Finding 2022-001 ? Information Technology General ControlsIdentification of the federal program:Federal Agency: United States Department of EducationFederal Cluster/Program: Student Financial AssistanceAward Periods: July 1, 2021 through June 30, 2022, and July 1, 2022 through June 30, 2023Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of the Uniform Guidance states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Mayo Clinic (the Clinic) did not implement all Complementary User Entity Controls (CUECs) as prescribed in the Ellucian SOC 1 Report that are required to be in place to support effective information technology general controls (ITGCs) for the Banner application. The controls that were not specifically implemented relate to user access review. Additionally, user provisioning and user termination processes were not operating as designed. As a result, Banner ITGCs cannot be relied upon in the period of audit.There is a risk the data relevant to the SFA Cluster program stored within the student financial aid system may be inappropriately created or modified. A user access review was not performed during the current period. For the remainder of the CUECs, evidence of the operation of controls identified to address this risk during the fiscal period under audit was not appropriately retained. Cause:Management did not appropriately implement a user access review. Management did not retain sufficient supporting documentation to evidence that the new user provisioning and termination controls, as required by the CUECs prescribed in the Ellucian SOC 1 Report, were designed effectively and placed in operation during the period under audit.Effect or potential effect:Effective testing of the required CUECs is to support effective ITGCs over the Banner application. As a result, the Banner application cannot be relied on for the audit period.Questioned costs:None.Context:We reviewed evidence over the testing of the required CUECs and noted the evidence was incomplete and insufficient to conclude on the effective ITGCs over the Banner application. These controls specifically relate to user access review, user provisioning, and user termination. As a result, Banner ITGCs cannot be relied upon in the period of audit.Total expenditures for the Student Financial Assistance Cluster were $16,350,962 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:This is a not a repeat finding from the prior year.Recommendation:Management should complete the implementation for all required CUECs prescribed within the Ellucian SOC 1 Report and retain documentation of the operation of controls.Views of responsible officials:Mayo Clinic IT will work with the Student Financial Aid office to review the risk rating given to the Banner application. A complete user access review based on job roles will be completed for 2023. The review will include each employee?s assigned functions within the Banner system. The user provisioning process will also be updated to include the functions the user will be receiving. Enhanced documentation will be retained for user terminations and other system reports required to complete testing of the Banner controls.
Finding 2022-003 ? Gramm-Leach-Bliley Act ? Student Information Security (GLBA)Identification of the federal program:Federal Agency: United States Department of EducationFederal Cluster: Student Financial AssistanceAward Periods: July 1, 2021 through June 30, 2022, and July 1, 2022 through June 30, 2023Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?16 CFR 314.4(b) requires institutions to ?Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures.?16 CFR 314.4(c) requires institutions to ?Design and implement information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards? key controls, systems, and procedures.?Condition:The Clinic has a security risk program in place that follows the National Institute of Standards and Technology (NIST) framework to assess its information technology risks. The program includes: (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and (3) detecting, preventing, and responding to attacks, intrusions, or other systems failures.However, for the student financial aid system used by the Clinic, the 2022 NIST risk assessment did not cover (2) information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and (3) detecting, preventing, and responding to attacks, intrusions, or other systems failures.Cause:The Clinic?s security risk program did not include the student financial aid information applications.Effect or potential effect:The absence of internal controls and policies and procedures could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of student account information.Questioned costs:None.Context:Under an institution?s Program Participation Agreement with the U.S. Department of Education and the GLBA, schools must protect student financial aid information, with particular attention to information provided to institutions by the U.S. Department of Education or otherwise obtained in support of the administration of the federal student financial aid programs. Total expenditures for the Student Financial Assistance Cluster were $16,350,962 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:This finding is a repeat of Finding 2021-006 from the prior year.Recommendation:We recommend that the Clinic include the student information systems as part of its annual enterprise-wide risk assessment.Views of responsible officials:Mayo Clinic Office of Information Security created a corrective action plan in the Fall of 2022. The corrective action plan has been fully implemented as of May 2023. The Department of Education reviewed the corrective action plan and concluded it acceptable to address the auditor finding from audit year 2021.
Finding 2022-004 ? Enrollment ReportingIdentification of the federal program:Federal Agency: United States Department of EducationFederal Cluster: Student Financial AssistanceAward Period: July 1, 2021 through June 30, 2022Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:As part of the review of the monthly SFRNSLC enrollment report prior to its upload to the National Student Clearinghouse (NSC)/National Student Loan Data System, the Financial Aid Director sampled 10 students from the monthly SFRNSLC enrollment report for accuracy against the student records system and sampled 10 students from the student records system for completeness against the monthly SFRNSLC enrollment report. However, evidence was not retained of the students sampled and the specific data validated as part of the review for the period January 1 ? June 30, 2022. Management implemented internal controls on July 1, 2022 to include the retention of documentation over its internal controls. This control was tested for the period July 1, 2022 through December 31, 2022 and determined to be operating effectively.Cause:Internal controls were not properly designed for the first six months of FY22 to require detailed evidence of the accounts reviewed and related test attributes to be retained.Effect or potential effect:An incorrect enrollment report may be submitted.Questioned costs:None.Context:Total expenditures for the Student Financial Assistance Cluster were $16,350,962 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:This finding is a repeat of Finding 2021-007 from the prior year.Recommendation:Management should continue to follow its internal control implemented on July 1, 2022 which documents the review process performed by the Financial Aid Director, including the students sampled and specific data validated, the results of the review, and the follow-up actions taken, if any, and sign-off by the Financial Aid Director to evidence performance of the monthly review.Views of responsible officials:Mayo Clinic has provided evidence to support internal controls were properly designed to support correct information is being submitted to the National Student Loan Clearinghouse. This process will be continued.
Finding 2022-005 ? Activities Allowed or Unallowed and Eligibility (Cost of Attendance)Identification of the federal program:Federal Agency: United States Department of EducationFederal Cluster: Student Financial AssistanceAward Periods: July 1, 2021 through June 30, 2022, and July 1, 2022 through June 30, 2023Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Annual cost of attendance (COA) budgets (by program/by enrollment status) uploaded to Mayo Clinic College of Medicine and Science?s student information system by the Program Manager of Student Financial Aid were not reviewed and approved by another individual for accuracy once the upload was complete for the period January 1 ? August 31, 2022. Management implemented internal controls on September 1, 2022 to include evidence over review and approval of COA budgets and performed the control for any remaining programs for which COA budgets required upload to the student information system by December 31, 2022. This control was tested for the period September 1, 2022 through December 31, 2022 for two of four programs subject to the new control and determined to be operating effectively.Cause:Internal controls were not in place for the first eight months of FY22 to require a secondary review of the data input by the Program Manager of Student Financial Aid.Effect or potential effect:COA could be incorrectly uploaded to the student information system, which could cause a student?s financial need, and resulting financial aid, to be incorrectly calculated.Questioned Costs:None.Context:Total expenditures for the Student Financial Assistance Cluster were $16,350,962 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:This finding is a repeat of Finding 2021-008 from the prior year.Recommendation:Management should continue to follow its internal control implemented on September 1, 2022 which requires signoff on the annual COA budgets uploaded into the student information system by the Program Manager of Student Financial Aid by a secondary reviewer to ensure accuracy.Views of responsible officials:Starting in September 2022, annual cost of attendance budgets uploaded to Mayo Clinic College of Medicine and Science?s student information system by the Program Manager of Student Financial Aid are reviewed and approved by another individual for accuracy once the upload was complete. This process will be continued.
