Audit 321602

Finding 2023-001 – Information Technology General Controls Identification of the federal program: Federal Program: Student Financial Assistance Cluster: Federal Pell Grant Program (Assistance Listing No. 84.063) and Federal Direct Student Loans (Assistance Listing No. 84.268) Federal Agency: United States Department of Education BJC HealthCare Location: Goldfarb School of Nursing (GSON) Award Periods: January 1, 2023 through June 30, 2023 (included in award year July 1, 2022 through June 30, 2023), and July 1, 2023 through December 31, 2023 (included in award year July 1, 2023 through June 30, 2024) Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding the auditee and internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: BJC HealthCare (BJC) did not fully implement all Logical Access and Change Management controls to support effective information technology general controls (ITGCs) for the Banner application. The controls that were not fully implemented during the current period relate to user provisioning, user termination, user access reviews and change management processes. As a result, Banner ITGCs and, therefore, Banner application controls, cannot be relied upon in the period of audit. Cause: Management did not appropriately implement Logical Access and Change Management controls for the period under audit. Effect or potential effect: There is a risk the data relevant to the Student Financial Assistance Cluster program stored within the Banner student financial aid system may be inappropriately created or modified. Effective testing of the required logical access controls is to support effective ITGCs over the Banner application. As a result, the Banner application cannot be relied on for the audit period. Questioned costs: None. Context: Procedures over the Banner application were performed during FY23 to determine if controls were in place and operating as designed. We noted the following: • User provisioning documentation was not consistently retained for three of four samples. Documentation for the fourth sample did not include enough information to support that the access requested is what was provisioned. • Access terminations were not consistently removed from the application timely, though active directory access was removed. • Through review of the semi-annual access review in September, the removals (or modifications) of six of six users were not completed following the conclusion of the user access review. a. The review is sent to each user and there is no overall, independent review of all user’s access by an overseer / manager. b. There was no review evidence for three of 44 accounts with access to Banner. • Documentation evidencing testing or approval for three of six patches applied to production was not retained or available. Total expenditures for the Student Financial Assistance Cluster were $6,709,387 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This is a partial repeat of finding 2022-002 from the prior year. Recommendation: Management should enhance the user access review, user provisioning, user termination and change management controls, and retain documentation of the operation of controls. Views of responsible officials: BJC agrees with the findings as reported. GSON is committed to complying with program requirements and meeting program objectives as defined in Section 200.303(a) of the Uniform Guidance, regarding auditee internal controls. To facilitate these requirements, GSON has instituted the following controls: • Establishment of a formal provisioning and deprovisioning process for Banner system access. • Refinements to formal access review process to include an independent review of system access, as well as an overseer or manager approval. • Establishment of a formal testing process for Banner system patches or updates to include review from key functional areas within GSON.

Finding 2023-001 – Information Technology General Controls Identification of the federal program: Federal Program: Student Financial Assistance Cluster: Federal Pell Grant Program (Assistance Listing No. 84.063) and Federal Direct Student Loans (Assistance Listing No. 84.268) Federal Agency: United States Department of Education BJC HealthCare Location: Goldfarb School of Nursing (GSON) Award Periods: January 1, 2023 through June 30, 2023 (included in award year July 1, 2022 through June 30, 2023), and July 1, 2023 through December 31, 2023 (included in award year July 1, 2023 through June 30, 2024) Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding the auditee and internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: BJC HealthCare (BJC) did not fully implement all Logical Access and Change Management controls to support effective information technology general controls (ITGCs) for the Banner application. The controls that were not fully implemented during the current period relate to user provisioning, user termination, user access reviews and change management processes. As a result, Banner ITGCs and, therefore, Banner application controls, cannot be relied upon in the period of audit. Cause: Management did not appropriately implement Logical Access and Change Management controls for the period under audit. Effect or potential effect: There is a risk the data relevant to the Student Financial Assistance Cluster program stored within the Banner student financial aid system may be inappropriately created or modified. Effective testing of the required logical access controls is to support effective ITGCs over the Banner application. As a result, the Banner application cannot be relied on for the audit period. Questioned costs: None. Context: Procedures over the Banner application were performed during FY23 to determine if controls were in place and operating as designed. We noted the following: • User provisioning documentation was not consistently retained for three of four samples. Documentation for the fourth sample did not include enough information to support that the access requested is what was provisioned. • Access terminations were not consistently removed from the application timely, though active directory access was removed. • Through review of the semi-annual access review in September, the removals (or modifications) of six of six users were not completed following the conclusion of the user access review. a. The review is sent to each user and there is no overall, independent review of all user’s access by an overseer / manager. b. There was no review evidence for three of 44 accounts with access to Banner. • Documentation evidencing testing or approval for three of six patches applied to production was not retained or available. Total expenditures for the Student Financial Assistance Cluster were $6,709,387 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This is a partial repeat of finding 2022-002 from the prior year. Recommendation: Management should enhance the user access review, user provisioning, user termination and change management controls, and retain documentation of the operation of controls. Views of responsible officials: BJC agrees with the findings as reported. GSON is committed to complying with program requirements and meeting program objectives as defined in Section 200.303(a) of the Uniform Guidance, regarding auditee internal controls. To facilitate these requirements, GSON has instituted the following controls: • Establishment of a formal provisioning and deprovisioning process for Banner system access. • Refinements to formal access review process to include an independent review of system access, as well as an overseer or manager approval. • Establishment of a formal testing process for Banner system patches or updates to include review from key functional areas within GSON.

