Audit 349473

2022-002 Update Documented Policies and Procedures Over Federal Awards Federal Program Information Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Injury Prevention and Control Research and State and Community Based Programs; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.136, 93.391 Award Year: 2022 Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Cash Management, Procurement, Subrecipient Monitoring Type of Finding Compliance Internal Control over Compliance – Significant Deficiency Criteria or Specific Requirement OMB’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (UG) requirements stipulate that federal award recipients must document their policies and procedures over certain aspects of financial and program management. Specifically, written policies are required for the following: • Determination of allowable costs • Employee travel • Cash management • Procurement • Conflicts of interest • Subrecipient monitoring and management Condition and Context Although the Organization has written policies and procedures related to federal awards, certain areas are not fully in compliance with the requirements of the Uniform Guidance. Cause The Organization has not developed written formal documentation of internal controls to encompass all required areas per the Uniform Guidance. Effect or Potential Effect Due to the weaknesses in internal controls noted above, the Organization did not comply with the requirements of the Uniform Guidance over documented policies and procedures. No questioned costs are reported as this requirement is procedural in nature. Recommendation The Organization should address the weakness noted above and update its policies and procedures related to federal awards in order to comply with the Uniform Guidance. Specific attention should be given to subrecipient monitoring, including required information in subrecipient agreements, references to Uniform Guidance, segregation of duties, and language that explicitly prohibits management override of controls. Views of Responsible Official Management agrees with the finding. Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

2022-002 Update Documented Policies and Procedures Over Federal Awards Federal Program Information Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Injury Prevention and Control Research and State and Community Based Programs; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.136, 93.391 Award Year: 2022 Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Cash Management, Procurement, Subrecipient Monitoring Type of Finding Compliance Internal Control over Compliance – Significant Deficiency Criteria or Specific Requirement OMB’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (UG) requirements stipulate that federal award recipients must document their policies and procedures over certain aspects of financial and program management. Specifically, written policies are required for the following: • Determination of allowable costs • Employee travel • Cash management • Procurement • Conflicts of interest • Subrecipient monitoring and management Condition and Context Although the Organization has written policies and procedures related to federal awards, certain areas are not fully in compliance with the requirements of the Uniform Guidance. Cause The Organization has not developed written formal documentation of internal controls to encompass all required areas per the Uniform Guidance. Effect or Potential Effect Due to the weaknesses in internal controls noted above, the Organization did not comply with the requirements of the Uniform Guidance over documented policies and procedures. No questioned costs are reported as this requirement is procedural in nature. Recommendation The Organization should address the weakness noted above and update its policies and procedures related to federal awards in order to comply with the Uniform Guidance. Specific attention should be given to subrecipient monitoring, including required information in subrecipient agreements, references to Uniform Guidance, segregation of duties, and language that explicitly prohibits management override of controls. Views of Responsible Official Management agrees with the finding. Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

2022-003 Improve Internal Controls Over Timesheet Approvals Federal Program Information Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Injury Prevention and Control Research and State and Community Based Programs; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.136, 93.391 Award Year: 2022 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding Internal Control over Compliance – Significant Deficiency Criteria or Specific Requirement Grantees must provide reasonable assurance that federal awards are expended only for allowable activities and that the costs charged to federal awards are allowable and in accordance with the applicable cost principles. Management of the Organization is also responsible for establishing and maintaining effective internal control over compliance with federal requirements that have a direct and material effect on a federal program. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of perform¬ing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a federal program on a timely basis. Condition and Context During our audit, we tested a sample of forty payroll transactions for each assistance listing number in order to determine if charges were properly approved prior to disbursement. As a result of our testing, it was identified that three of the Executive Director’s timesheets were not approved by a knowledgeable individual under assistance listing number 93.136, and three were not approved under assistance listing number 93.391. Cause The Organization did not have adequate controls in place to ensure approval over all timesheets prior to disbursement and application to federal awards. Effect or Potential Effect Due to the weakness in internal controls noted above, there is a risk that amounts charged to federal awards could not be allowable or in accordance with applicable cost principles. No questioned costs are reported as the auditor obtained approved salary documentation and recalculated the Executive Director’s gross pay and application to federal awards without exception. Recommendation The Organization should address the weaknesses in internal controls noted above in order to provide reasonable assurance that federal awards are expended only for allowable activities, and that the costs charged to federal awards are allowable and in accordance with the applicable cost principles. The Organization should implement controls to ensure that all timesheets are approved to ensure allowability of the costs applied to the federal award. Views of Responsible Official Management agrees with the finding. Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

