Audit 321903

Finding 2023-002 - Reporting: Federal Funding Accountability and Transparency Act ("FFATA") – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria 1. In accordance with 2 CFR Section 200.303, Internal controls, the non-Federal entity must: (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2. Under the requirements of the FFATA (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, that are codified in 2 CFR Part 170, prime recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The prime recipient is required to file a FFATA sub-award report by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. Condition 1. During our audit, we noted there was no evidence of review and approval by someone other than the preparer of the FFATA subawards that were submitted to the FSRS. 2. During our audit, we noted the FFATA subawards were not submitted timely to the FSRS. Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 4 4 4 0 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $6,845,844 $6,845,844 $6,845,844 $0 $0 Cause 1. There is no formal policy in place requiring the CFO (or designee) to review and approve the FFATA reports before submission to the FSRS. 2. As a result of personnel changes within the finance department, the FFATA reporting was not done timely. Effect or Potential Effect 1. The condition could result in key data elements inaccurately reported and/or not supported by the source documentation. 2. The FFATA subawards were not submitted timely to the FSRS. Questioned Costs None. Context Four exceptions from a statistically valid sample of four. Identification as Repeat Finding 1. No 2. Yes (see prior year finding number 2022-001) Recommendation 1. We recommend that all FFATA reports be reviewed and approved by the CFO or designee and evidence of approval be maintained. 2. We recommend that management create an e-mail reminder or other alert mechanism and implement controls to ensure compliance with the reporting requirements under FFATA. Views of Responsible Officials As of September 1, 2023, BCHN implemented a workflow where FFATA information will be reported to the FSRS upon receipt of the Notices of Award. In addition, as of September 9, 2024, the FFATA report will be reviewed by someone other than the preparer prior to submission and evidence of the approval maintained.

Finding 2023-003 - Procurement and Suspension and Debarment – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria In accordance with 2 CFR 200.214, nonfederal entities are subject to the nonprocurement debarment and suspension regulations. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in federal assistance programs or activities. Condition During our audit, we noted that BCHN did not perform a timely check at the System for Award Management Exclusions (sam.gov) to verify whether an employee or a vendor had been suspended or debarred before being hired. Cause There is no formal policy in place requiring a check to be performed at sam.gov for prospective employees and vendors. Effect or Potential Effect The condition could result in employees or vendors who are suspended or debarred receiving federal funds. Questioned Costs None. Context Seven exceptions from a statistically valid sample of seven. Identification as Repeat Finding No. Recommendation We recommend Human Resources (HR) personnel/management perform a check at sam.gov prior to the hire of an employee or vendor to ensure the employee or vendor was not suspended or debarred and retain evidence of that verification. We also recommend a check at sam.gov be done annually thereafter and evidence of that verification be maintained. Views of Responsible Officials BCHN will check sam.gov and the Office of Inspector General, to screen all potential employees, contractors/consultants, and vendors, prior to the commencement of their affiliation with BCHN and maintain evidence of the results. BCHN will also screen all employees, contractors, consultants, and vendors on an annual basis thereafter and maintain evidence of the results.

Finding 2023-004 - Activities Allowed or Unallowed and Allowable Costs/Cost Principles – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria In accordance with 2 CFR Section 200.303, Internal controls, the non-Federal entity must: (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our audit, we noted that there was no evidence, such as a signature, evidencing review and approval by a direct supervisor of the timesheets and time and effort reports. Cause There is no formal policy requiring timesheets and time and effort reports be approved by a direct supervisor and evidence of approval retained. Effect or Potential Effect The condition could result in inaccuracies in the allocation of salaries to the federal grants. Questioned Costs None. Context Two exceptions from a statistically valid sample of two. Identification as Repeat Finding No. Recommendation We recommend that management put in place a formal policy requiring all timesheets and time and effort reports be approved by a direct supervisor and that evidence of that approval be retained. Views of Responsible Officials Effective immediately, a time and effort reporting policy was implemented and sent to all staff to ensure that staff follow the process. This policy will be reviewed with all new staff during new hire orientation and annually. Timesheets will be reviewed and approved by direct supervisors on a weekly basis. HR will send a reminder to all staff on a weekly basis to complete all missing time worked. Employees are responsible for updating the timesheet for each work week in Paylocity. HR will provide a monthly time and effort report to the finance team. This report will provide total number of hours worked by each employee for each assigned cost center.

