furthermore, the monthly review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures was not operating effectively. Compliance For one (9%) of 11 procurement transactions tested for compliance, the procurement was an add-on purchase related to a larger procurement of the same product under a prior purchase order. The prior procurement was above the simplified acquisition threshold and the Clinic’s competitive bid threshold. The Clinic did not complete a procurement justification form for the add-on purchase (which was a small purchase), and the original procurement did not have adequate support to evidence that it had been competitively bid. As such, adequate documentation did not exist for the procurement in accordance with Uniform Guidance Section 230.320(a)(2)(i) and(b). In addition, for five procurement transactions, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Cause: While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures and Uniform Guidance CFR 200.320, the review of the procurement justification form is not robust enough to identify errors and there is not a process in place to ensure the form is completed prior to the purchase. Effect or potential effect: The Clinic’s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to small purchases and noncompetitive procurements. Questioned costs: $53,482, determined as the amount of the procurement expenditures included in the schedule of expenditures of federal awards for the year ended December 31, 2023, for the one procurement transaction that had inadequate support for compliance with CFR 200.320 at the time of procurement, as follows: • Assistance Listing No. 93.310, OD023121 – $53,482 Context: Internal Control We sampled nine federal procurements over $25,000 to test operating effectiveness of internal controls, totaling $962,393, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For seven of the 11 federal procurements tested totaling $770,093, procurement controls were not operating effectively. • For five of 11 procurement transactions tested totaling $529,273, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately two to eight months later. Compliance We sampled 11 federal procurements over $25,000 to test compliance, totaling $1,736,844, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For one of 11 federal procurements tested totaling $53,482, documentation retained was not adequate to support that the procurement transaction was executed in accordance with the Uniform Guidance Sections 200.320(a)(2)(i) and (b). • For five of 11 procurement transactions tested totaling $529,273, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Procurement-related expenditures are approximately 9% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is not a repeat of the finding of the prior year. Recommendation: The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures, and internal controls to comply with the Uniform Guidance procurement standards and that the procurement justification form is reviewed prior to entering into the purchase transaction. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with the Clinic documented policies, procedures, and internal controls. Views of responsible officials: Management will reinforce education and training to the research community and procurement teams regarding the procurement requirements, Justification of Source Selection Checklist/Form, and timely completion of the required documentation. The Clinic utilizes a third party, Visual Compliance, to execute daily supplier sanction and debarment checks for all Mayo Clinic vendors. All third party suspension and debarment match alerts are reviewed and adjudicated as needed. Going forward, the Clinic will supplement this daily review by periodically validating a sample of vendors who are not flagged with an alert by Visual Compliance.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, University of Chicago, University of Michigan, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Evidence of review of allowability of internal service charges at a transactional level by the Principal Investigator (PI) or appropriate individual with authority on the grant was not retained during the fiscal year. Cause: While internal service charges transaction detail is reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant’s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability was not retained by the Clinic during fiscal year 2023. Effect or potential effect: Internal service costs could be charged that are not allowable. Questioned costs: None. Context: Internal service charges are $49,405,925, representing 11.1% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is a repeat of Finding 2022-007 in the prior year. Recommendation: Beginning in fiscal year 2024, the PI monthly/quarterly review packet was redesigned to provide evidence of review and conclusions reached over internal service charges transaction detail. Management should ensure that the newly implemented control is operating as designed. Views of responsible officials: Management implemented revisions to the monthly/quarterly review packet in January 2024 to provide evidence of review and conclusions reached over the allowability of internal service charges. Communication has occurred to ensure awareness and understanding of control process expectations.

