Audit 325563

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Numbers: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: The Organization did not have sufficient internal control processes or review in place to identify errors in grant expenditure tracking spreadsheets, resulting in summarized expenditures that exceeded the total of the underlying detailed expenditures for H8F grant. Grant draws and revenue recognition utilized the summarized expenditures. There was also no documentation of review and approval process occurring related to drawdowns tested in the audit procedures. Questioned costs: None. Context: The Organization's detailed expenditures initially were not sufficient to support the full amount of the grant funds drawn down and recognized as revenue on the H8F grant. There was, however, more than sufficient eligible expenditures when additional indirect costs under an approved indirect cost rate were considered. The Health Center does have a review process in place around federal grant drawdowns, however formal documentation was not maintained to support that review process occurring. Cause: There were insufficient reconciliation procedures in place between the detailed expenditures identified to the grant and the summary schedules used for drawing down federal funds and required reporting. Effect: Had there not been sufficient eligible indirect costs to make up for the deficit between detailed expenditures and grant draws, grant draws would have exceeded the related eligible expenditures, and revenue recorded per the general ledger and SEFA would have been overstated. Without detailed review and approval process, there is greater risk of future errors. Recommendation: We recommend reviewing reconciliation procedures between detailed grant expenditures and summary schedules used in reporting/draw down requests to ensure sufficient detail to support draw downs. Also recommend a detailed review and approval process for federal grant eligible expenditures and draw downs, to identify issues prior to draw down or reporting in the future. Documentation should be retained to support review/approval occurrence. View of responsible officials: No disagreement with the finding. Management will review and improve reconciliation and review process around eligible expenditures for federal grants, and drawdowns of federal funds.

Federal agency: U.S. Department of Health and Human Services Federal program titles: Health Centers Cluster, Provider Relief Fund Assistance Listing Numbers: 93.224/93.527, 93.498 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23, PRF Reporting Period 2 for funds received 7/1/20 – 12/31/20 and used through 12/31/21 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: The Organization did not have sufficient internal control process or review in place over required reporting for federal programs. There was no documentation retained of review occurring before submission of reports. Errors were identified in key line items tested in the UDS report filed for 2021 during the fiscal year 2022. Questioned costs: None. Context: While the Organization has historically had a review process over required federal program reporting, there was no documentation of that review occurring for the reports tested, including FFR reports and UDS report for the community Organization grants, and the required reporting for Provider Relief Funds. For the UDS report, due to an error in supporting schedules, amounts reported in Table 9E, lines 1g and 1q were overstated. There was turnover in key finance positions at the Organization, where historical segregation of duties between preparer and reviewer was not always possible. Cause: Turnover in personnel at the Organization likely led to lapses in review processes that had been in place historically. The lack of detailed review likely resulted in the errors identified in UDS reporting. The Provider Relief Fund grant was also a newer program with unique reporting requirements the Organization had not previously experienced. Effect: Without sufficient review processes in place, there is greater risk of noncompliance or errors in required reporting under federal programs. In the case of the UDS reporting, certain line items were misreported due to errors in supporting spreadsheets. Recommendation: We recommend implementing a formal policy and procedure where there is a review of all required reporting by an individual that did not prepare the report. Documentation should be retained to support the review/approval occurrence. View of responsible officials: No disagreement with the finding. Management will implement a formal review process for reporting and retain documentation of review.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Number: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Cost principles under 2 CFR 200 also do not allow expenditures for individual's wages that exceed a federal compensation limit. Condition: One individual's compensation charged to the federal grant had wages that exceeded federal compensation limits. Questioned costs: $24,920 of wage-related costs exceeding federal limitation. Context: While there was one individual with compensation exceeding federal limits charged to the Organization H8F grant, there were other eligible wage and other expenditures available that could have replaced the overage had it been corrected. Cause: Internal control procedures were not sufficient to identify the wages exceeding federal limits prior to being charged to the federal grant. Effect: Eligible wage expenditures were overstated due to wages that exceed federal limits for one individual. There were other available eligible expenditures sufficient to offset this overstatement, however. Recommendation: We recommend management implement a review process to check individual's compensation charged to federal grants against annual federal limitations prior to drawdown of funds. View of responsible officials: No disagreement with the finding. Management will implement review processes to identify individuals over federal wage limitations moving forward before being charged to federal grants.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Number: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations section 200.320 states the non-Federal entity must have and use documented procurement procedures following specific requirements for different methods of procurement depending on size and type of purchase. Thresholds for these categories (micro-purchase, simplified acquisition threshold) refer to using the Federal Acquisition Regulations (FAR), unless a different threshold has been specifically approved. Specifically, under FAR multiple quotes are generally required for purchases over the micro-purchase threshold, or documentation should be maintained explaining why multiple quotes were not obtained. Condition: During our testing, we noted the Organization had a proper procurement policy that met the federal requirements, but was not able to provide documentation supporting the policy was followed for all vendors selected. Questioned costs: None. Context: In our testing covering three vendors, two of the three the Organization was not able to provide documentation supporting the use of noncompetitive procurement. Based on understanding of the vendors and why they were selected, the vendors used appear reasonable, but there is insufficient documentation to support the Organization's policy was followed. Cause: Turnover in personnel at the Organization likely played a role, but the Organization was also focused on response to the COVID-19 pandemic at the time of vendor procurement. So timeliness was often most important in procuring vendors and related products/services. Effect: Without retaining documentation to support proper compliance with the Organization's policy, there is greater risk of noncompliance or inappropriate vendor selection. Recommendation: We recommend the Organization follow existing policy, but ensure procedures are in place to retain sufficient documentation to support whichever procurement method was utilized in procuring vendors. View of responsible officials: No disagreement with the finding. Management will review procedures to ensure proper procurement methodology is utilized under the Organization's policy, and that sufficient documentation is retained to support procurement method.