Finding 2023-002 - Reporting: Federal Funding Accountability and Transparency Act ("FFATA") – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria 1. In accordance with 2 CFR Section 200.303, Internal controls, the non-Federal entity must: (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2. Under the requirements of the FFATA (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, that are codified in 2 CFR Part 170, prime recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The prime recipient is required to file a FFATA sub-award report by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. Condition 1. During our audit, we noted there was no evidence of review and approval by someone other than the preparer of the FFATA subawards that were submitted to the FSRS. 2. During our audit, we noted the FFATA subawards were not submitted timely to the FSRS. Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 4 4 4 0 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $6,845,844 $6,845,844 $6,845,844 $0 $0 Cause 1. There is no formal policy in place requiring the CFO (or designee) to review and approve the FFATA reports before submission to the FSRS. 2. As a result of personnel changes within the finance department, the FFATA reporting was not done timely. Effect or Potential Effect 1. The condition could result in key data elements inaccurately reported and/or not supported by the source documentation. 2. The FFATA subawards were not submitted timely to the FSRS. Questioned Costs None. Context Four exceptions from a statistically valid sample of four. Identification as Repeat Finding 1. No 2. Yes (see prior year finding number 2022-001) Recommendation 1. We recommend that all FFATA reports be reviewed and approved by the CFO or designee and evidence of approval be maintained. 2. We recommend that management create an e-mail reminder or other alert mechanism and implement controls to ensure compliance with the reporting requirements under FFATA. Views of Responsible Officials As of September 1, 2023, BCHN implemented a workflow where FFATA information will be reported to the FSRS upon receipt of the Notices of Award. In addition, as of September 9, 2024, the FFATA report will be reviewed by someone other than the preparer prior to submission and evidence of the approval maintained.

Finding 2023-003 - Procurement and Suspension and Debarment – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria In accordance with 2 CFR 200.214, nonfederal entities are subject to the nonprocurement debarment and suspension regulations. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in federal assistance programs or activities. Condition During our audit, we noted that BCHN did not perform a timely check at the System for Award Management Exclusions (sam.gov) to verify whether an employee or a vendor had been suspended or debarred before being hired. Cause There is no formal policy in place requiring a check to be performed at sam.gov for prospective employees and vendors. Effect or Potential Effect The condition could result in employees or vendors who are suspended or debarred receiving federal funds. Questioned Costs None. Context Seven exceptions from a statistically valid sample of seven. Identification as Repeat Finding No. Recommendation We recommend Human Resources (HR) personnel/management perform a check at sam.gov prior to the hire of an employee or vendor to ensure the employee or vendor was not suspended or debarred and retain evidence of that verification. We also recommend a check at sam.gov be done annually thereafter and evidence of that verification be maintained. Views of Responsible Officials BCHN will check sam.gov and the Office of Inspector General, to screen all potential employees, contractors/consultants, and vendors, prior to the commencement of their affiliation with BCHN and maintain evidence of the results. BCHN will also screen all employees, contractors, consultants, and vendors on an annual basis thereafter and maintain evidence of the results.

Finding 2023-004 - Activities Allowed or Unallowed and Allowable Costs/Cost Principles – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria In accordance with 2 CFR Section 200.303, Internal controls, the non-Federal entity must: (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our audit, we noted that there was no evidence, such as a signature, evidencing review and approval by a direct supervisor of the timesheets and time and effort reports. Cause There is no formal policy requiring timesheets and time and effort reports be approved by a direct supervisor and evidence of approval retained. Effect or Potential Effect The condition could result in inaccuracies in the allocation of salaries to the federal grants. Questioned Costs None. Context Two exceptions from a statistically valid sample of two. Identification as Repeat Finding No. Recommendation We recommend that management put in place a formal policy requiring all timesheets and time and effort reports be approved by a direct supervisor and that evidence of that approval be retained. Views of Responsible Officials Effective immediately, a time and effort reporting policy was implemented and sent to all staff to ensure that staff follow the process. This policy will be reviewed with all new staff during new hire orientation and annually. Timesheets will be reviewed and approved by direct supervisors on a weekly basis. HR will send a reminder to all staff on a weekly basis to complete all missing time worked. Employees are responsible for updating the timesheet for each work week in Paylocity. HR will provide a monthly time and effort report to the finance team. This report will provide total number of hours worked by each employee for each assigned cost center.