Finding 2022-001 ? Information Technology General ControlsIdentification of the federal program:Federal Agency: United States Department of EducationFederal Cluster/Program: Student Financial AssistanceAward Periods: July 1, 2021 through June 30, 2022, and July 1, 2022 through June 30, 2023Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of the Uniform Guidance states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Mayo Clinic (the Clinic) did not implement all Complementary User Entity Controls (CUECs) as prescribed in the Ellucian SOC 1 Report that are required to be in place to support effective information technology general controls (ITGCs) for the Banner application. The controls that were not specifically implemented relate to user access review. Additionally, user provisioning and user termination processes were not operating as designed. As a result, Banner ITGCs cannot be relied upon in the period of audit.There is a risk the data relevant to the SFA Cluster program stored within the student financial aid system may be inappropriately created or modified. A user access review was not performed during the current period. For the remainder of the CUECs, evidence of the operation of controls identified to address this risk during the fiscal period under audit was not appropriately retained. Cause:Management did not appropriately implement a user access review. Management did not retain sufficient supporting documentation to evidence that the new user provisioning and termination controls, as required by the CUECs prescribed in the Ellucian SOC 1 Report, were designed effectively and placed in operation during the period under audit.Effect or potential effect:Effective testing of the required CUECs is to support effective ITGCs over the Banner application. As a result, the Banner application cannot be relied on for the audit period.Questioned costs:None.Context:We reviewed evidence over the testing of the required CUECs and noted the evidence was incomplete and insufficient to conclude on the effective ITGCs over the Banner application. These controls specifically relate to user access review, user provisioning, and user termination. As a result, Banner ITGCs cannot be relied upon in the period of audit.Total expenditures for the Student Financial Assistance Cluster were $16,350,962 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:This is a not a repeat finding from the prior year.Recommendation:Management should complete the implementation for all required CUECs prescribed within the Ellucian SOC 1 Report and retain documentation of the operation of controls.Views of responsible officials:Mayo Clinic IT will work with the Student Financial Aid office to review the risk rating given to the Banner application. A complete user access review based on job roles will be completed for 2023. The review will include each employee?s assigned functions within the Banner system. The user provisioning process will also be updated to include the functions the user will be receiving. Enhanced documentation will be retained for user terminations and other system reports required to complete testing of the Banner controls.
Finding 2022-003 ? Gramm-Leach-Bliley Act ? Student Information Security (GLBA)Identification of the federal program:Federal Agency: United States Department of EducationFederal Cluster: Student Financial AssistanceAward Periods: July 1, 2021 through June 30, 2022, and July 1, 2022 through June 30, 2023Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?16 CFR 314.4(b) requires institutions to ?Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures.?16 CFR 314.4(c) requires institutions to ?Design and implement information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards? key controls, systems, and procedures.?Condition:The Clinic has a security risk program in place that follows the National Institute of Standards and Technology (NIST) framework to assess its information technology risks. The program includes: (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and (3) detecting, preventing, and responding to attacks, intrusions, or other systems failures.However, for the student financial aid system used by the Clinic, the 2022 NIST risk assessment did not cover (2) information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and (3) detecting, preventing, and responding to attacks, intrusions, or other systems failures.Cause:The Clinic?s security risk program did not include the student financial aid information applications.Effect or potential effect:The absence of internal controls and policies and procedures could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of student account information.Questioned costs:None.Context:Under an institution?s Program Participation Agreement with the U.S. Department of Education and the GLBA, schools must protect student financial aid information, with particular attention to information provided to institutions by the U.S. Department of Education or otherwise obtained in support of the administration of the federal student financial aid programs. Total expenditures for the Student Financial Assistance Cluster were $16,350,962 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:This finding is a repeat of Finding 2021-006 from the prior year.Recommendation:We recommend that the Clinic include the student information systems as part of its annual enterprise-wide risk assessment.Views of responsible officials:Mayo Clinic Office of Information Security created a corrective action plan in the Fall of 2022. The corrective action plan has been fully implemented as of May 2023. The Department of Education reviewed the corrective action plan and concluded it acceptable to address the auditor finding from audit year 2021.
Finding 2022-004 ? Enrollment ReportingIdentification of the federal program:Federal Agency: United States Department of EducationFederal Cluster: Student Financial AssistanceAward Period: July 1, 2021 through June 30, 2022Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:As part of the review of the monthly SFRNSLC enrollment report prior to its upload to the National Student Clearinghouse (NSC)/National Student Loan Data System, the Financial Aid Director sampled 10 students from the monthly SFRNSLC enrollment report for accuracy against the student records system and sampled 10 students from the student records system for completeness against the monthly SFRNSLC enrollment report. However, evidence was not retained of the students sampled and the specific data validated as part of the review for the period January 1 ? June 30, 2022. Management implemented internal controls on July 1, 2022 to include the retention of documentation over its internal controls. This control was tested for the period July 1, 2022 through December 31, 2022 and determined to be operating effectively.Cause:Internal controls were not properly designed for the first six months of FY22 to require detailed evidence of the accounts reviewed and related test attributes to be retained.Effect or potential effect:An incorrect enrollment report may be submitted.Questioned costs:None.Context:Total expenditures for the Student Financial Assistance Cluster were $16,350,962 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:This finding is a repeat of Finding 2021-007 from the prior year.Recommendation:Management should continue to follow its internal control implemented on July 1, 2022 which documents the review process performed by the Financial Aid Director, including the students sampled and specific data validated, the results of the review, and the follow-up actions taken, if any, and sign-off by the Financial Aid Director to evidence performance of the monthly review.Views of responsible officials:Mayo Clinic has provided evidence to support internal controls were properly designed to support correct information is being submitted to the National Student Loan Clearinghouse. This process will be continued.