2022-003 Improve Internal Controls Over Timesheet Approvals Federal Program Information Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Injury Prevention and Control Research and State and Community Based Programs; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.136, 93.391 Award Year: 2022 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding Internal Control over Compliance – Significant Deficiency Criteria or Specific Requirement Grantees must provide reasonable assurance that federal awards are expended only for allowable activities and that the costs charged to federal awards are allowable and in accordance with the applicable cost principles. Management of the Organization is also responsible for establishing and maintaining effective internal control over compliance with federal requirements that have a direct and material effect on a federal program. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of perform¬ing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a federal program on a timely basis. Condition and Context During our audit, we tested a sample of forty payroll transactions for each assistance listing number in order to determine if charges were properly approved prior to disbursement. As a result of our testing, it was identified that three of the Executive Director’s timesheets were not approved by a knowledgeable individual under assistance listing number 93.136, and three were not approved under assistance listing number 93.391. Cause The Organization did not have adequate controls in place to ensure approval over all timesheets prior to disbursement and application to federal awards. Effect or Potential Effect Due to the weakness in internal controls noted above, there is a risk that amounts charged to federal awards could not be allowable or in accordance with applicable cost principles. No questioned costs are reported as the auditor obtained approved salary documentation and recalculated the Executive Director’s gross pay and application to federal awards without exception. Recommendation The Organization should address the weaknesses in internal controls noted above in order to provide reasonable assurance that federal awards are expended only for allowable activities, and that the costs charged to federal awards are allowable and in accordance with the applicable cost principles. The Organization should implement controls to ensure that all timesheets are approved to ensure allowability of the costs applied to the federal award. Views of Responsible Official Management agrees with the finding. Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

2022-004 Improve Controls and Documentation Over Procurement Federal Program Information Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Injury Prevention and Control Research and State and Community Based Programs; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.136, 93.391 Award Year: 2022 Compliance Requirement: Procurement Type of Finding Compliance Internal Control over Compliance – Significant Deficiency Criteria or Specific Requirement OMB’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (UG) requires that grant recipients follow procurement procedures for the acquisition of property or services under a federal award. Grantees are required to comply with certain procurement standards as defined in 2 CFR 200.318. These standards include the requirement that the grantee must use its own documented procurement procedures provided that they conform to applicable federal law. In addition, the grantee must maintain records sufficient to detail the history of procurement. Condition and Context During our audit, we tested a sample of two procurement transactions under assistance listing number 93.136 and one transaction under assistance listing number 93.391 for vendors with expenditures between $10,000 and $49,999 during fiscal year 2022. Of the transactions tested, all were missing supporting documentation to validate justification of why it was sole source as approvals were done verbally between the requestor and the Executive Director. In addition, one transaction under assistance listing number 93.136 did not qualify as meeting the requirements of sole source based on the Organization’s procurement policy. Cause The Organization did not have adequate controls or policies in place to maintain formal evidence of sole source justification and to ensure procurement policy was adhered to. Effect or Potential Effect Due to the weakness in internal controls and compliance finding noted above, there is a risk that contracts may be awarded to vendors in a manner that is not consistent with Federal procurement requirements and the Organization’s procurement policy. No questioned costs are reported as it is not quantifiable. Recommendation The Organization should address the weaknesses in internal controls noted above in order to ensure that federal procurements are conducted in accordance with federal requirements and supporting documentation is maintained to support such conclusion. The Organization should ensure that prior to entering into transactions, a review is performed over vendor selection and all required documentation is retained. Views of Responsible Official Management agrees with the finding. Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