Finding 2023-003 – A. Activities Allowed or Unallowed, B. Allowable Costs/Cost Principles, and H. Period of Performance Identification of the federal program: Federal Agency: U.S. Department of Health and Human Services Federal Program: Research and Development Cluster (Assistance Listing Nos. 93.395 and 93.399) BJC HealthCare Location: Missouri Baptist Medical Center Pass-Through Entities and Award Numbers: Pass-Through Award Periods: Brigham and Women’s Hospital, Inc./120870 (Amendment 1) Brigham and Women’s Hospital, Inc./120870 03/01/2023–02/29/2024 03/01/2022–02/28/2023 Decatur Memorial Hospital/None 08/01/2022–07/31/2023; 08/01/2023–07/31/2024 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Management reviews and approves Effort Certification Reports (ECRs) for allowability and period of performance, including determining whether adjustments were required and appropriate. Evidence of review and approval was not consistently retained for ECRs. Cause: Due to employee turnover, evidence of review and approval over the ECRs by the appropriate Grant Management Office personnel was not consistently retained during the fiscal year. Effect or potential effect: Unallowable expenses could be charged to the Research and Development Cluster program. Questioned costs: None. Context: Total Research and Development Cluster expenditures reported on the schedule of expenditures of federal awards are $1,125,092 for the year ended December 31, 2023. Of this amount, payroll costs totaled $666,648 and fringe benefit costs totaled $184,759. Identification as a repeat finding: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure that established internal controls over the review and approval of effort reports are consistently followed. Views of responsible officials: BJC agrees with the findings as reported. BJC is committed to complying with program requirements and meeting program objectives as defined in Section 200.303(a) of the Uniform Guidance, regarding auditee internal controls. To facilitate these requirements, BJC will review and strengthen current controls and documentation to ensure that all ECRs are appropriately approved and documentation of the approval is retained.

Finding 2023-003 – A. Activities Allowed or Unallowed, B. Allowable Costs/Cost Principles, and H. Period of Performance Identification of the federal program: Federal Agency: U.S. Department of Health and Human Services Federal Program: Research and Development Cluster (Assistance Listing Nos. 93.395 and 93.399) BJC HealthCare Location: Missouri Baptist Medical Center Pass-Through Entities and Award Numbers: Pass-Through Award Periods: Brigham and Women’s Hospital, Inc./120870 (Amendment 1) Brigham and Women’s Hospital, Inc./120870 03/01/2023–02/29/2024 03/01/2022–02/28/2023 Decatur Memorial Hospital/None 08/01/2022–07/31/2023; 08/01/2023–07/31/2024 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Management reviews and approves Effort Certification Reports (ECRs) for allowability and period of performance, including determining whether adjustments were required and appropriate. Evidence of review and approval was not consistently retained for ECRs. Cause: Due to employee turnover, evidence of review and approval over the ECRs by the appropriate Grant Management Office personnel was not consistently retained during the fiscal year. Effect or potential effect: Unallowable expenses could be charged to the Research and Development Cluster program. Questioned costs: None. Context: Total Research and Development Cluster expenditures reported on the schedule of expenditures of federal awards are $1,125,092 for the year ended December 31, 2023. Of this amount, payroll costs totaled $666,648 and fringe benefit costs totaled $184,759. Identification as a repeat finding: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure that established internal controls over the review and approval of effort reports are consistently followed. Views of responsible officials: BJC agrees with the findings as reported. BJC is committed to complying with program requirements and meeting program objectives as defined in Section 200.303(a) of the Uniform Guidance, regarding auditee internal controls. To facilitate these requirements, BJC will review and strengthen current controls and documentation to ensure that all ECRs are appropriately approved and documentation of the approval is retained.