Finding 2022-005 ? Activities Allowed or Unallowed and Eligibility (Cost of Attendance)Identification of the federal program:Federal Agency: United States Department of EducationFederal Cluster: Student Financial AssistanceAward Periods: July 1, 2021 through June 30, 2022, and July 1, 2022 through June 30, 2023Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Annual cost of attendance (COA) budgets (by program/by enrollment status) uploaded to Mayo Clinic College of Medicine and Science?s student information system by the Program Manager of Student Financial Aid were not reviewed and approved by another individual for accuracy once the upload was complete for the period January 1 ? August 31, 2022. Management implemented internal controls on September 1, 2022 to include evidence over review and approval of COA budgets and performed the control for any remaining programs for which COA budgets required upload to the student information system by December 31, 2022. This control was tested for the period September 1, 2022 through December 31, 2022 for two of four programs subject to the new control and determined to be operating effectively.Cause:Internal controls were not in place for the first eight months of FY22 to require a secondary review of the data input by the Program Manager of Student Financial Aid.Effect or potential effect:COA could be incorrectly uploaded to the student information system, which could cause a student?s financial need, and resulting financial aid, to be incorrectly calculated.Questioned Costs:None.Context:Total expenditures for the Student Financial Assistance Cluster were $16,350,962 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:This finding is a repeat of Finding 2021-008 from the prior year.Recommendation:Management should continue to follow its internal control implemented on September 1, 2022 which requires signoff on the annual COA budgets uploaded into the student information system by the Program Manager of Student Financial Aid by a secondary reviewer to ensure accuracy.Views of responsible officials:Starting in September 2022, annual cost of attendance budgets uploaded to Mayo Clinic College of Medicine and Science?s student information system by the Program Manager of Student Financial Aid are reviewed and approved by another individual for accuracy once the upload was complete. This process will be continued.
Finding 2022-002 ? Procurement, Suspension and DebarmentIdentification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesFederal Cluster: Research and Development (R&D)Pass-Through Entities: University of Iowa (93.397) and NYU Grossman School of Medicine (93.838)Assistance Listing Nos.: 93.310, 93.394, 93.397 and 93.838Award Numbers: OD23121, CA212162, CA97274 and HL16847Award Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of the Uniform Guidance states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed:?When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with ? 200.319 or paragraph (c) of this section.?Section 200.320(c) of the Uniform Guidance states the following regarding noncompetitive procurement:?There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply:(1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (see paragraph (a)(1) of this section);(2) The item is available only from a single source;(3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation;(4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or(5) After solicitation of a number of sources, competition is determined inadequate.?Condition:Four federal procurements conducted in fiscal year 2022 in excess of the SAT of $250,000 were not competitively bid as required under Uniform Guidance Section 230.320(b) nor was a competitive bid exception documented to support the lack of formal proposals in accordance with Clinic procurement policies and procedures and Uniform Guidance Section 230.320(c). In addition, for one procurement, the Clinic did not timely document its independent suspension and debarment check at the time of procurement as required by its procurement justification form.Cause:While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic?s procurement, suspension and debarment policies and procedures, they are not robust enough to identify procurement transactions that are not in accordance with the Clinic?s policies and procedures.Effect or potential effect:The Clinic?s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to purchases in excess of the SAT.Questioned costs:$1,158,184:Assistance Listing No. 93.310, OD23121 ? $270,000Assistance Listing No. 93.394, CA212162 ? $254,125Assistance Listing No. 93.397, CA97274 ? $254,125Assistance Listing No. 93.838, HL16847 ? $379,934Context:We sampled 16 federal procurements over $25,000, totaling $2,839,288, from a population of 91 federal procurements over $25,000, totaling $7,490,915. For four of the 16 federal procurements tested totaling $1,158,184, the amount of the procurement exceeded the SAT of $250,000. Based on the Uniform Guidance and Clinic procurement policies, competitive proposals would be required; however, no competitive bidding was performed. For one of the 16 procurements tested totaling $257,100, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately seven months later.Procurement-related expenditures are approximately 7% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is not a repeat finding from the prior year.Recommendation:The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures and internal controls in order to comply with the Uniform Guidance procurement standards. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with Clinic documented policies, procedures and internal controls.Views of responsible officials:While Mayo Clinic Supply Chain Procurement processes include internal controls and procedures to review submission of Federal Funds documentation, enhanced controls will be evaluated to ensure compliance with competitive bid requirements. A review of risks will be completed with compensating controls added, as necessary.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-002 ? Procurement, Suspension and DebarmentIdentification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesFederal Cluster: Research and Development (R&D)Pass-Through Entities: University of Iowa (93.397) and NYU Grossman School of Medicine (93.838)Assistance Listing Nos.: 93.310, 93.394, 93.397 and 93.838Award Numbers: OD23121, CA212162, CA97274 and HL16847Award Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of the Uniform Guidance states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed:?When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with ? 200.319 or paragraph (c) of this section.?Section 200.320(c) of the Uniform Guidance states the following regarding noncompetitive procurement:?There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply:(1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (see paragraph (a)(1) of this section);(2) The item is available only from a single source;(3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation;(4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or(5) After solicitation of a number of sources, competition is determined inadequate.?Condition:Four federal procurements conducted in fiscal year 2022 in excess of the SAT of $250,000 were not competitively bid as required under Uniform Guidance Section 230.320(b) nor was a competitive bid exception documented to support the lack of formal proposals in accordance with Clinic procurement policies and procedures and Uniform Guidance Section 230.320(c). In addition, for one procurement, the Clinic did not timely document its independent suspension and debarment check at the time of procurement as required by its procurement justification form.Cause:While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic?s procurement, suspension and debarment policies and procedures, they are not robust enough to identify procurement transactions that are not in accordance with the Clinic?s policies and procedures.Effect or potential effect:The Clinic?s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to purchases in excess of the SAT.Questioned costs:$1,158,184:Assistance Listing No. 93.310, OD23121 ? $270,000Assistance Listing No. 93.394, CA212162 ? $254,125Assistance Listing No. 93.397, CA97274 ? $254,125Assistance Listing No. 93.838, HL16847 ? $379,934Context:We sampled 16 federal procurements over $25,000, totaling $2,839,288, from a population of 91 federal procurements over $25,000, totaling $7,490,915. For four of the 16 federal procurements tested totaling $1,158,184, the amount of the procurement exceeded the SAT of $250,000. Based on the Uniform Guidance and Clinic procurement policies, competitive proposals would be required; however, no competitive bidding was performed. For one of the 16 procurements tested totaling $257,100, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately seven months later.Procurement-related expenditures are approximately 7% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is not a repeat finding from the prior year.Recommendation:The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures and internal controls in order to comply with the Uniform Guidance procurement standards. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with Clinic documented policies, procedures and internal controls.Views of responsible officials:While Mayo Clinic Supply Chain Procurement processes include internal controls and procedures to review submission of Federal Funds documentation, enhanced controls will be evaluated to ensure compliance with competitive bid requirements. A review of risks will be completed with compensating controls added, as necessary.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-002 ? Procurement, Suspension and DebarmentIdentification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesFederal Cluster: Research and Development (R&D)Pass-Through Entities: University of Iowa (93.397) and NYU Grossman School of Medicine (93.838)Assistance Listing Nos.: 93.310, 93.394, 93.397 and 93.838Award Numbers: OD23121, CA212162, CA97274 and HL16847Award Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of the Uniform Guidance states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed:?When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with ? 