Activities Allowed or Unallowed and Allowable Costs/Cost Principles Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Pass-Through Entities: Boston University, Georgia Institute of Technology, Massachusetts General Hospital, NYU Grossman School of Medicine, Stanford University, The University of Texas, University of Buffalo, University of Chicago, and Washington University Federal Cluster: Research and Development (R&D) Assistance Listing Nos.: 12.300, 12.420, 93.233, 93.273, 93.279, 93.310, 93.350, 93.393, 93.395, 93.396, 93.397, 93.837, 93.838, 93.846, 93.847, 93.853, 93.855, 93.859, 93.865, and 93.866 Award Numbers: Various Award Periods: Various Identification of the state projects: State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.130, Endowed Chair for Cancer Research Award Number: MOG07 Award Period: July 1, 2014 – until expended State Grantor: State of Florida Department of Health (DOH) Catalog of State Financial Assistance (CSFA) No.: 64.135, Ed and Ethel Moore Alzheimer’s Disease Research Program Award Numbers: 20A10, 22A04, 22A05, 22A06, 22A07, 22A08, 22A09, 22K01, 23A03, 23A04, and 23K09 Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 215.97, Florida Single Audit Act, part (2)(j) states, “Internal control over state projects means a process, effected by a nonstate entity’s management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial operations. 3. Compliance with applicable laws and regulations.” Condition: Internal controls over effort reporting were not operating effectively from April 1, 2023 through May 31, 2023 and, therefore, could not be relied upon. Internal controls over salary cap were not operating effectively from April 1, 2023 through December 31, 2023 and therefore, could not be relied upon. Cause: The Clinic implemented a new general ledger system effective April 1, 2023. The general ledger implementation necessitated a rewrite of the effort certification system which delayed certification for the months of April and May. Therefore, for the period April 1, 2023 through May 31, 2023, effort certifications were not performed monthly. The information technology application used to calculate salary cap adjustments to salary expenses resulting from the effort certification process was not functioning as designed from April 1, 2023 through December 31, 2023. Effect or potential effect: Salary cap adjustments to payroll costs charged to the federal program may not be recorded timely. Unallowable payroll costs may be charged to the federal program or state project. Questioned costs: None. Context: Payroll and fringe benefit expenditures are $163,912,932, representing 36.8% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $289,963, representing 30.8% of total state expenditures for CSFA 64.130 of $940,679 for the year ended December 31, 2023. Payroll and fringe benefit expenditures are $551,321, representing 67.5% of total state expenditures for CSFA 64.135 of $816,958 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure effort report certifications and approvals are performed monthly. In addition, management should review the design of the payroll salary cap application to ensure it is appropriately calculating salary expenses during the effort certification process. Views of responsible officials: Effort certification was delayed for the months of April and May 2023. No certification periods in 2023 were missed and the effort certification system is operating as designed as of July 17, 2023. Manual reconciliations of the salary cap application were performed on every award for fiscal year 2023 to ensure salaries were correctly charged. The salary cap application is working effectively as of January 1, 2024.

N2 Disbursements to or on Behalf of Students Identification of the federal program: Federal Agency: United States Department of Education Federal Cluster: Student Financial Assistance Assistance Listing No.: 84.268, Federal Direct Student Loans (Direct Loans) Award Periods: July 1, 2022 through June 30, 2023; July 1, 2023 through June 30, 2024 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: When Direct Loans are being credited to a student’s account, an institution must notify the student, or parent, in writing of (1) the date and amount of the disbursement; (2) the student’s right, or parent’s right, to cancel all or a portion of that loan or loan disbursement and have the loan proceeds returned to the holder of that loan; and (3) the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan. In order to identify these students, Mayo Clinic (“the Clinic”) utilizes a disbursement report that is run from a script housed in SAP Business Objects. Information technology general controls (ITGCs) over the SAP Business Objects disbursement report was not tested by the Clinic during 2023 to ensure the accuracy and completeness of the disbursement report. Cause: Information technology general controls were not tested for SAP Business Objects in 2023. Effect or potential effect: The disbursement report may be inaccurate or incomplete and as a result a student may not be timely notified of the date and amount of the disbursement; the student/parent’s right to cancel; and the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel. Questioned costs: None. Context: Total expenditures for the Student Financial Assistance Cluster were $18,084,644 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This finding is not a repeat finding from the prior year. Recommendation: The Clinic should implement internal controls to ensure SAP Business Objects ITGCs are tested or implement compensating controls to ensure the disbursement report is accurate and complete. Views of responsible officials: The Clinic has internal controls over access and change management procedures in place over Business Objects. Management will ensure these controls are tested annually.