Finding 2023-002 - Reporting: Federal Funding Accountability and Transparency Act ("FFATA") – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria 1. In accordance with 2 CFR Section 200.303, Internal controls, the non-Federal entity must: (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2. Under the requirements of the FFATA (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, that are codified in 2 CFR Part 170, prime recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The prime recipient is required to file a FFATA sub-award report by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. Condition 1. During our audit, we noted there was no evidence of review and approval by someone other than the preparer of the FFATA subawards that were submitted to the FSRS. 2. During our audit, we noted the FFATA subawards were not submitted timely to the FSRS. Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 4 4 4 0 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $6,845,844 $6,845,844 $6,845,844 $0 $0 Cause 1. There is no formal policy in place requiring the CFO (or designee) to review and approve the FFATA reports before submission to the FSRS. 2. As a result of personnel changes within the finance department, the FFATA reporting was not done timely. Effect or Potential Effect 1. The condition could result in key data elements inaccurately reported and/or not supported by the source documentation. 2. The FFATA subawards were not submitted timely to the FSRS. Questioned Costs None. Context Four exceptions from a statistically valid sample of four. Identification as Repeat Finding 1. No 2. Yes (see prior year finding number 2022-001) Recommendation 1. We recommend that all FFATA reports be reviewed and approved by the CFO or designee and evidence of approval be maintained. 2. We recommend that management create an e-mail reminder or other alert mechanism and implement controls to ensure compliance with the reporting requirements under FFATA. Views of Responsible Officials As of September 1, 2023, BCHN implemented a workflow where FFATA information will be reported to the FSRS upon receipt of the Notices of Award. In addition, as of September 9, 2024, the FFATA report will be reviewed by someone other than the preparer prior to submission and evidence of the approval maintained.

Finding 2023-003 - Procurement and Suspension and Debarment – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria In accordance with 2 CFR 200.214, nonfederal entities are subject to the nonprocurement debarment and suspension regulations. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in federal assistance programs or activities. Condition During our audit, we noted that BCHN did not perform a timely check at the System for Award Management Exclusions (sam.gov) to verify whether an employee or a vendor had been suspended or debarred before being hired. Cause There is no formal policy in place requiring a check to be performed at sam.gov for prospective employees and vendors. Effect or Potential Effect The condition could result in employees or vendors who are suspended or debarred receiving federal funds. Questioned Costs None. Context Seven exceptions from a statistically valid sample of seven. Identification as Repeat Finding No. Recommendation We recommend Human Resources (HR) personnel/management perform a check at sam.gov prior to the hire of an employee or vendor to ensure the employee or vendor was not suspended or debarred and retain evidence of that verification. We also recommend a check at sam.gov be done annually thereafter and evidence of that verification be maintained. Views of Responsible Officials BCHN will check sam.gov and the Office of Inspector General, to screen all potential employees, contractors/consultants, and vendors, prior to the commencement of their affiliation with BCHN and maintain evidence of the results. BCHN will also screen all employees, contractors, consultants, and vendors on an annual basis thereafter and maintain evidence of the results.

Finding 2023-004 - Activities Allowed or Unallowed and Allowable Costs/Cost Principles – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria In accordance with 2 CFR Section 200.303, Internal controls, the non-Federal entity must: (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our audit, we noted that there was no evidence, such as a signature, evidencing review and approval by a direct supervisor of the timesheets and time and effort reports. Cause There is no formal policy requiring timesheets and time and effort reports be approved by a direct supervisor and evidence of approval retained. Effect or Potential Effect The condition could result in inaccuracies in the allocation of salaries to the federal grants. Questioned Costs None. Context Two exceptions from a statistically valid sample of two. Identification as Repeat Finding No. Recommendation We recommend that management put in place a formal policy requiring all timesheets and time and effort reports be approved by a direct supervisor and that evidence of that approval be retained. Views of Responsible Officials Effective immediately, a time and effort reporting policy was implemented and sent to all staff to ensure that staff follow the process. This policy will be reviewed with all new staff during new hire orientation and annually. Timesheets will be reviewed and approved by direct supervisors on a weekly basis. HR will send a reminder to all staff on a weekly basis to complete all missing time worked. Employees are responsible for updating the timesheet for each work week in Paylocity. HR will provide a monthly time and effort report to the finance team. This report will provide total number of hours worked by each employee for each assigned cost center.

