Audit 326225

2024 – 001: Improper Payroll Calculation Federal Agency: U.S. Department of Energy Federal Program Name: Research & Development Cluster Assistance Listing Number: 81.049 Federal Award Identification Number: DE-SC0023385 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – Per 2 CFR § 200.403, except where otherwise authorized by statute, costs must meet the following general criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award to be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award regarding types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally‐financed and other activities of the non‐Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally‐financed program in either the current or a prior period. (g) Be adequately documented. Condition: The University incorrectly calculated payroll costs charged to the grant after an employee was double paid for the same work hours. Questioned costs: $400. Context: This condition occurred for 1 out of 40 payroll costs selected for testing resulting in $400 being incorrectly charged to the program. Cause: An employee failed to accurately enter time worked into the university timekeeping system for the pay period 5/1/24 – 5/15/24. The employee reported the hours to their department contact on 5/29/24, which was after the pay period had closed and paychecks had already been processed. The department liaison contacted Kronos Support to have the hours added to the timecard retroactively. Kronos Support received confirmation from the employee that the missed hours could be added to the paycheck for 6/14/24.   During payroll processing for 6/14/24, Kronos Support added the missed hours to the employee’s payline on 6/5/24. The department liaison also submitted a CU Special Pay for the same missed hours on 6/5/24. Due to the timing of each separate transaction, Kronos Support did not have visibility into the duplication of the hours. The department failed to identify the duplication during its review of payroll reports. Effect: Expenditures may be incorrectly charged to the program. Repeat Finding: No Recommendation: We recommend that the institution strengthen its internal controls to ensure that expenditures are reviewed and adjusted for, if necessary, in a timely manner. Views of responsible officials: Management acknowledges the finding.

2024 – 002: Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis response Assistance Listing Number: 93.354 Federal Award Identification Number: NU90TP922168, NU90TP921992 Pass-Through Agency: South Carolina Department of Health and Environmental Control Pass-Through Numbers: PH-2-533, CY-19-018 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - Per 2 CFR section 200.332(a), the subaward is to clearly identify to the subrecipient required information, including identification of whether the award is R&D. Condition: The University incorrectly documented the subaward as a Research and Development grant to the subrecipient. Questioned costs: None Context: This condition occurred for 5 out of 5 subawards selected for testing. Cause: Attachment 2 of the Federal Awards Terms and Conditions template of the FDP Cost Reimbursement Subaward includes a field that is pre-selected and defaults to the R&D selection, requiring the field to be unchecked for the subawards that are not classified as R&D. Effect: The subrecipient may not be aware of certain award information in order to comply with federal statutes, regulations, and the terms and conditions of the award and properly classify its schedule of expenditures of federal awards. Repeat Finding: No Recommendation: We recommend the University strengthen its internal controls to ensure that subawards report the correct information. Views of responsible officials: Management acknowledges the finding.

2024 – 002: Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis response Assistance Listing Number: 93.354 Federal Award Identification Number: NU90TP922168, NU90TP921992 Pass-Through Agency: South Carolina Department of Health and Environmental Control Pass-Through Numbers: PH-2-533, CY-19-018 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - Per 2 CFR section 200.332(a), the subaward is to clearly identify to the subrecipient required information, including identification of whether the award is R&D. Condition: The University incorrectly documented the subaward as a Research and Development grant to the subrecipient. Questioned costs: None Context: This condition occurred for 5 out of 5 subawards selected for testing. Cause: Attachment 2 of the Federal Awards Terms and Conditions template of the FDP Cost Reimbursement Subaward includes a field that is pre-selected and defaults to the R&D selection, requiring the field to be unchecked for the subawards that are not classified as R&D. Effect: The subrecipient may not be aware of certain award information in order to comply with federal statutes, regulations, and the terms and conditions of the award and properly classify its schedule of expenditures of federal awards. Repeat Finding: No Recommendation: We recommend the University strengthen its internal controls to ensure that subawards report the correct information. Views of responsible officials: Management acknowledges the finding.