200.319 or paragraph (c) of this section.?Section 200.320(c) of the Uniform Guidance states the following regarding noncompetitive procurement:?There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply:(1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (see paragraph (a)(1) of this section);(2) The item is available only from a single source;(3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation;(4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or(5) After solicitation of a number of sources, competition is determined inadequate.?Condition:Four federal procurements conducted in fiscal year 2022 in excess of the SAT of $250,000 were not competitively bid as required under Uniform Guidance Section 230.320(b) nor was a competitive bid exception documented to support the lack of formal proposals in accordance with Clinic procurement policies and procedures and Uniform Guidance Section 230.320(c). In addition, for one procurement, the Clinic did not timely document its independent suspension and debarment check at the time of procurement as required by its procurement justification form.Cause:While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic?s procurement, suspension and debarment policies and procedures, they are not robust enough to identify procurement transactions that are not in accordance with the Clinic?s policies and procedures.Effect or potential effect:The Clinic?s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to purchases in excess of the SAT.Questioned costs:$1,158,184:Assistance Listing No. 93.310, OD23121 ? $270,000Assistance Listing No. 93.394, CA212162 ? $254,125Assistance Listing No. 93.397, CA97274 ? $254,125Assistance Listing No. 93.838, HL16847 ? $379,934Context:We sampled 16 federal procurements over $25,000, totaling $2,839,288, from a population of 91 federal procurements over $25,000, totaling $7,490,915. For four of the 16 federal procurements tested totaling $1,158,184, the amount of the procurement exceeded the SAT of $250,000. Based on the Uniform Guidance and Clinic procurement policies, competitive proposals would be required; however, no competitive bidding was performed. For one of the 16 procurements tested totaling $257,100, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately seven months later.Procurement-related expenditures are approximately 7% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is not a repeat finding from the prior year.Recommendation:The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures and internal controls in order to comply with the Uniform Guidance procurement standards. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with Clinic documented policies, procedures and internal controls.Views of responsible officials:While Mayo Clinic Supply Chain Procurement processes include internal controls and procedures to review submission of Federal Funds documentation, enhanced controls will be evaluated to ensure compliance with competitive bid requirements. A review of risks will be completed with compensating controls added, as necessary.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-002 ? Procurement, Suspension and DebarmentIdentification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesFederal Cluster: Research and Development (R&D)Pass-Through Entities: University of Iowa (93.397) and NYU Grossman School of Medicine (93.838)Assistance Listing Nos.: 93.310, 93.394, 93.397 and 93.838Award Numbers: OD23121, CA212162, CA97274 and HL16847Award Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of the Uniform Guidance states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed:?When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with ? 200.319 or paragraph (c) of this section.?Section 200.320(c) of the Uniform Guidance states the following regarding noncompetitive procurement:?There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply:(1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (see paragraph (a)(1) of this section);(2) The item is available only from a single source;(3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation;(4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or(5) After solicitation of a number of sources, competition is determined inadequate.?Condition:Four federal procurements conducted in fiscal year 2022 in excess of the SAT of $250,000 were not competitively bid as required under Uniform Guidance Section 230.320(b) nor was a competitive bid exception documented to support the lack of formal proposals in accordance with Clinic procurement policies and procedures and Uniform Guidance Section 230.320(c). In addition, for one procurement, the Clinic did not timely document its independent suspension and debarment check at the time of procurement as required by its procurement justification form.Cause:While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic?s procurement, suspension and debarment policies and procedures, they are not robust enough to identify procurement transactions that are not in accordance with the Clinic?s policies and procedures.Effect or potential effect:The Clinic?s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to purchases in excess of the SAT.Questioned costs:$1,158,184:Assistance Listing No. 93.310, OD23121 ? $270,000Assistance Listing No. 93.394, CA212162 ? $254,125Assistance Listing No. 93.397, CA97274 ? $254,125Assistance Listing No. 93.838, HL16847 ? $379,934Context:We sampled 16 federal procurements over $25,000, totaling $2,839,288, from a population of 91 federal procurements over $25,000, totaling $7,490,915. For four of the 16 federal procurements tested totaling $1,158,184, the amount of the procurement exceeded the SAT of $250,000. Based on the Uniform Guidance and Clinic procurement policies, competitive proposals would be required; however, no competitive bidding was performed. For one of the 16 procurements tested totaling $257,100, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately seven months later.Procurement-related expenditures are approximately 7% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is not a repeat finding from the prior year.Recommendation:The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures and internal controls in order to comply with the Uniform Guidance procurement standards. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with Clinic documented policies, procedures and internal controls.Views of responsible officials:While Mayo Clinic Supply Chain Procurement processes include internal controls and procedures to review submission of Federal Funds documentation, enhanced controls will be evaluated to ensure compliance with competitive bid requirements. A review of risks will be completed with compensating controls added, as necessary.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-001 ? Information Technology General ControlsIdentification of the federal program:Federal Agency: United States Department of EducationFederal Cluster/Program: Student Financial AssistanceAward Periods: July 1, 2021 through June 30, 2022, and July 1, 2022 through June 30, 2023Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of the Uniform Guidance states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Mayo Clinic (the Clinic) did not implement all Complementary User Entity Controls (CUECs) as prescribed in the Ellucian SOC 1 Report that are required to be in place to support effective information technology general controls (ITGCs) for the Banner application. The controls that were not specifically implemented relate to user access review. Additionally, user provisioning and user termination processes were not operating as designed. As a result, Banner ITGCs cannot be relied upon in the period of audit.There is a risk the data relevant to the SFA Cluster program stored within the student financial aid system may be inappropriately created or modified. A user access review was not performed during the current period. For the remainder of the CUECs, evidence of the operation of controls identified to address this risk during the fiscal period under audit was not appropriately retained. Cause:Management did not appropriately implement a user access review. Management did not retain sufficient supporting documentation to evidence that the new user provisioning and termination controls, as required by the CUECs prescribed in the Ellucian SOC 1 Report, were designed effectively and placed in operation during the period under audit.Effect or potential effect:Effective testing of the required CUECs is to support effective ITGCs over the Banner application. As a result, the Banner application cannot be relied on for the audit period.Questioned costs:None.Context:We reviewed evidence over the testing of the required CUECs and noted the evidence was incomplete and insufficient to conclude on the effective ITGCs over the Banner application. These controls specifically relate to user access review, user provisioning, and user termination. As a result, Banner ITGCs cannot be relied upon in the period of audit.Total expenditures for the Student Financial Assistance Cluster were $16,350,962 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:This is a not a repeat finding from the prior year.Recommendation:Management should complete the implementation for all required CUECs prescribed within the Ellucian SOC 1 Report and retain documentation of the operation of controls.Views of responsible officials:Mayo Clinic IT will work with the Student Financial Aid office to review the risk rating given to the Banner application. A complete user access review based on job roles will be completed for 2023. The review will include each employee?s assigned functions within the Banner system. The user provisioning process will also be updated to include the functions the user will be receiving. Enhanced documentation will be retained for user terminations and other system reports required to complete testing of the Banner controls.