Finding 2023-002 - Reporting: Federal Funding Accountability and Transparency Act ("FFATA") – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria 1. In accordance with 2 CFR Section 200.303, Internal controls, the non-Federal entity must: (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2. Under the requirements of the FFATA (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, that are codified in 2 CFR Part 170, prime recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The prime recipient is required to file a FFATA sub-award report by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. Condition 1. During our audit, we noted there was no evidence of review and approval by someone other than the preparer of the FFATA subawards that were submitted to the FSRS. 2. During our audit, we noted the FFATA subawards were not submitted timely to the FSRS. Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 4 4 4 0 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $6,845,844 $6,845,844 $6,845,844 $0 $0 Cause 1. There is no formal policy in place requiring the CFO (or designee) to review and approve the FFATA reports before submission to the FSRS. 2. As a result of personnel changes within the finance department, the FFATA reporting was not done timely. Effect or Potential Effect 1. The condition could result in key data elements inaccurately reported and/or not supported by the source documentation. 2. The FFATA subawards were not submitted timely to the FSRS. Questioned Costs None. Context Four exceptions from a statistically valid sample of four. Identification as Repeat Finding 1. No 2. Yes (see prior year finding number 2022-001) Recommendation 1. We recommend that all FFATA reports be reviewed and approved by the CFO or designee and evidence of approval be maintained. 2. We recommend that management create an e-mail reminder or other alert mechanism and implement controls to ensure compliance with the reporting requirements under FFATA. Views of Responsible Officials As of September 1, 2023, BCHN implemented a workflow where FFATA information will be reported to the FSRS upon receipt of the Notices of Award. In addition, as of September 9, 2024, the FFATA report will be reviewed by someone other than the preparer prior to submission and evidence of the approval maintained.

Finding 2023-003 - Procurement and Suspension and Debarment – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria In accordance with 2 CFR 200.214, nonfederal entities are subject to the nonprocurement debarment and suspension regulations. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in federal assistance programs or activities. Condition During our audit, we noted that BCHN did not perform a timely check at the System for Award Management Exclusions (sam.gov) to verify whether an employee or a vendor had been suspended or debarred before being hired. Cause There is no formal policy in place requiring a check to be performed at sam.gov for prospective employees and vendors. Effect or Potential Effect The condition could result in employees or vendors who are suspended or debarred receiving federal funds. Questioned Costs None. Context Seven exceptions from a statistically valid sample of seven. Identification as Repeat Finding No. Recommendation We recommend Human Resources (HR) personnel/management perform a check at sam.gov prior to the hire of an employee or vendor to ensure the employee or vendor was not suspended or debarred and retain evidence of that verification. We also recommend a check at sam.gov be done annually thereafter and evidence of that verification be maintained. Views of Responsible Officials BCHN will check sam.gov and the Office of Inspector General, to screen all potential employees, contractors/consultants, and vendors, prior to the commencement of their affiliation with BCHN and maintain evidence of the results. BCHN will also screen all employees, contractors, consultants, and vendors on an annual basis thereafter and maintain evidence of the results.

Finding 2023-004 - Activities Allowed or Unallowed and Allowable Costs/Cost Principles – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria In accordance with 2 CFR Section 200.303, Internal controls, the non-Federal entity must: (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our audit, we noted that there was no evidence, such as a signature, evidencing review and approval by a direct supervisor of the timesheets and time and effort reports. Cause There is no formal policy requiring timesheets and time and effort reports be approved by a direct supervisor and evidence of approval retained. Effect or Potential Effect The condition could result in inaccuracies in the allocation of salaries to the federal grants. Questioned Costs None. Context Two exceptions from a statistically valid sample of two. Identification as Repeat Finding No. Recommendation We recommend that management put in place a formal policy requiring all timesheets and time and effort reports be approved by a direct supervisor and that evidence of that approval be retained. Views of Responsible Officials Effective immediately, a time and effort reporting policy was implemented and sent to all staff to ensure that staff follow the process. This policy will be reviewed with all new staff during new hire orientation and annually. Timesheets will be reviewed and approved by direct supervisors on a weekly basis. HR will send a reminder to all staff on a weekly basis to complete all missing time worked. Employees are responsible for updating the timesheet for each work week in Paylocity. HR will provide a monthly time and effort report to the finance team. This report will provide total number of hours worked by each employee for each assigned cost center.