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Number: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations section 200.214 requires the Center to follow the nonprocurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. The Organization should have policies and procedures in place to ensure contracts or subaward are not provided to third parties that are suspended or disbarred. Condition: During our testing, we noted the Organization had a proper policy around suspension and debarment, but was not able to provide documentation supporting the policy was followed for all vendors selected. Questioned costs: None. Context: In our testing covering three vendors, the Organization was not able to provide documentation supporting the Organization had followed its suspension and debarment policy. All vendors were checked against the exclusion list at the time of audit testing, and none were found to be suspended/debarred. Cause: Turnover in personnel at the Organization likely played a role, but the Organization was also focused on response to the COVID-19 pandemic at the time of vendor procurement. So timeliness was often most important in procuring vendors and related products/services. Effect: Without retaining documentation to support proper compliance with the Organization's policy, there is greater risk of noncompliance or inappropriate vendor selection. Recommendation: We recommend the Organization follow existing policy, but ensure procedures are in place to retain sufficient documentation to support review of vendors against federal exclusion list. View of responsible officials: No disagreement with the finding. Management will review procedures to ensure proper check of vendors is performed against federal exclusion list, and that documentation is maintained to support that review.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Numbers: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: The Organization did not have sufficient internal control processes or review in place to identify errors in grant expenditure tracking spreadsheets, resulting in summarized expenditures that exceeded the total of the underlying detailed expenditures for H8F grant. Grant draws and revenue recognition utilized the summarized expenditures. There was also no documentation of review and approval process occurring related to drawdowns tested in the audit procedures. Questioned costs: None. Context: The Organization's detailed expenditures initially were not sufficient to support the full amount of the grant funds drawn down and recognized as revenue on the H8F grant. There was, however, more than sufficient eligible expenditures when additional indirect costs under an approved indirect cost rate were considered. The Health Center does have a review process in place around federal grant drawdowns, however formal documentation was not maintained to support that review process occurring. Cause: There were insufficient reconciliation procedures in place between the detailed expenditures identified to the grant and the summary schedules used for drawing down federal funds and required reporting. Effect: Had there not been sufficient eligible indirect costs to make up for the deficit between detailed expenditures and grant draws, grant draws would have exceeded the related eligible expenditures, and revenue recorded per the general ledger and SEFA would have been overstated. Without detailed review and approval process, there is greater risk of future errors. Recommendation: We recommend reviewing reconciliation procedures between detailed grant expenditures and summary schedules used in reporting/draw down requests to ensure sufficient detail to support draw downs. Also recommend a detailed review and approval process for federal grant eligible expenditures and draw downs, to identify issues prior to draw down or reporting in the future. Documentation should be retained to support review/approval occurrence. View of responsible officials: No disagreement with the finding. Management will review and improve reconciliation and review process around eligible expenditures for federal grants, and drawdowns of federal funds.

Federal agency: U.S. Department of Health and Human Services Federal program titles: Health Centers Cluster, Provider Relief Fund Assistance Listing Numbers: 93.224/93.527, 93.498 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23, PRF Reporting Period 2 for funds received 7/1/20 – 12/31/20 and used through 12/31/21 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: The Organization did not have sufficient internal control process or review in place over required reporting for federal programs. There was no documentation retained of review occurring before submission of reports. Errors were identified in key line items tested in the UDS report filed for 2021 during the fiscal year 2022. Questioned costs: None. Context: While the Organization has historically had a review process over required federal program reporting, there was no documentation of that review occurring for the reports tested, including FFR reports and UDS report for the community Organization grants, and the required reporting for Provider Relief Funds. For the UDS report, due to an error in supporting schedules, amounts reported in Table 9E, lines 1g and 1q were overstated. There was turnover in key finance positions at the Organization, where historical segregation of duties between preparer and reviewer was not always possible. Cause: Turnover in personnel at the Organization likely led to lapses in review processes that had been in place historically. The lack of detailed review likely resulted in the errors identified in UDS reporting. The Provider Relief Fund grant was also a newer program with unique reporting requirements the Organization had not previously experienced. Effect: Without sufficient review processes in place, there is greater risk of noncompliance or errors in required reporting under federal programs. In the case of the UDS reporting, certain line items were misreported due to errors in supporting spreadsheets. Recommendation: We recommend implementing a formal policy and procedure where there is a review of all required reporting by an individual that did not prepare the report. Documentation should be retained to support the review/approval occurrence. View of responsible officials: No disagreement with the finding. Management will implement a formal review process for reporting and retain documentation of review.