Finding 2022-003 ? Gramm-Leach-Bliley Act ? Student Information Security (GLBA)Identification of the federal program:Federal Agency: United States Department of EducationFederal Cluster: Student Financial AssistanceAward Periods: July 1, 2021 through June 30, 2022, and July 1, 2022 through June 30, 2023Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?16 CFR 314.4(b) requires institutions to ?Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures.?16 CFR 314.4(c) requires institutions to ?Design and implement information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards? key controls, systems, and procedures.?Condition:The Clinic has a security risk program in place that follows the National Institute of Standards and Technology (NIST) framework to assess its information technology risks. The program includes: (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and (3) detecting, preventing, and responding to attacks, intrusions, or other systems failures.However, for the student financial aid system used by the Clinic, the 2022 NIST risk assessment did not cover (2) information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and (3) detecting, preventing, and responding to attacks, intrusions, or other systems failures.Cause:The Clinic?s security risk program did not include the student financial aid information applications.Effect or potential effect:The absence of internal controls and policies and procedures could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of student account information.Questioned costs:None.Context:Under an institution?s Program Participation Agreement with the U.S. Department of Education and the GLBA, schools must protect student financial aid information, with particular attention to information provided to institutions by the U.S. Department of Education or otherwise obtained in support of the administration of the federal student financial aid programs. Total expenditures for the Student Financial Assistance Cluster were $16,350,962 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:This finding is a repeat of Finding 2021-006 from the prior year.Recommendation:We recommend that the Clinic include the student information systems as part of its annual enterprise-wide risk assessment.Views of responsible officials:Mayo Clinic Office of Information Security created a corrective action plan in the Fall of 2022. The corrective action plan has been fully implemented as of May 2023. The Department of Education reviewed the corrective action plan and concluded it acceptable to address the auditor finding from audit year 2021.
Finding 2022-004 ? Enrollment ReportingIdentification of the federal program:Federal Agency: United States Department of EducationFederal Cluster: Student Financial AssistanceAward Period: July 1, 2021 through June 30, 2022Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:As part of the review of the monthly SFRNSLC enrollment report prior to its upload to the National Student Clearinghouse (NSC)/National Student Loan Data System, the Financial Aid Director sampled 10 students from the monthly SFRNSLC enrollment report for accuracy against the student records system and sampled 10 students from the student records system for completeness against the monthly SFRNSLC enrollment report. However, evidence was not retained of the students sampled and the specific data validated as part of the review for the period January 1 ? June 30, 2022. Management implemented internal controls on July 1, 2022 to include the retention of documentation over its internal controls. This control was tested for the period July 1, 2022 through December 31, 2022 and determined to be operating effectively.Cause:Internal controls were not properly designed for the first six months of FY22 to require detailed evidence of the accounts reviewed and related test attributes to be retained.Effect or potential effect:An incorrect enrollment report may be submitted.Questioned costs:None.Context:Total expenditures for the Student Financial Assistance Cluster were $16,350,962 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:This finding is a repeat of Finding 2021-007 from the prior year.Recommendation:Management should continue to follow its internal control implemented on July 1, 2022 which documents the review process performed by the Financial Aid Director, including the students sampled and specific data validated, the results of the review, and the follow-up actions taken, if any, and sign-off by the Financial Aid Director to evidence performance of the monthly review.Views of responsible officials:Mayo Clinic has provided evidence to support internal controls were properly designed to support correct information is being submitted to the National Student Loan Clearinghouse. This process will be continued.
Finding 2022-005 ? Activities Allowed or Unallowed and Eligibility (Cost of Attendance)Identification of the federal program:Federal Agency: United States Department of EducationFederal Cluster: Student Financial AssistanceAward Periods: July 1, 2021 through June 30, 2022, and July 1, 2022 through June 30, 2023Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Annual cost of attendance (COA) budgets (by program/by enrollment status) uploaded to Mayo Clinic College of Medicine and Science?s student information system by the Program Manager of Student Financial Aid were not reviewed and approved by another individual for accuracy once the upload was complete for the period January 1 ? August 31, 2022. Management implemented internal controls on September 1, 2022 to include evidence over review and approval of COA budgets and performed the control for any remaining programs for which COA budgets required upload to the student information system by December 31, 2022. This control was tested for the period September 1, 2022 through December 31, 2022 for two of four programs subject to the new control and determined to be operating effectively.Cause:Internal controls were not in place for the first eight months of FY22 to require a secondary review of the data input by the Program Manager of Student Financial Aid.Effect or potential effect:COA could be incorrectly uploaded to the student information system, which could cause a student?s financial need, and resulting financial aid, to be incorrectly calculated.Questioned Costs:None.Context:Total expenditures for the Student Financial Assistance Cluster were $16,350,962 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:This finding is a repeat of Finding 2021-008 from the prior year.Recommendation:Management should continue to follow its internal control implemented on September 1, 2022 which requires signoff on the annual COA budgets uploaded into the student information system by the Program Manager of Student Financial Aid by a secondary reviewer to ensure accuracy.Views of responsible officials:Starting in September 2022, annual cost of attendance budgets uploaded to Mayo Clinic College of Medicine and Science?s student information system by the Program Manager of Student Financial Aid are reviewed and approved by another individual for accuracy once the upload was complete. This process will be continued.