Finding 2023-002 – A. Activities Allowed or Unallowed, B. Allowable Costs/Cost Principles, H. Period of Performance and N. Special Tests and Provisions Identification of the federal program: Federal Agency: U.S. Department of Homeland Security, Federal Emergency Management Agency (FEMA) Pass-Through Entities: Missouri State Emergency Management Agency and Illinois Emergency Management Agency Federal Program: COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (Assistance Listing No. 97.036) Pass-Through Award Numbers: Pass-Through Award Periods: PA-05-IL-4489-PW-1324(1) 01/21/2020–Ongoing PA-07-MO-4490-PW-00750 04/01/2021–07/01/2022 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Management reviewed a sample of FEMA expenses during the fiscal year for compliance with allowability, period of performance, and special tests and provisions requirements. However, the review did not ensure that invoices allocated between multiple project worksheets did not exceed claim in total for management costs. In addition, for materials and supplies costs, the review was not performed timely as it was completed four months after the claim was submitted. Cause: Management’s internal control over the review and approval of FEMA expenses (materials and supplies and management costs) for compliance with allowability, period of performance, and special tests and provisions requirements was not properly designed or operating effectively. Effect or potential effect: Unallowable expenses could be charged to the FEMA program. Questioned costs: None. Context: Total FEMA expenditures reported on the schedule of expenditures of federal awards are $3,503,825 for the year ended December 31, 2023. Of this amount, management costs totaled $11,205 and materials and supplies costs totaled $682,254. Identification as a repeat finding: This finding is a partial repeat of finding 2022-004 from the prior year. Recommendation: Management should reassess its internal controls over the review and approval of FEMA expenses for compliance with allowability, period of performance, and special tests and provisions requirements. Views of responsible officials: BJC agrees with the findings as reported. BJC is committed to complying with program requirements and meeting program objectives as defined in Section 200.303(a) of the Uniform Guidance, regarding auditee internal controls. To facilitate these requirements, BJC will review and strengthen controls and documentation to ensure that invoices allocated between multiple project worksheets do not exceed amount claimed in total for management costs. In addition, BJC will ensure reviews are performed timely.

Finding 2023-002 – A. Activities Allowed or Unallowed, B. Allowable Costs/Cost Principles, H. Period of Performance and N. Special Tests and Provisions Identification of the federal program: Federal Agency: U.S. Department of Homeland Security, Federal Emergency Management Agency (FEMA) Pass-Through Entities: Missouri State Emergency Management Agency and Illinois Emergency Management Agency Federal Program: COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (Assistance Listing No. 97.036) Pass-Through Award Numbers: Pass-Through Award Periods: PA-05-IL-4489-PW-1324(1) 01/21/2020–Ongoing PA-07-MO-4490-PW-00750 04/01/2021–07/01/2022 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Management reviewed a sample of FEMA expenses during the fiscal year for compliance with allowability, period of performance, and special tests and provisions requirements. However, the review did not ensure that invoices allocated between multiple project worksheets did not exceed claim in total for management costs. In addition, for materials and supplies costs, the review was not performed timely as it was completed four months after the claim was submitted. Cause: Management’s internal control over the review and approval of FEMA expenses (materials and supplies and management costs) for compliance with allowability, period of performance, and special tests and provisions requirements was not properly designed or operating effectively. Effect or potential effect: Unallowable expenses could be charged to the FEMA program. Questioned costs: None. Context: Total FEMA expenditures reported on the schedule of expenditures of federal awards are $3,503,825 for the year ended December 31, 2023. Of this amount, management costs totaled $11,205 and materials and supplies costs totaled $682,254. Identification as a repeat finding: This finding is a partial repeat of finding 2022-004 from the prior year. Recommendation: Management should reassess its internal controls over the review and approval of FEMA expenses for compliance with allowability, period of performance, and special tests and provisions requirements. Views of responsible officials: BJC agrees with the findings as reported. BJC is committed to complying with program requirements and meeting program objectives as defined in Section 200.303(a) of the Uniform Guidance, regarding auditee internal controls. To facilitate these requirements, BJC will review and strengthen controls and documentation to ensure that invoices allocated between multiple project worksheets do not exceed amount claimed in total for management costs. In addition, BJC will ensure reviews are performed timely.

