FINDING 2023-001 – Material Weakness in Internal Controls over Compliance and Material
Noncompliance
Federal award: U.S. Department of Health and Human Services Provider Relief Fund and American
Rescue Plan Rural Distribution – Assistance Listing Number 93.498
Criteria: According to the Single Audit Act and the Office of Management and Budget (OMB) Uniform
Guidance (2 CFR §200.501), non-federal entities that expend $750,000 of more in federal awards in a year
are required to have a single audit. Schedule of Expenditures of Federal Awards (SEFA) reporting amounts
for the Provider Relief Fund (PRF) and American Rescue Plan (ARP) Rural Distribution program are based
upon the PRF report that is required to be submitted to the HRSA reporting portal. The last day a provider
can use the funds drives inclusion of the PRF amount on the SEFA (OMB Compliance Supplement 2023
4-93.498-9.)
Condition: The Hospital omitted $6,955,649 of Period 4 Provider Relief Funds in its draft SEFA for the
year-ended June 30, 2023. The Hospital did not engage an auditor to perform a single audit of the June 30,
2023 financial statements in a timely manner because the SEFA omissions led it to believe its federal
expenditures were below the threshold that required a single audit.
Cause: The Hospital's current accounting team was unaware of the PRF funds, as they had been fully
expended in a prior fiscal year under a different accounting team and the employee responsible for
monitoring the funds had departed. The team's unfamiliarity with the unique SEFA reporting requirements
for PRF funds, which differ from most other federal programs, led to the oversight.
Effect: The Hospital did not engage an auditor to perform a single audit within the timeline required for
timely single audit submission.
Questioned Costs: None.
Context: The Hospital's staff accountants not aware of the PRF funds, as they had been entirely spent in
a previous fiscal year by a previous accounting team. Unfamiliar with the unique SEFA reporting
requirements for PRF funds, the current team didn't consider reviewing prior year expenditures for potential
inclusion in the current year's SEFA. Typically, federal programs are reported on the SEFA in the year of
expenditure, but PRF funds are an exception, needing to be reported on the last day a provider could use
the funds. The 2023 SEFA draft, prepared by staff accountants without senior management review and
without knowledge of the PRF reporting requirement, led the Hospital to mistakenly believe they were under
the threshold for single audit reporting for the year-ended June 30, 2023.
Repeat finding: No.
Recommendation: We recommend that the Hospital implement controls to review the SEFA prepared by
lower-level accounting staff. We also recommend that the Hospital monitor reporting requirements for
awards of federal funds through the entire life of the award, including identifying changes in reporting
requirements and special reporting requirements imposed by the federal government, and ensuring those
reporting requirements are communicated to those responsible for reviewing the SEFA and determining
whether a Single Audit is required.
Views of responsible officials: Management concurs with the finding and has developed a corrective
action plan.
FINDING 2023-002 – Reporting – Material Weakness in Internal Controls over Compliance and
Material Noncompliance
Federal award: U.S. Department of Health and Human Services Provider Relief Fund and American
Rescue Plan Rural Distribution – Assistance Listing Number 93.498
Criteria: Non-federal entities must maintain internal control to provide reasonable assurance of compliance
with laws, regulations and the provisions of grant agreements and contracts, including reporting
requirements (2 CFR §200.303.) Recipients of Provider Relief Fund payments must submit reports and
maintain documentation as the Secretary determines are needed to ensure compliance with conditions that
are imposed by the Terms and Conditions for the General and Targeted Distributions, the Coronavirus Aid,
relief and Economic Security Act (P.L. 116-136), the Paycheck Protection Program and Health Care
Enhancement Act (P.L. 116-136), and the Consolidated Appropriations Act (Division M of P.L. 116-260.)
Condition: The Hospital’s internal controls over compliance did not consider continuity when key personnel
responsible for performing controls depart. As a result, the Hospital did not timely file the PRF report for
Period 4 PRF funds.
Effect: The Hospital submitted the Period 4 PRF report after the reporting deadline.
Cause: The Hospital’s internal controls over compliance were not designed to ensure continuity of controls
when key personnel departed.
Questioned costs: None.
Context: The CFO was the authorized reporter for the PRF funds and departed the Hospital before filing
the PRF report. There was no process in place to monitor the PRF reporting requirements after the
departure of the authorized reporter. A backup control to monitor the email of former employees for
important emails failed when the personnel responsible for that control also departed. As a result, the
Hospital did not file the Period 4 PRF report and was unaware of the missed deadline until February 2,
2024 when it received two letters of non-compliance from the Health Resources and Services
Administration (HRSA) with a demand for repayment. The Hospital submitted the Phase 4 submission late
on April 30, 2024 and after review, the HRSA rescinded its demand for repayment.
Repeat finding: No.
Recommendation: We recommend the Hospital redesign its internal controls to consider continuity of
controls when key personnel depart.