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Number: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Cost principles under 2 CFR 200 also do not allow expenditures for individual's wages that exceed a federal compensation limit. Condition: One individual's compensation charged to the federal grant had wages that exceeded federal compensation limits. Questioned costs: $24,920 of wage-related costs exceeding federal limitation. Context: While there was one individual with compensation exceeding federal limits charged to the Organization H8F grant, there were other eligible wage and other expenditures available that could have replaced the overage had it been corrected. Cause: Internal control procedures were not sufficient to identify the wages exceeding federal limits prior to being charged to the federal grant. Effect: Eligible wage expenditures were overstated due to wages that exceed federal limits for one individual. There were other available eligible expenditures sufficient to offset this overstatement, however. Recommendation: We recommend management implement a review process to check individual's compensation charged to federal grants against annual federal limitations prior to drawdown of funds. View of responsible officials: No disagreement with the finding. Management will implement review processes to identify individuals over federal wage limitations moving forward before being charged to federal grants.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Number: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations section 200.320 states the non-Federal entity must have and use documented procurement procedures following specific requirements for different methods of procurement depending on size and type of purchase. Thresholds for these categories (micro-purchase, simplified acquisition threshold) refer to using the Federal Acquisition Regulations (FAR), unless a different threshold has been specifically approved. Specifically, under FAR multiple quotes are generally required for purchases over the micro-purchase threshold, or documentation should be maintained explaining why multiple quotes were not obtained. Condition: During our testing, we noted the Organization had a proper procurement policy that met the federal requirements, but was not able to provide documentation supporting the policy was followed for all vendors selected. Questioned costs: None. Context: In our testing covering three vendors, two of the three the Organization was not able to provide documentation supporting the use of noncompetitive procurement. Based on understanding of the vendors and why they were selected, the vendors used appear reasonable, but there is insufficient documentation to support the Organization's policy was followed. Cause: Turnover in personnel at the Organization likely played a role, but the Organization was also focused on response to the COVID-19 pandemic at the time of vendor procurement. So timeliness was often most important in procuring vendors and related products/services. Effect: Without retaining documentation to support proper compliance with the Organization's policy, there is greater risk of noncompliance or inappropriate vendor selection. Recommendation: We recommend the Organization follow existing policy, but ensure procedures are in place to retain sufficient documentation to support whichever procurement method was utilized in procuring vendors. View of responsible officials: No disagreement with the finding. Management will review procedures to ensure proper procurement methodology is utilized under the Organization's policy, and that sufficient documentation is retained to support procurement method.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Number: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations section 200.214 requires the Center to follow the nonprocurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. The Organization should have policies and procedures in place to ensure contracts or subaward are not provided to third parties that are suspended or disbarred. Condition: During our testing, we noted the Organization had a proper policy around suspension and debarment, but was not able to provide documentation supporting the policy was followed for all vendors selected. Questioned costs: None. Context: In our testing covering three vendors, the Organization was not able to provide documentation supporting the Organization had followed its suspension and debarment policy. All vendors were checked against the exclusion list at the time of audit testing, and none were found to be suspended/debarred. Cause: Turnover in personnel at the Organization likely played a role, but the Organization was also focused on response to the COVID-19 pandemic at the time of vendor procurement. So timeliness was often most important in procuring vendors and related products/services. Effect: Without retaining documentation to support proper compliance with the Organization's policy, there is greater risk of noncompliance or inappropriate vendor selection. Recommendation: We recommend the Organization follow existing policy, but ensure procedures are in place to retain sufficient documentation to support review of vendors against federal exclusion list. View of responsible officials: No disagreement with the finding. Management will review procedures to ensure proper check of vendors is performed against federal exclusion list, and that documentation is maintained to support that review.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Numbers: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: The Organization did not have sufficient internal control processes or review in place to identify errors in grant expenditure tracking spreadsheets, resulting in summarized expenditures that exceeded the total of the underlying detailed expenditures for H8F grant. Grant draws and revenue recognition utilized the summarized expenditures. There was also no documentation of review and approval process occurring related to drawdowns tested in the audit procedures. Questioned costs: None. Context: The Organization's detailed expenditures initially were not sufficient to support the full amount of the grant funds drawn down and recognized as revenue on the H8F grant. There was, however, more than sufficient eligible expenditures when additional indirect costs under an approved indirect cost rate were considered. The Health Center does have a review process in place around federal grant drawdowns, however formal documentation was not maintained to support that review process occurring. Cause: There were insufficient reconciliation procedures in place between the detailed expenditures identified to the grant and the summary schedules used for drawing down federal funds and required reporting. Effect: Had there not been sufficient eligible indirect costs to make up for the deficit between detailed expenditures and grant draws, grant draws would have exceeded the related eligible expenditures, and revenue recorded per the general ledger and SEFA would have been overstated. Without detailed review and approval process, there is greater risk of future errors. Recommendation: We recommend reviewing reconciliation procedures between detailed grant expenditures and summary schedules used in reporting/draw down requests to ensure sufficient detail to support draw downs. Also recommend a detailed review and approval process for federal grant eligible expenditures and draw downs, to identify issues prior to draw down or reporting in the future. Documentation should be retained to support review/approval occurrence. View of responsible officials: No disagreement with the finding. Management will review and improve reconciliation and review process around eligible expenditures for federal grants, and drawdowns of federal funds.