2022-004 Improve Controls and Documentation Over Procurement Federal Program Information Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Injury Prevention and Control Research and State and Community Based Programs; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.136, 93.391 Award Year: 2022 Compliance Requirement: Procurement Type of Finding Compliance Internal Control over Compliance – Significant Deficiency Criteria or Specific Requirement OMB’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (UG) requires that grant recipients follow procurement procedures for the acquisition of property or services under a federal award. Grantees are required to comply with certain procurement standards as defined in 2 CFR 200.318. These standards include the requirement that the grantee must use its own documented procurement procedures provided that they conform to applicable federal law. In addition, the grantee must maintain records sufficient to detail the history of procurement. Condition and Context During our audit, we tested a sample of two procurement transactions under assistance listing number 93.136 and one transaction under assistance listing number 93.391 for vendors with expenditures between $10,000 and $49,999 during fiscal year 2022. Of the transactions tested, all were missing supporting documentation to validate justification of why it was sole source as approvals were done verbally between the requestor and the Executive Director. In addition, one transaction under assistance listing number 93.136 did not qualify as meeting the requirements of sole source based on the Organization’s procurement policy. Cause The Organization did not have adequate controls or policies in place to maintain formal evidence of sole source justification and to ensure procurement policy was adhered to. Effect or Potential Effect Due to the weakness in internal controls and compliance finding noted above, there is a risk that contracts may be awarded to vendors in a manner that is not consistent with Federal procurement requirements and the Organization’s procurement policy. No questioned costs are reported as it is not quantifiable. Recommendation The Organization should address the weaknesses in internal controls noted above in order to ensure that federal procurements are conducted in accordance with federal requirements and supporting documentation is maintained to support such conclusion. The Organization should ensure that prior to entering into transactions, a review is performed over vendor selection and all required documentation is retained. Views of Responsible Official Management agrees with the finding. Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

2022-005 Improve Controls Over Cash Management and Application of Indirect Cost Rate Federal Program Information Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Injury Prevention and Control Research and State and Community Based Programs Assistance Listing Number(s): 93.136 Award Year: 2022 Compliance Requirement: Cash Management, Allowable Costs/Cost Principles Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.391 Award Year: 2022 Compliance Requirement: Cash Management Type of Finding Compliance Internal Control Over Compliance – Significant Deficiency Criteria or Specific Requirement Management of the Organization is responsible for establishing and maintaining effective internal control over compliance with federal requirements that have a direct and material effect on a federal program. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a Federal program on a timely basis. Management of the Organization is also responsible for establishing the appropriate modified total direct cost base and applying the de minimis indirect cost rate accordingly. Condition and Context There is no documented review of requests for reimbursement by an individual that is not involved with preparing the requests. The Director of Finance is both preparing and reviewing requests for reimbursement with no additional oversight. As a result of this, there is also no review over indirect costs charged to the program and the application of the indirect cost rate prior to requests for reimbursement. Cause The Organization did not have adequate controls in place to ensure approval over reimbursement requests prior to submission to the federal agency, including application of the indirect cost rate to the appropriate modified total direct cost base. Effect or Potential Effect Due to the weakness in internal controls noted above, there is a risk that amounts requested to be reimbursed under federal awards could not be allowable or in accordance with applicable cost principles, including application of the indirect cost rate. Questioned Costs Due to the condition noted above, the indirect cost rate was not applied to the appropriate modified total direct cost base and resulted in the following questioned costs. AL Number(s) Name of Federal Program Questioned Costs 93.136 Injury Prevention and Control Research and State and Community Based Programs $35,187 Recommendation The Organization should address the weaknesses in internal controls noted above by requiring two individuals to be involved in requesting reimbursements, and that the review and oversight of reimbursement requests and application of the indirect cost rate be documented. Views of Responsible Official Management agrees with the finding. Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