Finding 2023-001 – Information Technology General Controls Identification of the federal program: Federal Program: Student Financial Assistance Cluster: Federal Pell Grant Program (Assistance Listing No. 84.063) and Federal Direct Student Loans (Assistance Listing No. 84.268) Federal Agency: United States Department of Education BJC HealthCare Location: Goldfarb School of Nursing (GSON) Award Periods: January 1, 2023 through June 30, 2023 (included in award year July 1, 2022 through June 30, 2023), and July 1, 2023 through December 31, 2023 (included in award year July 1, 2023 through June 30, 2024) Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding the auditee and internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: BJC HealthCare (BJC) did not fully implement all Logical Access and Change Management controls to support effective information technology general controls (ITGCs) for the Banner application. The controls that were not fully implemented during the current period relate to user provisioning, user termination, user access reviews and change management processes. As a result, Banner ITGCs and, therefore, Banner application controls, cannot be relied upon in the period of audit. Cause: Management did not appropriately implement Logical Access and Change Management controls for the period under audit. Effect or potential effect: There is a risk the data relevant to the Student Financial Assistance Cluster program stored within the Banner student financial aid system may be inappropriately created or modified. Effective testing of the required logical access controls is to support effective ITGCs over the Banner application. As a result, the Banner application cannot be relied on for the audit period. Questioned costs: None. Context: Procedures over the Banner application were performed during FY23 to determine if controls were in place and operating as designed. We noted the following: • User provisioning documentation was not consistently retained for three of four samples. Documentation for the fourth sample did not include enough information to support that the access requested is what was provisioned. • Access terminations were not consistently removed from the application timely, though active directory access was removed. • Through review of the semi-annual access review in September, the removals (or modifications) of six of six users were not completed following the conclusion of the user access review. a. The review is sent to each user and there is no overall, independent review of all user’s access by an overseer / manager. b. There was no review evidence for three of 44 accounts with access to Banner. • Documentation evidencing testing or approval for three of six patches applied to production was not retained or available. Total expenditures for the Student Financial Assistance Cluster were $6,709,387 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This is a partial repeat of finding 2022-002 from the prior year. Recommendation: Management should enhance the user access review, user provisioning, user termination and change management controls, and retain documentation of the operation of controls. Views of responsible officials: BJC agrees with the findings as reported. GSON is committed to complying with program requirements and meeting program objectives as defined in Section 200.303(a) of the Uniform Guidance, regarding auditee internal controls. To facilitate these requirements, GSON has instituted the following controls: • Establishment of a formal provisioning and deprovisioning process for Banner system access. • Refinements to formal access review process to include an independent review of system access, as well as an overseer or manager approval. • Establishment of a formal testing process for Banner system patches or updates to include review from key functional areas within GSON.

Finding 2023-001 – Information Technology General Controls Identification of the federal program: Federal Program: Student Financial Assistance Cluster: Federal Pell Grant Program (Assistance Listing No. 84.063) and Federal Direct Student Loans (Assistance Listing No. 84.268) Federal Agency: United States Department of Education BJC HealthCare Location: Goldfarb School of Nursing (GSON) Award Periods: January 1, 2023 through June 30, 2023 (included in award year July 1, 2022 through June 30, 2023), and July 1, 2023 through December 31, 2023 (included in award year July 1, 2023 through June 30, 2024) Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding the auditee and internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: BJC HealthCare (BJC) did not fully implement all Logical Access and Change Management controls to support effective information technology general controls (ITGCs) for the Banner application. The controls that were not fully implemented during the current period relate to user provisioning, user termination, user access reviews and change management processes. As a result, Banner ITGCs and, therefore, Banner application controls, cannot be relied upon in the period of audit. Cause: Management did not appropriately implement Logical Access and Change Management controls for the period under audit. Effect or potential effect: There is a risk the data relevant to the Student Financial Assistance Cluster program stored within the Banner student financial aid system may be inappropriately created or modified. Effective testing of the required logical access controls is to support effective ITGCs over the Banner application. As a result, the Banner application cannot be relied on for the audit period. Questioned costs: None. Context: Procedures over the Banner application were performed during FY23 to determine if controls were in place and operating as designed. We noted the following: • User provisioning documentation was not consistently retained for three of four samples. Documentation for the fourth sample did not include enough information to support that the access requested is what was provisioned. • Access terminations were not consistently removed from the application timely, though active directory access was removed. • Through review of the semi-annual access review in September, the removals (or modifications) of six of six users were not completed following the conclusion of the user access review. a. The review is sent to each user and there is no overall, independent review of all user’s access by an overseer / manager. b. There was no review evidence for three of 44 accounts with access to Banner. • Documentation evidencing testing or approval for three of six patches applied to production was not retained or available. Total expenditures for the Student Financial Assistance Cluster were $6,709,387 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: This is a partial repeat of finding 2022-002 from the prior year. Recommendation: Management should enhance the user access review, user provisioning, user termination and change management controls, and retain documentation of the operation of controls. Views of responsible officials: BJC agrees with the findings as reported. GSON is committed to complying with program requirements and meeting program objectives as defined in Section 200.303(a) of the Uniform Guidance, regarding auditee internal controls. To facilitate these requirements, GSON has instituted the following controls: • Establishment of a formal provisioning and deprovisioning process for Banner system access. • Refinements to formal access review process to include an independent review of system access, as well as an overseer or manager approval. • Establishment of a formal testing process for Banner system patches or updates to include review from key functional areas within GSON.