Federal agency: U.S. Department of Health and Human Services Federal program titles: Health Centers Cluster, Provider Relief Fund Assistance Listing Numbers: 93.224/93.527, 93.498 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23, PRF Reporting Period 2 for funds received 7/1/20 – 12/31/20 and used through 12/31/21 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: The Organization did not have sufficient internal control process or review in place over required reporting for federal programs. There was no documentation retained of review occurring before submission of reports. Errors were identified in key line items tested in the UDS report filed for 2021 during the fiscal year 2022. Questioned costs: None. Context: While the Organization has historically had a review process over required federal program reporting, there was no documentation of that review occurring for the reports tested, including FFR reports and UDS report for the community Organization grants, and the required reporting for Provider Relief Funds. For the UDS report, due to an error in supporting schedules, amounts reported in Table 9E, lines 1g and 1q were overstated. There was turnover in key finance positions at the Organization, where historical segregation of duties between preparer and reviewer was not always possible. Cause: Turnover in personnel at the Organization likely led to lapses in review processes that had been in place historically. The lack of detailed review likely resulted in the errors identified in UDS reporting. The Provider Relief Fund grant was also a newer program with unique reporting requirements the Organization had not previously experienced. Effect: Without sufficient review processes in place, there is greater risk of noncompliance or errors in required reporting under federal programs. In the case of the UDS reporting, certain line items were misreported due to errors in supporting spreadsheets. Recommendation: We recommend implementing a formal policy and procedure where there is a review of all required reporting by an individual that did not prepare the report. Documentation should be retained to support the review/approval occurrence. View of responsible officials: No disagreement with the finding. Management will implement a formal review process for reporting and retain documentation of review.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Number: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Cost principles under 2 CFR 200 also do not allow expenditures for individual's wages that exceed a federal compensation limit. Condition: One individual's compensation charged to the federal grant had wages that exceeded federal compensation limits. Questioned costs: $24,920 of wage-related costs exceeding federal limitation. Context: While there was one individual with compensation exceeding federal limits charged to the Organization H8F grant, there were other eligible wage and other expenditures available that could have replaced the overage had it been corrected. Cause: Internal control procedures were not sufficient to identify the wages exceeding federal limits prior to being charged to the federal grant. Effect: Eligible wage expenditures were overstated due to wages that exceed federal limits for one individual. There were other available eligible expenditures sufficient to offset this overstatement, however. Recommendation: We recommend management implement a review process to check individual's compensation charged to federal grants against annual federal limitations prior to drawdown of funds. View of responsible officials: No disagreement with the finding. Management will implement review processes to identify individuals over federal wage limitations moving forward before being charged to federal grants.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Number: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations section 200.320 states the non-Federal entity must have and use documented procurement procedures following specific requirements for different methods of procurement depending on size and type of purchase. Thresholds for these categories (micro-purchase, simplified acquisition threshold) refer to using the Federal Acquisition Regulations (FAR), unless a different threshold has been specifically approved. Specifically, under FAR multiple quotes are generally required for purchases over the micro-purchase threshold, or documentation should be maintained explaining why multiple quotes were not obtained. Condition: During our testing, we noted the Organization had a proper procurement policy that met the federal requirements, but was not able to provide documentation supporting the policy was followed for all vendors selected. Questioned costs: None. Context: In our testing covering three vendors, two of the three the Organization was not able to provide documentation supporting the use of noncompetitive procurement. Based on understanding of the vendors and why they were selected, the vendors used appear reasonable, but there is insufficient documentation to support the Organization's policy was followed. Cause: Turnover in personnel at the Organization likely played a role, but the Organization was also focused on response to the COVID-19 pandemic at the time of vendor procurement. So timeliness was often most important in procuring vendors and related products/services. Effect: Without retaining documentation to support proper compliance with the Organization's policy, there is greater risk of noncompliance or inappropriate vendor selection. Recommendation: We recommend the Organization follow existing policy, but ensure procedures are in place to retain sufficient documentation to support whichever procurement method was utilized in procuring vendors. View of responsible officials: No disagreement with the finding. Management will review procedures to ensure proper procurement methodology is utilized under the Organization's policy, and that sufficient documentation is retained to support procurement method.