Finding 2023-002 - Reporting: Federal Funding Accountability and Transparency Act ("FFATA") – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria 1. In accordance with 2 CFR Section 200.303, Internal controls, the non-Federal entity must: (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2. Under the requirements of the FFATA (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, that are codified in 2 CFR Part 170, prime recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The prime recipient is required to file a FFATA sub-award report by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. Condition 1. During our audit, we noted there was no evidence of review and approval by someone other than the preparer of the FFATA subawards that were submitted to the FSRS. 2. During our audit, we noted the FFATA subawards were not submitted timely to the FSRS. Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 4 4 4 0 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $6,845,844 $6,845,844 $6,845,844 $0 $0 Cause 1. There is no formal policy in place requiring the CFO (or designee) to review and approve the FFATA reports before submission to the FSRS. 2. As a result of personnel changes within the finance department, the FFATA reporting was not done timely. Effect or Potential Effect 1. The condition could result in key data elements inaccurately reported and/or not supported by the source documentation. 2. The FFATA subawards were not submitted timely to the FSRS. Questioned Costs None. Context Four exceptions from a statistically valid sample of four. Identification as Repeat Finding 1. No 2. Yes (see prior year finding number 2022-001) Recommendation 1. We recommend that all FFATA reports be reviewed and approved by the CFO or designee and evidence of approval be maintained. 2. We recommend that management create an e-mail reminder or other alert mechanism and implement controls to ensure compliance with the reporting requirements under FFATA. Views of Responsible Officials As of September 1, 2023, BCHN implemented a workflow where FFATA information will be reported to the FSRS upon receipt of the Notices of Award. In addition, as of September 9, 2024, the FFATA report will be reviewed by someone other than the preparer prior to submission and evidence of the approval maintained.

Finding 2023-003 - Procurement and Suspension and Debarment – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria In accordance with 2 CFR 200.214, nonfederal entities are subject to the nonprocurement debarment and suspension regulations. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in federal assistance programs or activities. Condition During our audit, we noted that BCHN did not perform a timely check at the System for Award Management Exclusions (sam.gov) to verify whether an employee or a vendor had been suspended or debarred before being hired. Cause There is no formal policy in place requiring a check to be performed at sam.gov for prospective employees and vendors. Effect or Potential Effect The condition could result in employees or vendors who are suspended or debarred receiving federal funds. Questioned Costs None. Context Seven exceptions from a statistically valid sample of seven. Identification as Repeat Finding No. Recommendation We recommend Human Resources (HR) personnel/management perform a check at sam.gov prior to the hire of an employee or vendor to ensure the employee or vendor was not suspended or debarred and retain evidence of that verification. We also recommend a check at sam.gov be done annually thereafter and evidence of that verification be maintained. Views of Responsible Officials BCHN will check sam.gov and the Office of Inspector General, to screen all potential employees, contractors/consultants, and vendors, prior to the commencement of their affiliation with BCHN and maintain evidence of the results. BCHN will also screen all employees, contractors, consultants, and vendors on an annual basis thereafter and maintain evidence of the results.

Finding 2023-004 - Activities Allowed or Unallowed and Allowable Costs/Cost Principles – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria In accordance with 2 CFR Section 200.303, Internal controls, the non-Federal entity must: (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our audit, we noted that there was no evidence, such as a signature, evidencing review and approval by a direct supervisor of the timesheets and time and effort reports. Cause There is no formal policy requiring timesheets and time and effort reports be approved by a direct supervisor and evidence of approval retained. Effect or Potential Effect The condition could result in inaccuracies in the allocation of salaries to the federal grants. Questioned Costs None. Context Two exceptions from a statistically valid sample of two. Identification as Repeat Finding No. Recommendation We recommend that management put in place a formal policy requiring all timesheets and time and effort reports be approved by a direct supervisor and that evidence of that approval be retained. Views of Responsible Officials Effective immediately, a time and effort reporting policy was implemented and sent to all staff to ensure that staff follow the process. This policy will be reviewed with all new staff during new hire orientation and annually. Timesheets will be reviewed and approved by direct supervisors on a weekly basis. HR will send a reminder to all staff on a weekly basis to complete all missing time worked. Employees are responsible for updating the timesheet for each work week in Paylocity. HR will provide a monthly time and effort report to the finance team. This report will provide total number of hours worked by each employee for each assigned cost center.