Finding 2023-003 – A. Activities Allowed or Unallowed, B. Allowable Costs/Cost Principles, and H. Period of Performance Identification of the federal program: Federal Agency: U.S. Department of Health and Human Services Federal Program: Research and Development Cluster (Assistance Listing Nos. 93.395 and 93.399) BJC HealthCare Location: Missouri Baptist Medical Center Pass-Through Entities and Award Numbers: Pass-Through Award Periods: Brigham and Women’s Hospital, Inc./120870 (Amendment 1) Brigham and Women’s Hospital, Inc./120870 03/01/2023–02/29/2024 03/01/2022–02/28/2023 Decatur Memorial Hospital/None 08/01/2022–07/31/2023; 08/01/2023–07/31/2024 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Management reviews and approves Effort Certification Reports (ECRs) for allowability and period of performance, including determining whether adjustments were required and appropriate. Evidence of review and approval was not consistently retained for ECRs. Cause: Due to employee turnover, evidence of review and approval over the ECRs by the appropriate Grant Management Office personnel was not consistently retained during the fiscal year. Effect or potential effect: Unallowable expenses could be charged to the Research and Development Cluster program. Questioned costs: None. Context: Total Research and Development Cluster expenditures reported on the schedule of expenditures of federal awards are $1,125,092 for the year ended December 31, 2023. Of this amount, payroll costs totaled $666,648 and fringe benefit costs totaled $184,759. Identification as a repeat finding: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure that established internal controls over the review and approval of effort reports are consistently followed. Views of responsible officials: BJC agrees with the findings as reported. BJC is committed to complying with program requirements and meeting program objectives as defined in Section 200.303(a) of the Uniform Guidance, regarding auditee internal controls. To facilitate these requirements, BJC will review and strengthen current controls and documentation to ensure that all ECRs are appropriately approved and documentation of the approval is retained.

Finding 2023-003 – A. Activities Allowed or Unallowed, B. Allowable Costs/Cost Principles, and H. Period of Performance Identification of the federal program: Federal Agency: U.S. Department of Health and Human Services Federal Program: Research and Development Cluster (Assistance Listing Nos. 93.395 and 93.399) BJC HealthCare Location: Missouri Baptist Medical Center Pass-Through Entities and Award Numbers: Pass-Through Award Periods: Brigham and Women’s Hospital, Inc./120870 (Amendment 1) Brigham and Women’s Hospital, Inc./120870 03/01/2023–02/29/2024 03/01/2022–02/28/2023 Decatur Memorial Hospital/None 08/01/2022–07/31/2023; 08/01/2023–07/31/2024 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Management reviews and approves Effort Certification Reports (ECRs) for allowability and period of performance, including determining whether adjustments were required and appropriate. Evidence of review and approval was not consistently retained for ECRs. Cause: Due to employee turnover, evidence of review and approval over the ECRs by the appropriate Grant Management Office personnel was not consistently retained during the fiscal year. Effect or potential effect: Unallowable expenses could be charged to the Research and Development Cluster program. Questioned costs: None. Context: Total Research and Development Cluster expenditures reported on the schedule of expenditures of federal awards are $1,125,092 for the year ended December 31, 2023. Of this amount, payroll costs totaled $666,648 and fringe benefit costs totaled $184,759. Identification as a repeat finding: This finding is not a repeat finding from the prior year. Recommendation: Management should ensure that established internal controls over the review and approval of effort reports are consistently followed. Views of responsible officials: BJC agrees with the findings as reported. BJC is committed to complying with program requirements and meeting program objectives as defined in Section 200.303(a) of the Uniform Guidance, regarding auditee internal controls. To facilitate these requirements, BJC will review and strengthen current controls and documentation to ensure that all ECRs are appropriately approved and documentation of the approval is retained.