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Number: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations section 200.214 requires the Center to follow the nonprocurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. The Organization should have policies and procedures in place to ensure contracts or subaward are not provided to third parties that are suspended or disbarred. Condition: During our testing, we noted the Organization had a proper policy around suspension and debarment, but was not able to provide documentation supporting the policy was followed for all vendors selected. Questioned costs: None. Context: In our testing covering three vendors, the Organization was not able to provide documentation supporting the Organization had followed its suspension and debarment policy. All vendors were checked against the exclusion list at the time of audit testing, and none were found to be suspended/debarred. Cause: Turnover in personnel at the Organization likely played a role, but the Organization was also focused on response to the COVID-19 pandemic at the time of vendor procurement. So timeliness was often most important in procuring vendors and related products/services. Effect: Without retaining documentation to support proper compliance with the Organization's policy, there is greater risk of noncompliance or inappropriate vendor selection. Recommendation: We recommend the Organization follow existing policy, but ensure procedures are in place to retain sufficient documentation to support review of vendors against federal exclusion list. View of responsible officials: No disagreement with the finding. Management will review procedures to ensure proper check of vendors is performed against federal exclusion list, and that documentation is maintained to support that review.

Federal agency: U.S. Department of Health and Human Services Federal program titles: Health Centers Cluster, Provider Relief Fund Assistance Listing Numbers: 93.224/93.527, 93.498 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23, PRF Reporting Period 2 for funds received 7/1/20 – 12/31/20 and used through 12/31/21 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: The Organization did not have sufficient internal control process or review in place over required reporting for federal programs. There was no documentation retained of review occurring before submission of reports. Errors were identified in key line items tested in the UDS report filed for 2021 during the fiscal year 2022. Questioned costs: None. Context: While the Organization has historically had a review process over required federal program reporting, there was no documentation of that review occurring for the reports tested, including FFR reports and UDS report for the community Organization grants, and the required reporting for Provider Relief Funds. For the UDS report, due to an error in supporting schedules, amounts reported in Table 9E, lines 1g and 1q were overstated. There was turnover in key finance positions at the Organization, where historical segregation of duties between preparer and reviewer was not always possible. Cause: Turnover in personnel at the Organization likely led to lapses in review processes that had been in place historically. The lack of detailed review likely resulted in the errors identified in UDS reporting. The Provider Relief Fund grant was also a newer program with unique reporting requirements the Organization had not previously experienced. Effect: Without sufficient review processes in place, there is greater risk of noncompliance or errors in required reporting under federal programs. In the case of the UDS reporting, certain line items were misreported due to errors in supporting spreadsheets. Recommendation: We recommend implementing a formal policy and procedure where there is a review of all required reporting by an individual that did not prepare the report. Documentation should be retained to support the review/approval occurrence. View of responsible officials: No disagreement with the finding. Management will implement a formal review process for reporting and retain documentation of review.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Numbers: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: The Organization did not have sufficient internal control processes or review in place to identify errors in grant expenditure tracking spreadsheets, resulting in summarized expenditures that exceeded the total of the underlying detailed expenditures for H8F grant. Grant draws and revenue recognition utilized the summarized expenditures. There was also no documentation of review and approval process occurring related to drawdowns tested in the audit procedures. Questioned costs: None. Context: The Organization's detailed expenditures initially were not sufficient to support the full amount of the grant funds drawn down and recognized as revenue on the H8F grant. There was, however, more than sufficient eligible expenditures when additional indirect costs under an approved indirect cost rate were considered. The Health Center does have a review process in place around federal grant drawdowns, however formal documentation was not maintained to support that review process occurring. Cause: There were insufficient reconciliation procedures in place between the detailed expenditures identified to the grant and the summary schedules used for drawing down federal funds and required reporting. Effect: Had there not been sufficient eligible indirect costs to make up for the deficit between detailed expenditures and grant draws, grant draws would have exceeded the related eligible expenditures, and revenue recorded per the general ledger and SEFA would have been overstated. Without detailed review and approval process, there is greater risk of future errors. Recommendation: We recommend reviewing reconciliation procedures between detailed grant expenditures and summary schedules used in reporting/draw down requests to ensure sufficient detail to support draw downs. Also recommend a detailed review and approval process for federal grant eligible expenditures and draw downs, to identify issues prior to draw down or reporting in the future. Documentation should be retained to support review/approval occurrence. View of responsible officials: No disagreement with the finding. Management will review and improve reconciliation and review process around eligible expenditures for federal grants, and drawdowns of federal funds.