2022-005 Improve Controls Over Cash Management and Application of Indirect Cost Rate Federal Program Information Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Injury Prevention and Control Research and State and Community Based Programs Assistance Listing Number(s): 93.136 Award Year: 2022 Compliance Requirement: Cash Management, Allowable Costs/Cost Principles Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.391 Award Year: 2022 Compliance Requirement: Cash Management Type of Finding Compliance Internal Control Over Compliance – Significant Deficiency Criteria or Specific Requirement Management of the Organization is responsible for establishing and maintaining effective internal control over compliance with federal requirements that have a direct and material effect on a federal program. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a Federal program on a timely basis. Management of the Organization is also responsible for establishing the appropriate modified total direct cost base and applying the de minimis indirect cost rate accordingly. Condition and Context There is no documented review of requests for reimbursement by an individual that is not involved with preparing the requests. The Director of Finance is both preparing and reviewing requests for reimbursement with no additional oversight. As a result of this, there is also no review over indirect costs charged to the program and the application of the indirect cost rate prior to requests for reimbursement. Cause The Organization did not have adequate controls in place to ensure approval over reimbursement requests prior to submission to the federal agency, including application of the indirect cost rate to the appropriate modified total direct cost base. Effect or Potential Effect Due to the weakness in internal controls noted above, there is a risk that amounts requested to be reimbursed under federal awards could not be allowable or in accordance with applicable cost principles, including application of the indirect cost rate. Questioned Costs Due to the condition noted above, the indirect cost rate was not applied to the appropriate modified total direct cost base and resulted in the following questioned costs. AL Number(s) Name of Federal Program Questioned Costs 93.136 Injury Prevention and Control Research and State and Community Based Programs $35,187 Recommendation The Organization should address the weaknesses in internal controls noted above by requiring two individuals to be involved in requesting reimbursements, and that the review and oversight of reimbursement requests and application of the indirect cost rate be documented. Views of Responsible Official Management agrees with the finding. Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

2022-002 Update Documented Policies and Procedures Over Federal Awards Federal Program Information Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Injury Prevention and Control Research and State and Community Based Programs; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.136, 93.391 Award Year: 2022 Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Cash Management, Procurement, Subrecipient Monitoring Type of Finding Compliance Internal Control over Compliance – Significant Deficiency Criteria or Specific Requirement OMB’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (UG) requirements stipulate that federal award recipients must document their policies and procedures over certain aspects of financial and program management. Specifically, written policies are required for the following: • Determination of allowable costs • Employee travel • Cash management • Procurement • Conflicts of interest • Subrecipient monitoring and management Condition and Context Although the Organization has written policies and procedures related to federal awards, certain areas are not fully in compliance with the requirements of the Uniform Guidance. Cause The Organization has not developed written formal documentation of internal controls to encompass all required areas per the Uniform Guidance. Effect or Potential Effect Due to the weaknesses in internal controls noted above, the Organization did not comply with the requirements of the Uniform Guidance over documented policies and procedures. No questioned costs are reported as this requirement is procedural in nature. Recommendation The Organization should address the weakness noted above and update its policies and procedures related to federal awards in order to comply with the Uniform Guidance. Specific attention should be given to subrecipient monitoring, including required information in subrecipient agreements, references to Uniform Guidance, segregation of duties, and language that explicitly prohibits management override of controls. Views of Responsible Official Management agrees with the finding. Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