Finding 2023-002 - Reporting: Federal Funding Accountability and Transparency Act ("FFATA") – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria 1. In accordance with 2 CFR Section 200.303, Internal controls, the non-Federal entity must: (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2. Under the requirements of the FFATA (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, that are codified in 2 CFR Part 170, prime recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The prime recipient is required to file a FFATA sub-award report by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. Condition 1. During our audit, we noted there was no evidence of review and approval by someone other than the preparer of the FFATA subawards that were submitted to the FSRS. 2. During our audit, we noted the FFATA subawards were not submitted timely to the FSRS. Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 4 4 4 0 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $6,845,844 $6,845,844 $6,845,844 $0 $0 Cause 1. There is no formal policy in place requiring the CFO (or designee) to review and approve the FFATA reports before submission to the FSRS. 2. As a result of personnel changes within the finance department, the FFATA reporting was not done timely. Effect or Potential Effect 1. The condition could result in key data elements inaccurately reported and/or not supported by the source documentation. 2. The FFATA subawards were not submitted timely to the FSRS. Questioned Costs None. Context Four exceptions from a statistically valid sample of four. Identification as Repeat Finding 1. No 2. Yes (see prior year finding number 2022-001) Recommendation 1. We recommend that all FFATA reports be reviewed and approved by the CFO or designee and evidence of approval be maintained. 2. We recommend that management create an e-mail reminder or other alert mechanism and implement controls to ensure compliance with the reporting requirements under FFATA. Views of Responsible Officials As of September 1, 2023, BCHN implemented a workflow where FFATA information will be reported to the FSRS upon receipt of the Notices of Award. In addition, as of September 9, 2024, the FFATA report will be reviewed by someone other than the preparer prior to submission and evidence of the approval maintained.

Finding 2023-003 - Procurement and Suspension and Debarment – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria In accordance with 2 CFR 200.214, nonfederal entities are subject to the nonprocurement debarment and suspension regulations. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in federal assistance programs or activities. Condition During our audit, we noted that BCHN did not perform a timely check at the System for Award Management Exclusions (sam.gov) to verify whether an employee or a vendor had been suspended or debarred before being hired. Cause There is no formal policy in place requiring a check to be performed at sam.gov for prospective employees and vendors. Effect or Potential Effect The condition could result in employees or vendors who are suspended or debarred receiving federal funds. Questioned Costs None. Context Seven exceptions from a statistically valid sample of seven. Identification as Repeat Finding No. Recommendation We recommend Human Resources (HR) personnel/management perform a check at sam.gov prior to the hire of an employee or vendor to ensure the employee or vendor was not suspended or debarred and retain evidence of that verification. We also recommend a check at sam.gov be done annually thereafter and evidence of that verification be maintained. Views of Responsible Officials BCHN will check sam.gov and the Office of Inspector General, to screen all potential employees, contractors/consultants, and vendors, prior to the commencement of their affiliation with BCHN and maintain evidence of the results. BCHN will also screen all employees, contractors, consultants, and vendors on an annual basis thereafter and maintain evidence of the results.

Finding 2023-004 - Activities Allowed or Unallowed and Allowable Costs/Cost Principles – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria In accordance with 2 CFR Section 200.303, Internal controls, the non-Federal entity must: (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our audit, we noted that there was no evidence, such as a signature, evidencing review and approval by a direct supervisor of the timesheets and time and effort reports. Cause There is no formal policy requiring timesheets and time and effort reports be approved by a direct supervisor and evidence of approval retained. Effect or Potential Effect The condition could result in inaccuracies in the allocation of salaries to the federal grants. Questioned Costs None. Context Two exceptions from a statistically valid sample of two. Identification as Repeat Finding No. Recommendation We recommend that management put in place a formal policy requiring all timesheets and time and effort reports be approved by a direct supervisor and that evidence of that approval be retained. Views of Responsible Officials Effective immediately, a time and effort reporting policy was implemented and sent to all staff to ensure that staff follow the process. This policy will be reviewed with all new staff during new hire orientation and annually. Timesheets will be reviewed and approved by direct supervisors on a weekly basis. HR will send a reminder to all staff on a weekly basis to complete all missing time worked. Employees are responsible for updating the timesheet for each work week in Paylocity. HR will provide a monthly time and effort report to the finance team. This report will provide total number of hours worked by each employee for each assigned cost center.