Federal agency: U.S. Department of Health and Human Services Federal program titles: Health Centers Cluster, Provider Relief Fund Assistance Listing Numbers: 93.224/93.527, 93.498 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23, PRF Reporting Period 2 for funds received 7/1/20 – 12/31/20 and used through 12/31/21 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: The Organization did not have sufficient internal control process or review in place over required reporting for federal programs. There was no documentation retained of review occurring before submission of reports. Errors were identified in key line items tested in the UDS report filed for 2021 during the fiscal year 2022. Questioned costs: None. Context: While the Organization has historically had a review process over required federal program reporting, there was no documentation of that review occurring for the reports tested, including FFR reports and UDS report for the community Organization grants, and the required reporting for Provider Relief Funds. For the UDS report, due to an error in supporting schedules, amounts reported in Table 9E, lines 1g and 1q were overstated. There was turnover in key finance positions at the Organization, where historical segregation of duties between preparer and reviewer was not always possible. Cause: Turnover in personnel at the Organization likely led to lapses in review processes that had been in place historically. The lack of detailed review likely resulted in the errors identified in UDS reporting. The Provider Relief Fund grant was also a newer program with unique reporting requirements the Organization had not previously experienced. Effect: Without sufficient review processes in place, there is greater risk of noncompliance or errors in required reporting under federal programs. In the case of the UDS reporting, certain line items were misreported due to errors in supporting spreadsheets. Recommendation: We recommend implementing a formal policy and procedure where there is a review of all required reporting by an individual that did not prepare the report. Documentation should be retained to support the review/approval occurrence. View of responsible officials: No disagreement with the finding. Management will implement a formal review process for reporting and retain documentation of review.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Number: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Cost principles under 2 CFR 200 also do not allow expenditures for individual's wages that exceed a federal compensation limit. Condition: One individual's compensation charged to the federal grant had wages that exceeded federal compensation limits. Questioned costs: $24,920 of wage-related costs exceeding federal limitation. Context: While there was one individual with compensation exceeding federal limits charged to the Organization H8F grant, there were other eligible wage and other expenditures available that could have replaced the overage had it been corrected. Cause: Internal control procedures were not sufficient to identify the wages exceeding federal limits prior to being charged to the federal grant. Effect: Eligible wage expenditures were overstated due to wages that exceed federal limits for one individual. There were other available eligible expenditures sufficient to offset this overstatement, however. Recommendation: We recommend management implement a review process to check individual's compensation charged to federal grants against annual federal limitations prior to drawdown of funds. View of responsible officials: No disagreement with the finding. Management will implement review processes to identify individuals over federal wage limitations moving forward before being charged to federal grants.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Number: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations section 200.320 states the non-Federal entity must have and use documented procurement procedures following specific requirements for different methods of procurement depending on size and type of purchase. Thresholds for these categories (micro-purchase, simplified acquisition threshold) refer to using the Federal Acquisition Regulations (FAR), unless a different threshold has been specifically approved. Specifically, under FAR multiple quotes are generally required for purchases over the micro-purchase threshold, or documentation should be maintained explaining why multiple quotes were not obtained. Condition: During our testing, we noted the Organization had a proper procurement policy that met the federal requirements, but was not able to provide documentation supporting the policy was followed for all vendors selected. Questioned costs: None. Context: In our testing covering three vendors, two of the three the Organization was not able to provide documentation supporting the use of noncompetitive procurement. Based on understanding of the vendors and why they were selected, the vendors used appear reasonable, but there is insufficient documentation to support the Organization's policy was followed. Cause: Turnover in personnel at the Organization likely played a role, but the Organization was also focused on response to the COVID-19 pandemic at the time of vendor procurement. So timeliness was often most important in procuring vendors and related products/services. Effect: Without retaining documentation to support proper compliance with the Organization's policy, there is greater risk of noncompliance or inappropriate vendor selection. Recommendation: We recommend the Organization follow existing policy, but ensure procedures are in place to retain sufficient documentation to support whichever procurement method was utilized in procuring vendors. View of responsible officials: No disagreement with the finding. Management will review procedures to ensure proper procurement methodology is utilized under the Organization's policy, and that sufficient documentation is retained to support procurement method.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Number: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations section 200.214 requires the Center to follow the nonprocurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. The Organization should have policies and procedures in place to ensure contracts or subaward are not provided to third parties that are suspended or disbarred. Condition: During our testing, we noted the Organization had a proper policy around suspension and debarment, but was not able to provide documentation supporting the policy was followed for all vendors selected. Questioned costs: None. Context: In our testing covering three vendors, the Organization was not able to provide documentation supporting the Organization had followed its suspension and debarment policy. All vendors were checked against the exclusion list at the time of audit testing, and none were found to be suspended/debarred. Cause: Turnover in personnel at the Organization likely played a role, but the Organization was also focused on response to the COVID-19 pandemic at the time of vendor procurement. So timeliness was often most important in procuring vendors and related products/services. Effect: Without retaining documentation to support proper compliance with the Organization's policy, there is greater risk of noncompliance or inappropriate vendor selection. Recommendation: We recommend the Organization follow existing policy, but ensure procedures are in place to retain sufficient documentation to support review of vendors against federal exclusion list. View of responsible officials: No disagreement with the finding. Management will review procedures to ensure proper check of vendors is performed against federal exclusion list, and that documentation is maintained to support that review.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Numbers: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: The Organization did not have sufficient internal control processes or review in place to identify errors in grant expenditure tracking spreadsheets, resulting in summarized expenditures that exceeded the total of the underlying detailed expenditures for H8F grant. Grant draws and revenue recognition utilized the summarized expenditures. There was also no documentation of review and approval process occurring related to drawdowns tested in the audit procedures. Questioned costs: None. Context: The Organization's detailed expenditures initially were not sufficient to support the full amount of the grant funds drawn down and recognized as revenue on the H8F grant. There was, however, more than sufficient eligible expenditures when additional indirect costs under an approved indirect cost rate were considered. The Health Center does have a review process in place around federal grant drawdowns, however formal documentation was not maintained to support that review process occurring. Cause: There were insufficient reconciliation procedures in place between the detailed expenditures identified to the grant and the summary schedules used for drawing down federal funds and required reporting. Effect: Had there not been sufficient eligible indirect costs to make up for the deficit between detailed expenditures and grant draws, grant draws would have exceeded the related eligible expenditures, and revenue recorded per the general ledger and SEFA would have been overstated. Without detailed review and approval process, there is greater risk of future errors. Recommendation: We recommend reviewing reconciliation procedures between detailed grant expenditures and summary schedules used in reporting/draw down requests to ensure sufficient detail to support draw downs. Also recommend a detailed review and approval process for federal grant eligible expenditures and draw downs, to identify issues prior to draw down or reporting in the future. Documentation should be retained to support review/approval occurrence. View of responsible officials: No disagreement with the finding. Management will review and improve reconciliation and review process around eligible expenditures for federal grants, and drawdowns of federal funds.