Finding 2022-001 ? Information Technology General ControlsIdentification of the federal program:Federal Agency: United States Department of EducationFederal Cluster/Program: Student Financial AssistanceAward Periods: July 1, 2021 through June 30, 2022, and July 1, 2022 through June 30, 2023Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of the Uniform Guidance states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Mayo Clinic (the Clinic) did not implement all Complementary User Entity Controls (CUECs) as prescribed in the Ellucian SOC 1 Report that are required to be in place to support effective information technology general controls (ITGCs) for the Banner application. The controls that were not specifically implemented relate to user access review. Additionally, user provisioning and user termination processes were not operating as designed. As a result, Banner ITGCs cannot be relied upon in the period of audit.There is a risk the data relevant to the SFA Cluster program stored within the student financial aid system may be inappropriately created or modified. A user access review was not performed during the current period. For the remainder of the CUECs, evidence of the operation of controls identified to address this risk during the fiscal period under audit was not appropriately retained. Cause:Management did not appropriately implement a user access review. Management did not retain sufficient supporting documentation to evidence that the new user provisioning and termination controls, as required by the CUECs prescribed in the Ellucian SOC 1 Report, were designed effectively and placed in operation during the period under audit.Effect or potential effect:Effective testing of the required CUECs is to support effective ITGCs over the Banner application. As a result, the Banner application cannot be relied on for the audit period.Questioned costs:None.Context:We reviewed evidence over the testing of the required CUECs and noted the evidence was incomplete and insufficient to conclude on the effective ITGCs over the Banner application. These controls specifically relate to user access review, user provisioning, and user termination. As a result, Banner ITGCs cannot be relied upon in the period of audit.Total expenditures for the Student Financial Assistance Cluster were $16,350,962 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:This is a not a repeat finding from the prior year.Recommendation:Management should complete the implementation for all required CUECs prescribed within the Ellucian SOC 1 Report and retain documentation of the operation of controls.Views of responsible officials:Mayo Clinic IT will work with the Student Financial Aid office to review the risk rating given to the Banner application. A complete user access review based on job roles will be completed for 2023. The review will include each employee?s assigned functions within the Banner system. The user provisioning process will also be updated to include the functions the user will be receiving. Enhanced documentation will be retained for user terminations and other system reports required to complete testing of the Banner controls.
Finding 2022-003 ? Gramm-Leach-Bliley Act ? Student Information Security (GLBA)Identification of the federal program:Federal Agency: United States Department of EducationFederal Cluster: Student Financial AssistanceAward Periods: July 1, 2021 through June 30, 2022, and July 1, 2022 through June 30, 2023Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?16 CFR 314.4(b) requires institutions to ?Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures.?16 CFR 314.4(c) requires institutions to ?Design and implement information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards? key controls, systems, and procedures.?Condition:The Clinic has a security risk program in place that follows the National Institute of Standards and Technology (NIST) framework to assess its information technology risks. The program includes: (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and (3) detecting, preventing, and responding to attacks, intrusions, or other systems failures.However, for the student financial aid system used by the Clinic, the 2022 NIST risk assessment did not cover (2) information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and (3) detecting, preventing, and responding to attacks, intrusions, or other systems failures.Cause:The Clinic?s security risk program did not include the student financial aid information applications.Effect or potential effect:The absence of internal controls and policies and procedures could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of student account information.Questioned costs:None.Context:Under an institution?s Program Participation Agreement with the U.S. Department of Education and the GLBA, schools must protect student financial aid information, with particular attention to information provided to institutions by the U.S. Department of Education or otherwise obtained in support of the administration of the federal student financial aid programs. Total expenditures for the Student Financial Assistance Cluster were $16,350,962 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:This finding is a repeat of Finding 2021-006 from the prior year.Recommendation:We recommend that the Clinic include the student information systems as part of its annual enterprise-wide risk assessment.Views of responsible officials:Mayo Clinic Office of Information Security created a corrective action plan in the Fall of 2022. The corrective action plan has been fully implemented as of May 2023. The Department of Education reviewed the corrective action plan and concluded it acceptable to address the auditor finding from audit year 2021.
Finding 2022-004 ? Enrollment ReportingIdentification of the federal program:Federal Agency: United States Department of EducationFederal Cluster: Student Financial AssistanceAward Period: July 1, 2021 through June 30, 2022Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:As part of the review of the monthly SFRNSLC enrollment report prior to its upload to the National Student Clearinghouse (NSC)/National Student Loan Data System, the Financial Aid Director sampled 10 students from the monthly SFRNSLC enrollment report for accuracy against the student records system and sampled 10 students from the student records system for completeness against the monthly SFRNSLC enrollment report. However, evidence was not retained of the students sampled and the specific data validated as part of the review for the period January 1 ? June 30, 2022. Management implemented internal controls on July 1, 2022 to include the retention of documentation over its internal controls. This control was tested for the period July 1, 2022 through December 31, 2022 and determined to be operating effectively.Cause:Internal controls were not properly designed for the first six months of FY22 to require detailed evidence of the accounts reviewed and related test attributes to be retained.Effect or potential effect:An incorrect enrollment report may be submitted.Questioned costs:None.Context:Total expenditures for the Student Financial Assistance Cluster were $16,350,962 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:This finding is a repeat of Finding 2021-007 from the prior year.Recommendation:Management should continue to follow its internal control implemented on July 1, 2022 which documents the review process performed by the Financial Aid Director, including the students sampled and specific data validated, the results of the review, and the follow-up actions taken, if any, and sign-off by the Financial Aid Director to evidence performance of the monthly review.Views of responsible officials:Mayo Clinic has provided evidence to support internal controls were properly designed to support correct information is being submitted to the National Student Loan Clearinghouse. This process will be continued.
Finding 2022-005 ? Activities Allowed or Unallowed and Eligibility (Cost of Attendance)Identification of the federal program:Federal Agency: United States Department of EducationFederal Cluster: Student Financial AssistanceAward Periods: July 1, 2021 through June 30, 2022, and July 1, 2022 through June 30, 2023Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Annual cost of attendance (COA) budgets (by program/by enrollment status) uploaded to Mayo Clinic College of Medicine and Science?s student information system by the Program Manager of Student Financial Aid were not reviewed and approved by another individual for accuracy once the upload was complete for the period January 1 ? August 31, 2022. Management implemented internal controls on September 1, 2022 to include evidence over review and approval of COA budgets and performed the control for any remaining programs for which COA budgets required upload to the student information system by December 31, 2022. This control was tested for the period September 1, 2022 through December 31, 2022 for two of four programs subject to the new control and determined to be operating effectively.Cause:Internal controls were not in place for the first eight months of FY22 to require a secondary review of the data input by the Program Manager of Student Financial Aid.Effect or potential effect:COA could be incorrectly uploaded to the student information system, which could cause a student?s financial need, and resulting financial aid, to be incorrectly calculated.Questioned Costs:None.Context:Total expenditures for the Student Financial Assistance Cluster were $16,350,962 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:This finding is a repeat of Finding 2021-008 from the prior year.Recommendation:Management should continue to follow its internal control implemented on September 1, 2022 which requires signoff on the annual COA budgets uploaded into the student information system by the Program Manager of Student Financial Aid by a secondary reviewer to ensure accuracy.Views of responsible officials:Starting in September 2022, annual cost of attendance budgets uploaded to Mayo Clinic College of Medicine and Science?s student information system by the Program Manager of Student Financial Aid are reviewed and approved by another individual for accuracy once the upload was complete. This process will be continued.