2022-002 Update Documented Policies and Procedures Over Federal Awards Federal Program Information Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Injury Prevention and Control Research and State and Community Based Programs; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.136, 93.391 Award Year: 2022 Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Cash Management, Procurement, Subrecipient Monitoring Type of Finding Compliance Internal Control over Compliance – Significant Deficiency Criteria or Specific Requirement OMB’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (UG) requirements stipulate that federal award recipients must document their policies and procedures over certain aspects of financial and program management. Specifically, written policies are required for the following: • Determination of allowable costs • Employee travel • Cash management • Procurement • Conflicts of interest • Subrecipient monitoring and management Condition and Context Although the Organization has written policies and procedures related to federal awards, certain areas are not fully in compliance with the requirements of the Uniform Guidance. Cause The Organization has not developed written formal documentation of internal controls to encompass all required areas per the Uniform Guidance. Effect or Potential Effect Due to the weaknesses in internal controls noted above, the Organization did not comply with the requirements of the Uniform Guidance over documented policies and procedures. No questioned costs are reported as this requirement is procedural in nature. Recommendation The Organization should address the weakness noted above and update its policies and procedures related to federal awards in order to comply with the Uniform Guidance. Specific attention should be given to subrecipient monitoring, including required information in subrecipient agreements, references to Uniform Guidance, segregation of duties, and language that explicitly prohibits management override of controls. Views of Responsible Official Management agrees with the finding. Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

2022-003 Improve Internal Controls Over Timesheet Approvals Federal Program Information Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Injury Prevention and Control Research and State and Community Based Programs; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.136, 93.391 Award Year: 2022 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding Internal Control over Compliance – Significant Deficiency Criteria or Specific Requirement Grantees must provide reasonable assurance that federal awards are expended only for allowable activities and that the costs charged to federal awards are allowable and in accordance with the applicable cost principles. Management of the Organization is also responsible for establishing and maintaining effective internal control over compliance with federal requirements that have a direct and material effect on a federal program. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of perform¬ing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a federal program on a timely basis. Condition and Context During our audit, we tested a sample of forty payroll transactions for each assistance listing number in order to determine if charges were properly approved prior to disbursement. As a result of our testing, it was identified that three of the Executive Director’s timesheets were not approved by a knowledgeable individual under assistance listing number 93.136, and three were not approved under assistance listing number 93.391. Cause The Organization did not have adequate controls in place to ensure approval over all timesheets prior to disbursement and application to federal awards. Effect or Potential Effect Due to the weakness in internal controls noted above, there is a risk that amounts charged to federal awards could not be allowable or in accordance with applicable cost principles. No questioned costs are reported as the auditor obtained approved salary documentation and recalculated the Executive Director’s gross pay and application to federal awards without exception. Recommendation The Organization should address the weaknesses in internal controls noted above in order to provide reasonable assurance that federal awards are expended only for allowable activities, and that the costs charged to federal awards are allowable and in accordance with the applicable cost principles. The Organization should implement controls to ensure that all timesheets are approved to ensure allowability of the costs applied to the federal award. Views of Responsible Official Management agrees with the finding. Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

2022-003 Improve Internal Controls Over Timesheet Approvals Federal Program Information Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Injury Prevention and Control Research and State and Community Based Programs; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.136, 93.391 Award Year: 2022 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding Internal Control over Compliance – Significant Deficiency Criteria or Specific Requirement Grantees must provide reasonable assurance that federal awards are expended only for allowable activities and that the costs charged to federal awards are allowable and in accordance with the applicable cost principles. Management of the Organization is also responsible for establishing and maintaining effective internal control over compliance with federal requirements that have a direct and material effect on a federal program. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of perform¬ing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a federal program on a timely basis. Condition and Context During our audit, we tested a sample of forty payroll transactions for each assistance listing number in order to determine if charges were properly approved prior to disbursement. As a result of our testing, it was identified that three of the Executive Director’s timesheets were not approved by a knowledgeable individual under assistance listing number 93.136, and three were not approved under assistance listing number 93.391. Cause The Organization did not have adequate controls in place to ensure approval over all timesheets prior to disbursement and application to federal awards. Effect or Potential Effect Due to the weakness in internal controls noted above, there is a risk that amounts charged to federal awards could not be allowable or in accordance with applicable cost principles. No questioned costs are reported as the auditor obtained approved salary documentation and recalculated the Executive Director’s gross pay and application to federal awards without exception. Recommendation The Organization should address the weaknesses in internal controls noted above in order to provide reasonable assurance that federal awards are expended only for allowable activities, and that the costs charged to federal awards are allowable and in accordance with the applicable cost principles. The Organization should implement controls to ensure that all timesheets are approved to ensure allowability of the costs applied to the federal award. Views of Responsible Official Management agrees with the finding. Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