2024 – 001: Improper Payroll Calculation Federal Agency: U.S. Department of Energy Federal Program Name: Research & Development Cluster Assistance Listing Number: 81.049 Federal Award Identification Number: DE-SC0023385 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – Per 2 CFR § 200.403, except where otherwise authorized by statute, costs must meet the following general criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award to be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award regarding types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally‐financed and other activities of the non‐Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally‐financed program in either the current or a prior period. (g) Be adequately documented. Condition: The University incorrectly calculated payroll costs charged to the grant after an employee was double paid for the same work hours. Questioned costs: $400. Context: This condition occurred for 1 out of 40 payroll costs selected for testing resulting in $400 being incorrectly charged to the program. Cause: An employee failed to accurately enter time worked into the university timekeeping system for the pay period 5/1/24 – 5/15/24. The employee reported the hours to their department contact on 5/29/24, which was after the pay period had closed and paychecks had already been processed. The department liaison contacted Kronos Support to have the hours added to the timecard retroactively. Kronos Support received confirmation from the employee that the missed hours could be added to the paycheck for 6/14/24.   During payroll processing for 6/14/24, Kronos Support added the missed hours to the employee’s payline on 6/5/24. The department liaison also submitted a CU Special Pay for the same missed hours on 6/5/24. Due to the timing of each separate transaction, Kronos Support did not have visibility into the duplication of the hours. The department failed to identify the duplication during its review of payroll reports. Effect: Expenditures may be incorrectly charged to the program. Repeat Finding: No Recommendation: We recommend that the institution strengthen its internal controls to ensure that expenditures are reviewed and adjusted for, if necessary, in a timely manner. Views of responsible officials: Management acknowledges the finding.

2024 – 002: Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis response Assistance Listing Number: 93.354 Federal Award Identification Number: NU90TP922168, NU90TP921992 Pass-Through Agency: South Carolina Department of Health and Environmental Control Pass-Through Numbers: PH-2-533, CY-19-018 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - Per 2 CFR section 200.332(a), the subaward is to clearly identify to the subrecipient required information, including identification of whether the award is R&D. Condition: The University incorrectly documented the subaward as a Research and Development grant to the subrecipient. Questioned costs: None Context: This condition occurred for 5 out of 5 subawards selected for testing. Cause: Attachment 2 of the Federal Awards Terms and Conditions template of the FDP Cost Reimbursement Subaward includes a field that is pre-selected and defaults to the R&D selection, requiring the field to be unchecked for the subawards that are not classified as R&D. Effect: The subrecipient may not be aware of certain award information in order to comply with federal statutes, regulations, and the terms and conditions of the award and properly classify its schedule of expenditures of federal awards. Repeat Finding: No Recommendation: We recommend the University strengthen its internal controls to ensure that subawards report the correct information. Views of responsible officials: Management acknowledges the finding.

2024 – 002: Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis response Assistance Listing Number: 93.354 Federal Award Identification Number: NU90TP922168, NU90TP921992 Pass-Through Agency: South Carolina Department of Health and Environmental Control Pass-Through Numbers: PH-2-533, CY-19-018 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - Per 2 CFR section 200.332(a), the subaward is to clearly identify to the subrecipient required information, including identification of whether the award is R&D. Condition: The University incorrectly documented the subaward as a Research and Development grant to the subrecipient. Questioned costs: None Context: This condition occurred for 5 out of 5 subawards selected for testing. Cause: Attachment 2 of the Federal Awards Terms and Conditions template of the FDP Cost Reimbursement Subaward includes a field that is pre-selected and defaults to the R&D selection, requiring the field to be unchecked for the subawards that are not classified as R&D. Effect: The subrecipient may not be aware of certain award information in order to comply with federal statutes, regulations, and the terms and conditions of the award and properly classify its schedule of expenditures of federal awards. Repeat Finding: No Recommendation: We recommend the University strengthen its internal controls to ensure that subawards report the correct information. Views of responsible officials: Management acknowledges the finding.