Audit 321761

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.

Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.