2022-004 Improve Controls and Documentation Over Procurement Federal Program Information Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Injury Prevention and Control Research and State and Community Based Programs; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.136, 93.391 Award Year: 2022 Compliance Requirement: Procurement Type of Finding Compliance Internal Control over Compliance – Significant Deficiency Criteria or Specific Requirement OMB’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (UG) requires that grant recipients follow procurement procedures for the acquisition of property or services under a federal award. Grantees are required to comply with certain procurement standards as defined in 2 CFR 200.318. These standards include the requirement that the grantee must use its own documented procurement procedures provided that they conform to applicable federal law. In addition, the grantee must maintain records sufficient to detail the history of procurement. Condition and Context During our audit, we tested a sample of two procurement transactions under assistance listing number 93.136 and one transaction under assistance listing number 93.391 for vendors with expenditures between $10,000 and $49,999 during fiscal year 2022. Of the transactions tested, all were missing supporting documentation to validate justification of why it was sole source as approvals were done verbally between the requestor and the Executive Director. In addition, one transaction under assistance listing number 93.136 did not qualify as meeting the requirements of sole source based on the Organization’s procurement policy. Cause The Organization did not have adequate controls or policies in place to maintain formal evidence of sole source justification and to ensure procurement policy was adhered to. Effect or Potential Effect Due to the weakness in internal controls and compliance finding noted above, there is a risk that contracts may be awarded to vendors in a manner that is not consistent with Federal procurement requirements and the Organization’s procurement policy. No questioned costs are reported as it is not quantifiable. Recommendation The Organization should address the weaknesses in internal controls noted above in order to ensure that federal procurements are conducted in accordance with federal requirements and supporting documentation is maintained to support such conclusion. The Organization should ensure that prior to entering into transactions, a review is performed over vendor selection and all required documentation is retained. Views of Responsible Official Management agrees with the finding. Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

2022-004 Improve Controls and Documentation Over Procurement Federal Program Information Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Injury Prevention and Control Research and State and Community Based Programs; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.136, 93.391 Award Year: 2022 Compliance Requirement: Procurement Type of Finding Compliance Internal Control over Compliance – Significant Deficiency Criteria or Specific Requirement OMB’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (UG) requires that grant recipients follow procurement procedures for the acquisition of property or services under a federal award. Grantees are required to comply with certain procurement standards as defined in 2 CFR 200.318. These standards include the requirement that the grantee must use its own documented procurement procedures provided that they conform to applicable federal law. In addition, the grantee must maintain records sufficient to detail the history of procurement. Condition and Context During our audit, we tested a sample of two procurement transactions under assistance listing number 93.136 and one transaction under assistance listing number 93.391 for vendors with expenditures between $10,000 and $49,999 during fiscal year 2022. Of the transactions tested, all were missing supporting documentation to validate justification of why it was sole source as approvals were done verbally between the requestor and the Executive Director. In addition, one transaction under assistance listing number 93.136 did not qualify as meeting the requirements of sole source based on the Organization’s procurement policy. Cause The Organization did not have adequate controls or policies in place to maintain formal evidence of sole source justification and to ensure procurement policy was adhered to. Effect or Potential Effect Due to the weakness in internal controls and compliance finding noted above, there is a risk that contracts may be awarded to vendors in a manner that is not consistent with Federal procurement requirements and the Organization’s procurement policy. No questioned costs are reported as it is not quantifiable. Recommendation The Organization should address the weaknesses in internal controls noted above in order to ensure that federal procurements are conducted in accordance with federal requirements and supporting documentation is maintained to support such conclusion. The Organization should ensure that prior to entering into transactions, a review is performed over vendor selection and all required documentation is retained. Views of Responsible Official Management agrees with the finding. Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