Federal agency: U.S. Department of Health and Human Services Federal program titles: Health Centers Cluster, Provider Relief Fund Assistance Listing Numbers: 93.224/93.527, 93.498 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23, PRF Reporting Period 2 for funds received 7/1/20 – 12/31/20 and used through 12/31/21 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: The Organization did not have sufficient internal control process or review in place over required reporting for federal programs. There was no documentation retained of review occurring before submission of reports. Errors were identified in key line items tested in the UDS report filed for 2021 during the fiscal year 2022. Questioned costs: None. Context: While the Organization has historically had a review process over required federal program reporting, there was no documentation of that review occurring for the reports tested, including FFR reports and UDS report for the community Organization grants, and the required reporting for Provider Relief Funds. For the UDS report, due to an error in supporting schedules, amounts reported in Table 9E, lines 1g and 1q were overstated. There was turnover in key finance positions at the Organization, where historical segregation of duties between preparer and reviewer was not always possible. Cause: Turnover in personnel at the Organization likely led to lapses in review processes that had been in place historically. The lack of detailed review likely resulted in the errors identified in UDS reporting. The Provider Relief Fund grant was also a newer program with unique reporting requirements the Organization had not previously experienced. Effect: Without sufficient review processes in place, there is greater risk of noncompliance or errors in required reporting under federal programs. In the case of the UDS reporting, certain line items were misreported due to errors in supporting spreadsheets. Recommendation: We recommend implementing a formal policy and procedure where there is a review of all required reporting by an individual that did not prepare the report. Documentation should be retained to support the review/approval occurrence. View of responsible officials: No disagreement with the finding. Management will implement a formal review process for reporting and retain documentation of review.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Number: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Cost principles under 2 CFR 200 also do not allow expenditures for individual's wages that exceed a federal compensation limit. Condition: One individual's compensation charged to the federal grant had wages that exceeded federal compensation limits. Questioned costs: $24,920 of wage-related costs exceeding federal limitation. Context: While there was one individual with compensation exceeding federal limits charged to the Organization H8F grant, there were other eligible wage and other expenditures available that could have replaced the overage had it been corrected. Cause: Internal control procedures were not sufficient to identify the wages exceeding federal limits prior to being charged to the federal grant. Effect: Eligible wage expenditures were overstated due to wages that exceed federal limits for one individual. There were other available eligible expenditures sufficient to offset this overstatement, however. Recommendation: We recommend management implement a review process to check individual's compensation charged to federal grants against annual federal limitations prior to drawdown of funds. View of responsible officials: No disagreement with the finding. Management will implement review processes to identify individuals over federal wage limitations moving forward before being charged to federal grants.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Number: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations section 200.320 states the non-Federal entity must have and use documented procurement procedures following specific requirements for different methods of procurement depending on size and type of purchase. Thresholds for these categories (micro-purchase, simplified acquisition threshold) refer to using the Federal Acquisition Regulations (FAR), unless a different threshold has been specifically approved. Specifically, under FAR multiple quotes are generally required for purchases over the micro-purchase threshold, or documentation should be maintained explaining why multiple quotes were not obtained. Condition: During our testing, we noted the Organization had a proper procurement policy that met the federal requirements, but was not able to provide documentation supporting the policy was followed for all vendors selected. Questioned costs: None. Context: In our testing covering three vendors, two of the three the Organization was not able to provide documentation supporting the use of noncompetitive procurement. Based on understanding of the vendors and why they were selected, the vendors used appear reasonable, but there is insufficient documentation to support the Organization's policy was followed. Cause: Turnover in personnel at the Organization likely played a role, but the Organization was also focused on response to the COVID-19 pandemic at the time of vendor procurement. So timeliness was often most important in procuring vendors and related products/services. Effect: Without retaining documentation to support proper compliance with the Organization's policy, there is greater risk of noncompliance or inappropriate vendor selection. Recommendation: We recommend the Organization follow existing policy, but ensure procedures are in place to retain sufficient documentation to support whichever procurement method was utilized in procuring vendors. View of responsible officials: No disagreement with the finding. Management will review procedures to ensure proper procurement methodology is utilized under the Organization's policy, and that sufficient documentation is retained to support procurement method.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Number: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations section 200.214 requires the Center to follow the nonprocurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. The Organization should have policies and procedures in place to ensure contracts or subaward are not provided to third parties that are suspended or disbarred. Condition: During our testing, we noted the Organization had a proper policy around suspension and debarment, but was not able to provide documentation supporting the policy was followed for all vendors selected. Questioned costs: None. Context: In our testing covering three vendors, the Organization was not able to provide documentation supporting the Organization had followed its suspension and debarment policy. All vendors were checked against the exclusion list at the time of audit testing, and none were found to be suspended/debarred. Cause: Turnover in personnel at the Organization likely played a role, but the Organization was also focused on response to the COVID-19 pandemic at the time of vendor procurement. So timeliness was often most important in procuring vendors and related products/services. Effect: Without retaining documentation to support proper compliance with the Organization's policy, there is greater risk of noncompliance or inappropriate vendor selection. Recommendation: We recommend the Organization follow existing policy, but ensure procedures are in place to retain sufficient documentation to support review of vendors against federal exclusion list. View of responsible officials: No disagreement with the finding. Management will review procedures to ensure proper check of vendors is performed against federal exclusion list, and that documentation is maintained to support that review.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Numbers: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: The Organization did not have sufficient internal control processes or review in place to identify errors in grant expenditure tracking spreadsheets, resulting in summarized expenditures that exceeded the total of the underlying detailed expenditures for H8F grant. Grant draws and revenue recognition utilized the summarized expenditures. There was also no documentation of review and approval process occurring related to drawdowns tested in the audit procedures. Questioned costs: None. Context: The Organization's detailed expenditures initially were not sufficient to support the full amount of the grant funds drawn down and recognized as revenue on the H8F grant. There was, however, more than sufficient eligible expenditures when additional indirect costs under an approved indirect cost rate were considered. The Health Center does have a review process in place around federal grant drawdowns, however formal documentation was not maintained to support that review process occurring. Cause: There were insufficient reconciliation procedures in place between the detailed expenditures identified to the grant and the summary schedules used for drawing down federal funds and required reporting. Effect: Had there not been sufficient eligible indirect costs to make up for the deficit between detailed expenditures and grant draws, grant draws would have exceeded the related eligible expenditures, and revenue recorded per the general ledger and SEFA would have been overstated. Without detailed review and approval process, there is greater risk of future errors. Recommendation: We recommend reviewing reconciliation procedures between detailed grant expenditures and summary schedules used in reporting/draw down requests to ensure sufficient detail to support draw downs. Also recommend a detailed review and approval process for federal grant eligible expenditures and draw downs, to identify issues prior to draw down or reporting in the future. Documentation should be retained to support review/approval occurrence. View of responsible officials: No disagreement with the finding. Management will review and improve reconciliation and review process around eligible expenditures for federal grants, and drawdowns of federal funds.

