Audit 321440

Identification of the federal program: Federal Grantor: U.S. Department of Homeland Security Assistance Listing No.: 97.036 COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Award Period of Performance: January 1, 2020 – July 1, 2022 Criteria or Specific Requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Per discussion with management, San Antonio Regional Hospital (the Hospital) had processes and internal controls in place to review and approve FEMA expenditures submitted to the FEMA Portal. However, management did not consistently retain documentation to evidence the performance of these controls. Cause: Management represented they reviewed and approved the FEMA expenditures; however, supporting documentation to evidence the review and approval was not maintained. Effect or potential effect: A lack of internal controls over the review and approval of FEMA expenditures could result in unallowable expenses being charged to the federal program. Questioned Costs: None. Context: During our testing over the two FEMA projects in 2023, we observed that management did not retain evidence of controls surrounding the review and approval over the expenses submitted to FEMA. Total federal expenditures for Assistance Listing No. 97.036 totaled $3,463,657. Identification as a repeat finding, if applicable: Not applicable Recommendation: The Hospital should refine its process and retain documentation to evidence management’s internal controls in place to review and approve FEMA expenditures submitted to the FEMA Portal. View of Responsible Officials: The Hospital agrees with the finding and will implement procedures to ensure control documentation is retained.

Identification of the federal program: Federal Grantor: U.S. Department of Homeland Security Assistance Listing No.: 97.036 COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Award Period of Performance: January 1, 2020 – July 1, 2022 Criteria or Specific Requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Per discussion with management, San Antonio Regional Hospital (the Hospital) had processes and internal controls in place to review and approve FEMA expenditures submitted to the FEMA Portal. However, management did not consistently retain documentation to evidence the performance of these controls. Cause: Management represented they reviewed and approved the FEMA expenditures; however, supporting documentation to evidence the review and approval was not maintained. Effect or potential effect: A lack of internal controls over the review and approval of FEMA expenditures could result in unallowable expenses being charged to the federal program. Questioned Costs: None. Context: During our testing over the two FEMA projects in 2023, we observed that management did not retain evidence of controls surrounding the review and approval over the expenses submitted to FEMA. Total federal expenditures for Assistance Listing No. 97.036 totaled $3,463,657. Identification as a repeat finding, if applicable: Not applicable Recommendation: The Hospital should refine its process and retain documentation to evidence management’s internal controls in place to review and approve FEMA expenditures submitted to the FEMA Portal. View of Responsible Officials: The Hospital agrees with the finding and will implement procedures to ensure control documentation is retained.

Identification of the federal program: Federal Grantor: U.S. Department of Homeland Security Assistance Listing No.: 97.036 COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Award Period of Performance: January 1, 2020 – July 1, 2022 Criteria or Specific Requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Per discussion with management, San Antonio Regional Hospital (the Hospital) had processes and internal controls in place to review and approve FEMA expenditures submitted to the FEMA Portal. However, management did not consistently retain documentation to evidence the performance of these controls. Cause: Management represented they reviewed and approved the FEMA expenditures; however, supporting documentation to evidence the review and approval was not maintained. Effect or potential effect: A lack of internal controls over the review and approval of FEMA expenditures could result in unallowable expenses being charged to the federal program. Questioned Costs: None. Context: During our testing over the two FEMA projects in 2023, we observed that management did not retain evidence of controls surrounding the review and approval over the expenses submitted to FEMA. Total federal expenditures for Assistance Listing No. 97.036 totaled $3,463,657. Identification as a repeat finding, if applicable: Not applicable Recommendation: The Hospital should refine its process and retain documentation to evidence management’s internal controls in place to review and approve FEMA expenditures submitted to the FEMA Portal. View of Responsible Officials: The Hospital agrees with the finding and will implement procedures to ensure control documentation is retained.

Identification of the federal program: Federal Grantor: U.S. Department of Homeland Security Assistance Listing No.: 97.036 COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Award Period of Performance: January 1, 2020 – July 1, 2022 Criteria or Specific Requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Per discussion with management, San Antonio Regional Hospital (the Hospital) had processes and internal controls in place to review and approve FEMA expenditures submitted to the FEMA Portal. However, management did not consistently retain documentation to evidence the performance of these controls. Cause: Management represented they reviewed and approved the FEMA expenditures; however, supporting documentation to evidence the review and approval was not maintained. Effect or potential effect: A lack of internal controls over the review and approval of FEMA expenditures could result in unallowable expenses being charged to the federal program. Questioned Costs: None. Context: During our testing over the two FEMA projects in 2023, we observed that management did not retain evidence of controls surrounding the review and approval over the expenses submitted to FEMA. Total federal expenditures for Assistance Listing No. 97.036 totaled $3,463,657. Identification as a repeat finding, if applicable: Not applicable Recommendation: The Hospital should refine its process and retain documentation to evidence management’s internal controls in place to review and approve FEMA expenditures submitted to the FEMA Portal. View of Responsible Officials: The Hospital agrees with the finding and will implement procedures to ensure control documentation is retained.