2022-005 Improve Controls Over Cash Management and Application of Indirect Cost Rate Federal Program Information Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Injury Prevention and Control Research and State and Community Based Programs Assistance Listing Number(s): 93.136 Award Year: 2022 Compliance Requirement: Cash Management, Allowable Costs/Cost Principles Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.391 Award Year: 2022 Compliance Requirement: Cash Management Type of Finding Compliance Internal Control Over Compliance – Significant Deficiency Criteria or Specific Requirement Management of the Organization is responsible for establishing and maintaining effective internal control over compliance with federal requirements that have a direct and material effect on a federal program. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a Federal program on a timely basis. Management of the Organization is also responsible for establishing the appropriate modified total direct cost base and applying the de minimis indirect cost rate accordingly. Condition and Context There is no documented review of requests for reimbursement by an individual that is not involved with preparing the requests. The Director of Finance is both preparing and reviewing requests for reimbursement with no additional oversight. As a result of this, there is also no review over indirect costs charged to the program and the application of the indirect cost rate prior to requests for reimbursement. Cause The Organization did not have adequate controls in place to ensure approval over reimbursement requests prior to submission to the federal agency, including application of the indirect cost rate to the appropriate modified total direct cost base. Effect or Potential Effect Due to the weakness in internal controls noted above, there is a risk that amounts requested to be reimbursed under federal awards could not be allowable or in accordance with applicable cost principles, including application of the indirect cost rate. Questioned Costs Due to the condition noted above, the indirect cost rate was not applied to the appropriate modified total direct cost base and resulted in the following questioned costs. AL Number(s) Name of Federal Program Questioned Costs 93.136 Injury Prevention and Control Research and State and Community Based Programs $35,187 Recommendation The Organization should address the weaknesses in internal controls noted above by requiring two individuals to be involved in requesting reimbursements, and that the review and oversight of reimbursement requests and application of the indirect cost rate be documented. Views of Responsible Official Management agrees with the finding. Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

2022-005 Improve Controls Over Cash Management and Application of Indirect Cost Rate Federal Program Information Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Injury Prevention and Control Research and State and Community Based Programs Assistance Listing Number(s): 93.136 Award Year: 2022 Compliance Requirement: Cash Management, Allowable Costs/Cost Principles Federal Agency: Department of Health and Human Services, Centers for Disease Control and Prevention Award Name(s): Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.391 Award Year: 2022 Compliance Requirement: Cash Management Type of Finding Compliance Internal Control Over Compliance – Significant Deficiency Criteria or Specific Requirement Management of the Organization is responsible for establishing and maintaining effective internal control over compliance with federal requirements that have a direct and material effect on a federal program. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a Federal program on a timely basis. Management of the Organization is also responsible for establishing the appropriate modified total direct cost base and applying the de minimis indirect cost rate accordingly. Condition and Context There is no documented review of requests for reimbursement by an individual that is not involved with preparing the requests. The Director of Finance is both preparing and reviewing requests for reimbursement with no additional oversight. As a result of this, there is also no review over indirect costs charged to the program and the application of the indirect cost rate prior to requests for reimbursement. Cause The Organization did not have adequate controls in place to ensure approval over reimbursement requests prior to submission to the federal agency, including application of the indirect cost rate to the appropriate modified total direct cost base. Effect or Potential Effect Due to the weakness in internal controls noted above, there is a risk that amounts requested to be reimbursed under federal awards could not be allowable or in accordance with applicable cost principles, including application of the indirect cost rate. Questioned Costs Due to the condition noted above, the indirect cost rate was not applied to the appropriate modified total direct cost base and resulted in the following questioned costs. AL Number(s) Name of Federal Program Questioned Costs 93.136 Injury Prevention and Control Research and State and Community Based Programs $35,187 Recommendation The Organization should address the weaknesses in internal controls noted above by requiring two individuals to be involved in requesting reimbursements, and that the review and oversight of reimbursement requests and application of the indirect cost rate be documented. Views of Responsible Official Management agrees with the finding. Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.