Finding 2023-002 - Reporting: Federal Funding Accountability and Transparency Act ("FFATA") – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria 1. In accordance with 2 CFR Section 200.303, Internal controls, the non-Federal entity must: (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2. Under the requirements of the FFATA (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, that are codified in 2 CFR Part 170, prime recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The prime recipient is required to file a FFATA sub-award report by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. Condition 1. During our audit, we noted there was no evidence of review and approval by someone other than the preparer of the FFATA subawards that were submitted to the FSRS. 2. During our audit, we noted the FFATA subawards were not submitted timely to the FSRS. Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 4 4 4 0 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $6,845,844 $6,845,844 $6,845,844 $0 $0 Cause 1. There is no formal policy in place requiring the CFO (or designee) to review and approve the FFATA reports before submission to the FSRS. 2. As a result of personnel changes within the finance department, the FFATA reporting was not done timely. Effect or Potential Effect 1. The condition could result in key data elements inaccurately reported and/or not supported by the source documentation. 2. The FFATA subawards were not submitted timely to the FSRS. Questioned Costs None. Context Four exceptions from a statistically valid sample of four. Identification as Repeat Finding 1. No 2. Yes (see prior year finding number 2022-001) Recommendation 1. We recommend that all FFATA reports be reviewed and approved by the CFO or designee and evidence of approval be maintained. 2. We recommend that management create an e-mail reminder or other alert mechanism and implement controls to ensure compliance with the reporting requirements under FFATA. Views of Responsible Officials As of September 1, 2023, BCHN implemented a workflow where FFATA information will be reported to the FSRS upon receipt of the Notices of Award. In addition, as of September 9, 2024, the FFATA report will be reviewed by someone other than the preparer prior to submission and evidence of the approval maintained.

Finding 2023-003 - Procurement and Suspension and Debarment – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria In accordance with 2 CFR 200.214, nonfederal entities are subject to the nonprocurement debarment and suspension regulations. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in federal assistance programs or activities. Condition During our audit, we noted that BCHN did not perform a timely check at the System for Award Management Exclusions (sam.gov) to verify whether an employee or a vendor had been suspended or debarred before being hired. Cause There is no formal policy in place requiring a check to be performed at sam.gov for prospective employees and vendors. Effect or Potential Effect The condition could result in employees or vendors who are suspended or debarred receiving federal funds. Questioned Costs None. Context Seven exceptions from a statistically valid sample of seven. Identification as Repeat Finding No. Recommendation We recommend Human Resources (HR) personnel/management perform a check at sam.gov prior to the hire of an employee or vendor to ensure the employee or vendor was not suspended or debarred and retain evidence of that verification. We also recommend a check at sam.gov be done annually thereafter and evidence of that verification be maintained. Views of Responsible Officials BCHN will check sam.gov and the Office of Inspector General, to screen all potential employees, contractors/consultants, and vendors, prior to the commencement of their affiliation with BCHN and maintain evidence of the results. BCHN will also screen all employees, contractors, consultants, and vendors on an annual basis thereafter and maintain evidence of the results.

Finding 2023-004 - Activities Allowed or Unallowed and Allowable Costs/Cost Principles – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria In accordance with 2 CFR Section 200.303, Internal controls, the non-Federal entity must: (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our audit, we noted that there was no evidence, such as a signature, evidencing review and approval by a direct supervisor of the timesheets and time and effort reports. Cause There is no formal policy requiring timesheets and time and effort reports be approved by a direct supervisor and evidence of approval retained. Effect or Potential Effect The condition could result in inaccuracies in the allocation of salaries to the federal grants. Questioned Costs None. Context Two exceptions from a statistically valid sample of two. Identification as Repeat Finding No. Recommendation We recommend that management put in place a formal policy requiring all timesheets and time and effort reports be approved by a direct supervisor and that evidence of that approval be retained. Views of Responsible Officials Effective immediately, a time and effort reporting policy was implemented and sent to all staff to ensure that staff follow the process. This policy will be reviewed with all new staff during new hire orientation and annually. Timesheets will be reviewed and approved by direct supervisors on a weekly basis. HR will send a reminder to all staff on a weekly basis to complete all missing time worked. Employees are responsible for updating the timesheet for each work week in Paylocity. HR will provide a monthly time and effort report to the finance team. This report will provide total number of hours worked by each employee for each assigned cost center.