Federal agency: U.S. Department of Health and Human Services Federal program titles: Health Centers Cluster, Provider Relief Fund Assistance Listing Numbers: 93.224/93.527, 93.498 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23, PRF Reporting Period 2 for funds received 7/1/20 – 12/31/20 and used through 12/31/21 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: The Organization did not have sufficient internal control process or review in place over required reporting for federal programs. There was no documentation retained of review occurring before submission of reports. Errors were identified in key line items tested in the UDS report filed for 2021 during the fiscal year 2022. Questioned costs: None. Context: While the Organization has historically had a review process over required federal program reporting, there was no documentation of that review occurring for the reports tested, including FFR reports and UDS report for the community Organization grants, and the required reporting for Provider Relief Funds. For the UDS report, due to an error in supporting schedules, amounts reported in Table 9E, lines 1g and 1q were overstated. There was turnover in key finance positions at the Organization, where historical segregation of duties between preparer and reviewer was not always possible. Cause: Turnover in personnel at the Organization likely led to lapses in review processes that had been in place historically. The lack of detailed review likely resulted in the errors identified in UDS reporting. The Provider Relief Fund grant was also a newer program with unique reporting requirements the Organization had not previously experienced. Effect: Without sufficient review processes in place, there is greater risk of noncompliance or errors in required reporting under federal programs. In the case of the UDS reporting, certain line items were misreported due to errors in supporting spreadsheets. Recommendation: We recommend implementing a formal policy and procedure where there is a review of all required reporting by an individual that did not prepare the report. Documentation should be retained to support the review/approval occurrence. View of responsible officials: No disagreement with the finding. Management will implement a formal review process for reporting and retain documentation of review.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Number: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Cost principles under 2 CFR 200 also do not allow expenditures for individual's wages that exceed a federal compensation limit. Condition: One individual's compensation charged to the federal grant had wages that exceeded federal compensation limits. Questioned costs: $24,920 of wage-related costs exceeding federal limitation. Context: While there was one individual with compensation exceeding federal limits charged to the Organization H8F grant, there were other eligible wage and other expenditures available that could have replaced the overage had it been corrected. Cause: Internal control procedures were not sufficient to identify the wages exceeding federal limits prior to being charged to the federal grant. Effect: Eligible wage expenditures were overstated due to wages that exceed federal limits for one individual. There were other available eligible expenditures sufficient to offset this overstatement, however. Recommendation: We recommend management implement a review process to check individual's compensation charged to federal grants against annual federal limitations prior to drawdown of funds. View of responsible officials: No disagreement with the finding. Management will implement review processes to identify individuals over federal wage limitations moving forward before being charged to federal grants.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Number: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations section 200.320 states the non-Federal entity must have and use documented procurement procedures following specific requirements for different methods of procurement depending on size and type of purchase. Thresholds for these categories (micro-purchase, simplified acquisition threshold) refer to using the Federal Acquisition Regulations (FAR), unless a different threshold has been specifically approved. Specifically, under FAR multiple quotes are generally required for purchases over the micro-purchase threshold, or documentation should be maintained explaining why multiple quotes were not obtained. Condition: During our testing, we noted the Organization had a proper procurement policy that met the federal requirements, but was not able to provide documentation supporting the policy was followed for all vendors selected. Questioned costs: None. Context: In our testing covering three vendors, two of the three the Organization was not able to provide documentation supporting the use of noncompetitive procurement. Based on understanding of the vendors and why they were selected, the vendors used appear reasonable, but there is insufficient documentation to support the Organization's policy was followed. Cause: Turnover in personnel at the Organization likely played a role, but the Organization was also focused on response to the COVID-19 pandemic at the time of vendor procurement. So timeliness was often most important in procuring vendors and related products/services. Effect: Without retaining documentation to support proper compliance with the Organization's policy, there is greater risk of noncompliance or inappropriate vendor selection. Recommendation: We recommend the Organization follow existing policy, but ensure procedures are in place to retain sufficient documentation to support whichever procurement method was utilized in procuring vendors. View of responsible officials: No disagreement with the finding. Management will review procedures to ensure proper procurement methodology is utilized under the Organization's policy, and that sufficient documentation is retained to support procurement method.

Federal agency: U.S. Department of Health and Human Services Federal program title: Health Centers Cluster Assistance Listing Number: 93.224/93.527 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations section 200.214 requires the Center to follow the nonprocurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. The Organization should have policies and procedures in place to ensure contracts or subaward are not provided to third parties that are suspended or disbarred. Condition: During our testing, we noted the Organization had a proper policy around suspension and debarment, but was not able to provide documentation supporting the policy was followed for all vendors selected. Questioned costs: None. Context: In our testing covering three vendors, the Organization was not able to provide documentation supporting the Organization had followed its suspension and debarment policy. All vendors were checked against the exclusion list at the time of audit testing, and none were found to be suspended/debarred. Cause: Turnover in personnel at the Organization likely played a role, but the Organization was also focused on response to the COVID-19 pandemic at the time of vendor procurement. So timeliness was often most important in procuring vendors and related products/services. Effect: Without retaining documentation to support proper compliance with the Organization's policy, there is greater risk of noncompliance or inappropriate vendor selection. Recommendation: We recommend the Organization follow existing policy, but ensure procedures are in place to retain sufficient documentation to support review of vendors against federal exclusion list. View of responsible officials: No disagreement with the finding. Management will review procedures to ensure proper check of vendors is performed against federal exclusion list, and that documentation is maintained to support that review.

Federal agency: U.S. Department of Health and Human Services Federal program titles: Health Centers Cluster, Provider Relief Fund Assistance Listing Numbers: 93.224/93.527, 93.498 Award Period: Varying project and budget periods: 2/1/21 – 1/31/22, 2/1/22 – 1/31/23, 4/1/21 – 3/31/23, PRF Reporting Period 2 for funds received 7/1/20 – 12/31/20 and used through 12/31/21 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: The Organization did not have sufficient internal control process or review in place over required reporting for federal programs. There was no documentation retained of review occurring before submission of reports. Errors were identified in key line items tested in the UDS report filed for 2021 during the fiscal year 2022. Questioned costs: None. Context: While the Organization has historically had a review process over required federal program reporting, there was no documentation of that review occurring for the reports tested, including FFR reports and UDS report for the community Organization grants, and the required reporting for Provider Relief Funds. For the UDS report, due to an error in supporting schedules, amounts reported in Table 9E, lines 1g and 1q were overstated. There was turnover in key finance positions at the Organization, where historical segregation of duties between preparer and reviewer was not always possible. Cause: Turnover in personnel at the Organization likely led to lapses in review processes that had been in place historically. The lack of detailed review likely resulted in the errors identified in UDS reporting. The Provider Relief Fund grant was also a newer program with unique reporting requirements the Organization had not previously experienced. Effect: Without sufficient review processes in place, there is greater risk of noncompliance or errors in required reporting under federal programs. In the case of the UDS reporting, certain line items were misreported due to errors in supporting spreadsheets. Recommendation: We recommend implementing a formal policy and procedure where there is a review of all required reporting by an individual that did not prepare the report. Documentation should be retained to support the review/approval occurrence. View of responsible officials: No disagreement with the finding. Management will implement a formal review process for reporting and retain documentation of review.