Finding 2022-002 ? Procurement, Suspension and DebarmentIdentification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesFederal Cluster: Research and Development (R&D)Pass-Through Entities: University of Iowa (93.397) and NYU Grossman School of Medicine (93.838)Assistance Listing Nos.: 93.310, 93.394, 93.397 and 93.838Award Numbers: OD23121, CA212162, CA97274 and HL16847Award Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of the Uniform Guidance states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed:?When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with ? 200.319 or paragraph (c) of this section.?Section 200.320(c) of the Uniform Guidance states the following regarding noncompetitive procurement:?There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply:(1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (see paragraph (a)(1) of this section);(2) The item is available only from a single source;(3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation;(4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or(5) After solicitation of a number of sources, competition is determined inadequate.?Condition:Four federal procurements conducted in fiscal year 2022 in excess of the SAT of $250,000 were not competitively bid as required under Uniform Guidance Section 230.320(b) nor was a competitive bid exception documented to support the lack of formal proposals in accordance with Clinic procurement policies and procedures and Uniform Guidance Section 230.320(c). In addition, for one procurement, the Clinic did not timely document its independent suspension and debarment check at the time of procurement as required by its procurement justification form.Cause:While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic?s procurement, suspension and debarment policies and procedures, they are not robust enough to identify procurement transactions that are not in accordance with the Clinic?s policies and procedures.Effect or potential effect:The Clinic?s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to purchases in excess of the SAT.Questioned costs:$1,158,184:Assistance Listing No. 93.310, OD23121 ? $270,000Assistance Listing No. 93.394, CA212162 ? $254,125Assistance Listing No. 93.397, CA97274 ? $254,125Assistance Listing No. 93.838, HL16847 ? $379,934Context:We sampled 16 federal procurements over $25,000, totaling $2,839,288, from a population of 91 federal procurements over $25,000, totaling $7,490,915. For four of the 16 federal procurements tested totaling $1,158,184, the amount of the procurement exceeded the SAT of $250,000. Based on the Uniform Guidance and Clinic procurement policies, competitive proposals would be required; however, no competitive bidding was performed. For one of the 16 procurements tested totaling $257,100, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately seven months later.Procurement-related expenditures are approximately 7% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is not a repeat finding from the prior year.Recommendation:The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures and internal controls in order to comply with the Uniform Guidance procurement standards. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with Clinic documented policies, procedures and internal controls.Views of responsible officials:While Mayo Clinic Supply Chain Procurement processes include internal controls and procedures to review submission of Federal Funds documentation, enhanced controls will be evaluated to ensure compliance with competitive bid requirements. A review of risks will be completed with compensating controls added, as necessary.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-002 ? Procurement, Suspension and DebarmentIdentification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesFederal Cluster: Research and Development (R&D)Pass-Through Entities: University of Iowa (93.397) and NYU Grossman School of Medicine (93.838)Assistance Listing Nos.: 93.310, 93.394, 93.397 and 93.838Award Numbers: OD23121, CA212162, CA97274 and HL16847Award Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of the Uniform Guidance states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed:?When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with ? 200.319 or paragraph (c) of this section.?Section 200.320(c) of the Uniform Guidance states the following regarding noncompetitive procurement:?There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply:(1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (see paragraph (a)(1) of this section);(2) The item is available only from a single source;(3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation;(4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or(5) After solicitation of a number of sources, competition is determined inadequate.?Condition:Four federal procurements conducted in fiscal year 2022 in excess of the SAT of $250,000 were not competitively bid as required under Uniform Guidance Section 230.320(b) nor was a competitive bid exception documented to support the lack of formal proposals in accordance with Clinic procurement policies and procedures and Uniform Guidance Section 230.320(c). In addition, for one procurement, the Clinic did not timely document its independent suspension and debarment check at the time of procurement as required by its procurement justification form.Cause:While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic?s procurement, suspension and debarment policies and procedures, they are not robust enough to identify procurement transactions that are not in accordance with the Clinic?s policies and procedures.Effect or potential effect:The Clinic?s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to purchases in excess of the SAT.Questioned costs:$1,158,184:Assistance Listing No. 93.310, OD23121 ? $270,000Assistance Listing No. 93.394, CA212162 ? $254,125Assistance Listing No. 93.397, CA97274 ? $254,125Assistance Listing No. 93.838, HL16847 ? $379,934Context:We sampled 16 federal procurements over $25,000, totaling $2,839,288, from a population of 91 federal procurements over $25,000, totaling $7,490,915. For four of the 16 federal procurements tested totaling $1,158,184, the amount of the procurement exceeded the SAT of $250,000. Based on the Uniform Guidance and Clinic procurement policies, competitive proposals would be required; however, no competitive bidding was performed. For one of the 16 procurements tested totaling $257,100, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately seven months later.Procurement-related expenditures are approximately 7% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is not a repeat finding from the prior year.Recommendation:The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures and internal controls in order to comply with the Uniform Guidance procurement standards. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with Clinic documented policies, procedures and internal controls.Views of responsible officials:While Mayo Clinic Supply Chain Procurement processes include internal controls and procedures to review submission of Federal Funds documentation, enhanced controls will be evaluated to ensure compliance with competitive bid requirements. A review of risks will be completed with compensating controls added, as necessary.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-002 ? Procurement, Suspension and DebarmentIdentification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesFederal Cluster: Research and Development (R&D)Pass-Through Entities: University of Iowa (93.397) and NYU Grossman School of Medicine (93.838)Assistance Listing Nos.: 93.310, 93.394, 93.397 and 93.838Award Numbers: OD23121, CA212162, CA97274 and HL16847Award Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of the Uniform Guidance states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed:?When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with ? 