Finding 2023-002 – A. Activities Allowed or Unallowed, B. Allowable Costs/Cost Principles, H. Period of Performance and N. Special Tests and Provisions Identification of the federal program: Federal Agency: U.S. Department of Homeland Security, Federal Emergency Management Agency (FEMA) Pass-Through Entities: Missouri State Emergency Management Agency and Illinois Emergency Management Agency Federal Program: COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (Assistance Listing No. 97.036) Pass-Through Award Numbers: Pass-Through Award Periods: PA-05-IL-4489-PW-1324(1) 01/21/2020–Ongoing PA-07-MO-4490-PW-00750 04/01/2021–07/01/2022 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Management reviewed a sample of FEMA expenses during the fiscal year for compliance with allowability, period of performance, and special tests and provisions requirements. However, the review did not ensure that invoices allocated between multiple project worksheets did not exceed claim in total for management costs. In addition, for materials and supplies costs, the review was not performed timely as it was completed four months after the claim was submitted. Cause: Management’s internal control over the review and approval of FEMA expenses (materials and supplies and management costs) for compliance with allowability, period of performance, and special tests and provisions requirements was not properly designed or operating effectively. Effect or potential effect: Unallowable expenses could be charged to the FEMA program. Questioned costs: None. Context: Total FEMA expenditures reported on the schedule of expenditures of federal awards are $3,503,825 for the year ended December 31, 2023. Of this amount, management costs totaled $11,205 and materials and supplies costs totaled $682,254. Identification as a repeat finding: This finding is a partial repeat of finding 2022-004 from the prior year. Recommendation: Management should reassess its internal controls over the review and approval of FEMA expenses for compliance with allowability, period of performance, and special tests and provisions requirements. Views of responsible officials: BJC agrees with the findings as reported. BJC is committed to complying with program requirements and meeting program objectives as defined in Section 200.303(a) of the Uniform Guidance, regarding auditee internal controls. To facilitate these requirements, BJC will review and strengthen controls and documentation to ensure that invoices allocated between multiple project worksheets do not exceed amount claimed in total for management costs. In addition, BJC will ensure reviews are performed timely.

Finding 2023-002 – A. Activities Allowed or Unallowed, B. Allowable Costs/Cost Principles, H. Period of Performance and N. Special Tests and Provisions Identification of the federal program: Federal Agency: U.S. Department of Homeland Security, Federal Emergency Management Agency (FEMA) Pass-Through Entities: Missouri State Emergency Management Agency and Illinois Emergency Management Agency Federal Program: COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (Assistance Listing No. 97.036) Pass-Through Award Numbers: Pass-Through Award Periods: PA-05-IL-4489-PW-1324(1) 01/21/2020–Ongoing PA-07-MO-4490-PW-00750 04/01/2021–07/01/2022 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Management reviewed a sample of FEMA expenses during the fiscal year for compliance with allowability, period of performance, and special tests and provisions requirements. However, the review did not ensure that invoices allocated between multiple project worksheets did not exceed claim in total for management costs. In addition, for materials and supplies costs, the review was not performed timely as it was completed four months after the claim was submitted. Cause: Management’s internal control over the review and approval of FEMA expenses (materials and supplies and management costs) for compliance with allowability, period of performance, and special tests and provisions requirements was not properly designed or operating effectively. Effect or potential effect: Unallowable expenses could be charged to the FEMA program. Questioned costs: None. Context: Total FEMA expenditures reported on the schedule of expenditures of federal awards are $3,503,825 for the year ended December 31, 2023. Of this amount, management costs totaled $11,205 and materials and supplies costs totaled $682,254. Identification as a repeat finding: This finding is a partial repeat of finding 2022-004 from the prior year. Recommendation: Management should reassess its internal controls over the review and approval of FEMA expenses for compliance with allowability, period of performance, and special tests and provisions requirements. Views of responsible officials: BJC agrees with the findings as reported. BJC is committed to complying with program requirements and meeting program objectives as defined in Section 200.303(a) of the Uniform Guidance, regarding auditee internal controls. To facilitate these requirements, BJC will review and strengthen controls and documentation to ensure that invoices allocated between multiple project worksheets do not exceed amount claimed in total for management costs. In addition, BJC will ensure reviews are performed timely.