Finding 2023-002 - Reporting: Federal Funding Accountability and Transparency Act ("FFATA") – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria 1. In accordance with 2 CFR Section 200.303, Internal controls, the non-Federal entity must: (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2. Under the requirements of the FFATA (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, that are codified in 2 CFR Part 170, prime recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The prime recipient is required to file a FFATA sub-award report by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. Condition 1. During our audit, we noted there was no evidence of review and approval by someone other than the preparer of the FFATA subawards that were submitted to the FSRS. 2. During our audit, we noted the FFATA subawards were not submitted timely to the FSRS. Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 4 4 4 0 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $6,845,844 $6,845,844 $6,845,844 $0 $0 Cause 1. There is no formal policy in place requiring the CFO (or designee) to review and approve the FFATA reports before submission to the FSRS. 2. As a result of personnel changes within the finance department, the FFATA reporting was not done timely. Effect or Potential Effect 1. The condition could result in key data elements inaccurately reported and/or not supported by the source documentation. 2. The FFATA subawards were not submitted timely to the FSRS. Questioned Costs None. Context Four exceptions from a statistically valid sample of four. Identification as Repeat Finding 1. No 2. Yes (see prior year finding number 2022-001) Recommendation 1. We recommend that all FFATA reports be reviewed and approved by the CFO or designee and evidence of approval be maintained. 2. We recommend that management create an e-mail reminder or other alert mechanism and implement controls to ensure compliance with the reporting requirements under FFATA. Views of Responsible Officials As of September 1, 2023, BCHN implemented a workflow where FFATA information will be reported to the FSRS upon receipt of the Notices of Award. In addition, as of September 9, 2024, the FFATA report will be reviewed by someone other than the preparer prior to submission and evidence of the approval maintained.

Finding 2023-003 - Procurement and Suspension and Debarment – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria In accordance with 2 CFR 200.214, nonfederal entities are subject to the nonprocurement debarment and suspension regulations. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in federal assistance programs or activities. Condition During our audit, we noted that BCHN did not perform a timely check at the System for Award Management Exclusions (sam.gov) to verify whether an employee or a vendor had been suspended or debarred before being hired. Cause There is no formal policy in place requiring a check to be performed at sam.gov for prospective employees and vendors. Effect or Potential Effect The condition could result in employees or vendors who are suspended or debarred receiving federal funds. Questioned Costs None. Context Seven exceptions from a statistically valid sample of seven. Identification as Repeat Finding No. Recommendation We recommend Human Resources (HR) personnel/management perform a check at sam.gov prior to the hire of an employee or vendor to ensure the employee or vendor was not suspended or debarred and retain evidence of that verification. We also recommend a check at sam.gov be done annually thereafter and evidence of that verification be maintained. Views of Responsible Officials BCHN will check sam.gov and the Office of Inspector General, to screen all potential employees, contractors/consultants, and vendors, prior to the commencement of their affiliation with BCHN and maintain evidence of the results. BCHN will also screen all employees, contractors, consultants, and vendors on an annual basis thereafter and maintain evidence of the results.

Finding 2023-004 - Activities Allowed or Unallowed and Allowable Costs/Cost Principles – Significant Deficiency Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name(s): Health Center Program Cluster - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and COVID-19 - Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care and Grants for New and Expanded Services Under the Health Center Program and COVID-19 - Grants for New and Expanded Services Under the Health Center Program Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number(s) and Year(s): H8F4083 - 2021, H8000626 - 2022, H8G48366 - 2022 Criteria In accordance with 2 CFR Section 200.303, Internal controls, the non-Federal entity must: (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our audit, we noted that there was no evidence, such as a signature, evidencing review and approval by a direct supervisor of the timesheets and time and effort reports. Cause There is no formal policy requiring timesheets and time and effort reports be approved by a direct supervisor and evidence of approval retained. Effect or Potential Effect The condition could result in inaccuracies in the allocation of salaries to the federal grants. Questioned Costs None. Context Two exceptions from a statistically valid sample of two. Identification as Repeat Finding No. Recommendation We recommend that management put in place a formal policy requiring all timesheets and time and effort reports be approved by a direct supervisor and that evidence of that approval be retained. Views of Responsible Officials Effective immediately, a time and effort reporting policy was implemented and sent to all staff to ensure that staff follow the process. This policy will be reviewed with all new staff during new hire orientation and annually. Timesheets will be reviewed and approved by direct supervisors on a weekly basis. HR will send a reminder to all staff on a weekly basis to complete all missing time worked. Employees are responsible for updating the timesheet for each work week in Paylocity. HR will provide a monthly time and effort report to the finance team. This report will provide total number of hours worked by each employee for each assigned cost center.