200.319 or paragraph (c) of this section.?Section 200.320(c) of the Uniform Guidance states the following regarding noncompetitive procurement:?There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply:(1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (see paragraph (a)(1) of this section);(2) The item is available only from a single source;(3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation;(4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or(5) After solicitation of a number of sources, competition is determined inadequate.?Condition:Four federal procurements conducted in fiscal year 2022 in excess of the SAT of $250,000 were not competitively bid as required under Uniform Guidance Section 230.320(b) nor was a competitive bid exception documented to support the lack of formal proposals in accordance with Clinic procurement policies and procedures and Uniform Guidance Section 230.320(c). In addition, for one procurement, the Clinic did not timely document its independent suspension and debarment check at the time of procurement as required by its procurement justification form.Cause:While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic?s procurement, suspension and debarment policies and procedures, they are not robust enough to identify procurement transactions that are not in accordance with the Clinic?s policies and procedures.Effect or potential effect:The Clinic?s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to purchases in excess of the SAT.Questioned costs:$1,158,184:Assistance Listing No. 93.310, OD23121 ? $270,000Assistance Listing No. 93.394, CA212162 ? $254,125Assistance Listing No. 93.397, CA97274 ? $254,125Assistance Listing No. 93.838, HL16847 ? $379,934Context:We sampled 16 federal procurements over $25,000, totaling $2,839,288, from a population of 91 federal procurements over $25,000, totaling $7,490,915. For four of the 16 federal procurements tested totaling $1,158,184, the amount of the procurement exceeded the SAT of $250,000. Based on the Uniform Guidance and Clinic procurement policies, competitive proposals would be required; however, no competitive bidding was performed. For one of the 16 procurements tested totaling $257,100, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately seven months later.Procurement-related expenditures are approximately 7% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is not a repeat finding from the prior year.Recommendation:The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures and internal controls in order to comply with the Uniform Guidance procurement standards. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with Clinic documented policies, procedures and internal controls.Views of responsible officials:While Mayo Clinic Supply Chain Procurement processes include internal controls and procedures to review submission of Federal Funds documentation, enhanced controls will be evaluated to ensure compliance with competitive bid requirements. A review of risks will be completed with compensating controls added, as necessary.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-002 ? Procurement, Suspension and DebarmentIdentification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesFederal Cluster: Research and Development (R&D)Pass-Through Entities: University of Iowa (93.397) and NYU Grossman School of Medicine (93.838)Assistance Listing Nos.: 93.310, 93.394, 93.397 and 93.838Award Numbers: OD23121, CA212162, CA97274 and HL16847Award Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of the Uniform Guidance states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed:?When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with ? 200.319 or paragraph (c) of this section.?Section 200.320(c) of the Uniform Guidance states the following regarding noncompetitive procurement:?There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply:(1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (see paragraph (a)(1) of this section);(2) The item is available only from a single source;(3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation;(4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or(5) After solicitation of a number of sources, competition is determined inadequate.?Condition:Four federal procurements conducted in fiscal year 2022 in excess of the SAT of $250,000 were not competitively bid as required under Uniform Guidance Section 230.320(b) nor was a competitive bid exception documented to support the lack of formal proposals in accordance with Clinic procurement policies and procedures and Uniform Guidance Section 230.320(c). In addition, for one procurement, the Clinic did not timely document its independent suspension and debarment check at the time of procurement as required by its procurement justification form.Cause:While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic?s procurement, suspension and debarment policies and procedures, they are not robust enough to identify procurement transactions that are not in accordance with the Clinic?s policies and procedures.Effect or potential effect:The Clinic?s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to purchases in excess of the SAT.Questioned costs:$1,158,184:Assistance Listing No. 93.310, OD23121 ? $270,000Assistance Listing No. 93.394, CA212162 ? $254,125Assistance Listing No. 93.397, CA97274 ? $254,125Assistance Listing No. 93.838, HL16847 ? $379,934Context:We sampled 16 federal procurements over $25,000, totaling $2,839,288, from a population of 91 federal procurements over $25,000, totaling $7,490,915. For four of the 16 federal procurements tested totaling $1,158,184, the amount of the procurement exceeded the SAT of $250,000. Based on the Uniform Guidance and Clinic procurement policies, competitive proposals would be required; however, no competitive bidding was performed. For one of the 16 procurements tested totaling $257,100, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately seven months later.Procurement-related expenditures are approximately 7% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is not a repeat finding from the prior year.Recommendation:The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures and internal controls in order to comply with the Uniform Guidance procurement standards. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with Clinic documented policies, procedures and internal controls.Views of responsible officials:While Mayo Clinic Supply Chain Procurement processes include internal controls and procedures to review submission of Federal Funds documentation, enhanced controls will be evaluated to ensure compliance with competitive bid requirements. A review of risks will be completed with compensating controls added, as necessary.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.
Finding 2022-007 ? Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Internal Service Charges)Identification of the federal program:Federal Agency: U.S. Department of Health and Human ServicesPass-Through Entities: University of Iowa (Assistance Listing No. 93.397), Massachusetts General Hospital (Assistance Listing No. 93.853), and UCB Pharma, Inc. (Assistance Listing 93.866)Federal Cluster: Research and Development (R&D)Assistance Listing Nos.: 93.350, 93.393, 93.394, 93.395, 93.397, 93.837, 93.847, 93.853, and 93.866Award Numbers: VariousAward Periods: VariousCriteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Approval of allowability of internal service charges by the Principal Investigator (PI) or appropriate individual with authority on the grant was not consistently maintained at a transactional level during the fiscal year.Cause:While internal service charges are reviewed for allowability with federal regulations and the terms and conditions of the grant award on a monthly/quarterly basis by the PI as part of the grant?s financial statement review, evidence of the monthly/quarterly review by the PI and conclusions reached over allowability is not retained by the Clinic.Effect or potential effect:Internal service costs could be charged that are not allowable.Questioned costs:None.Context:For 35 of 40 internal service charges sampled totaling $14,322 and $22,180, respectively, there was insufficient evidence of review and approval of the costs to be charged to the research activity by the PI or authorized grant personnel at the time the cost was incurred.Internal service charges are $39,951,909, representing 9.4% of total Federal expenditures for the R&D Cluster of $425,554,624 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:The finding is a partial repeat of Finding 2021-001 in the prior year.Recommendation:The Clinic should retain sufficient evidence of the monthly/quarterly review of internal service charges by PIs and the related conclusions reached over allowability.Views of responsible officials:Approval of allowability of internal service charges by the PI or appropriate individual with authority on the grant at a transactional level is administratively burdensome. Requests for internal services are initiated by the PI or authorized grant personnel through a variety of internal service provider systems or intake methods which makes standardization across providers and service lines difficult. Further, the PI or authorized grant personnel review grant financial statements regularly to ensure charges to grants are appropriate and request corrections as needed.Management has implemented, and continues to reinforce, the corrective action plans developed following the completion of prior single audits. Management will consider alternative methods, which may include partnering with internal service providers, to ensure appropriate documentation for review and approval of charges is retained.