Views of responsible officials: Management concurs with the finding and has developed a corrective
action plan.
FINDING 2023-001 – Material Weakness in Internal Controls over Compliance and Material
Noncompliance
Federal award: U.S. Department of Health and Human Services Provider Relief Fund and American
Rescue Plan Rural Distribution – Assistance Listing Number 93.498
Criteria: According to the Single Audit Act and the Office of Management and Budget (OMB) Uniform
Guidance (2 CFR §200.501), non-federal entities that expend $750,000 of more in federal awards in a year
are required to have a single audit. Schedule of Expenditures of Federal Awards (SEFA) reporting amounts
for the Provider Relief Fund (PRF) and American Rescue Plan (ARP) Rural Distribution program are based
upon the PRF report that is required to be submitted to the HRSA reporting portal. The last day a provider
can use the funds drives inclusion of the PRF amount on the SEFA (OMB Compliance Supplement 2023
4-93.498-9.)
Condition: The Hospital omitted $6,955,649 of Period 4 Provider Relief Funds in its draft SEFA for the
year-ended June 30, 2023. The Hospital did not engage an auditor to perform a single audit of the June 30,
2023 financial statements in a timely manner because the SEFA omissions led it to believe its federal
expenditures were below the threshold that required a single audit.
Cause: The Hospital's current accounting team was unaware of the PRF funds, as they had been fully
expended in a prior fiscal year under a different accounting team and the employee responsible for
monitoring the funds had departed. The team's unfamiliarity with the unique SEFA reporting requirements
for PRF funds, which differ from most other federal programs, led to the oversight.
Effect: The Hospital did not engage an auditor to perform a single audit within the timeline required for
timely single audit submission.
Questioned Costs: None.
Context: The Hospital's staff accountants not aware of the PRF funds, as they had been entirely spent in
a previous fiscal year by a previous accounting team. Unfamiliar with the unique SEFA reporting
requirements for PRF funds, the current team didn't consider reviewing prior year expenditures for potential
inclusion in the current year's SEFA. Typically, federal programs are reported on the SEFA in the year of
expenditure, but PRF funds are an exception, needing to be reported on the last day a provider could use
the funds. The 2023 SEFA draft, prepared by staff accountants without senior management review and
without knowledge of the PRF reporting requirement, led the Hospital to mistakenly believe they were under
the threshold for single audit reporting for the year-ended June 30, 2023.
Repeat finding: No.
Recommendation: We recommend that the Hospital implement controls to review the SEFA prepared by
lower-level accounting staff. We also recommend that the Hospital monitor reporting requirements for
awards of federal funds through the entire life of the award, including identifying changes in reporting
requirements and special reporting requirements imposed by the federal government, and ensuring those
reporting requirements are communicated to those responsible for reviewing the SEFA and determining
whether a Single Audit is required.
Views of responsible officials: Management concurs with the finding and has developed a corrective
action plan.
FINDING 2023-002 – Reporting – Material Weakness in Internal Controls over Compliance and
Material Noncompliance
Federal award: U.S. Department of Health and Human Services Provider Relief Fund and American
Rescue Plan Rural Distribution – Assistance Listing Number 93.498
Criteria: Non-federal entities must maintain internal control to provide reasonable assurance of compliance
with laws, regulations and the provisions of grant agreements and contracts, including reporting
requirements (2 CFR §200.303.) Recipients of Provider Relief Fund payments must submit reports and
maintain documentation as the Secretary determines are needed to ensure compliance with conditions that
are imposed by the Terms and Conditions for the General and Targeted Distributions, the Coronavirus Aid,
relief and Economic Security Act (P.L. 116-136), the Paycheck Protection Program and Health Care
Enhancement Act (P.L. 116-136), and the Consolidated Appropriations Act (Division M of P.L. 116-260.)
Condition: The Hospital’s internal controls over compliance did not consider continuity when key personnel
responsible for performing controls depart. As a result, the Hospital did not timely file the PRF report for
Period 4 PRF funds.
Effect: The Hospital submitted the Period 4 PRF report after the reporting deadline.
Cause: The Hospital’s internal controls over compliance were not designed to ensure continuity of controls
when key personnel departed.
Questioned costs: None.
Context: The CFO was the authorized reporter for the PRF funds and departed the Hospital before filing
the PRF report. There was no process in place to monitor the PRF reporting requirements after the
departure of the authorized reporter. A backup control to monitor the email of former employees for
important emails failed when the personnel responsible for that control also departed. As a result, the
Hospital did not file the Period 4 PRF report and was unaware of the missed deadline until February 2,
2024 when it received two letters of non-compliance from the Health Resources and Services
Administration (HRSA) with a demand for repayment. The Hospital submitted the Phase 4 submission late
on April 30, 2024 and after review, the HRSA rescinded its demand for repayment.
Repeat finding: No.
Recommendation: We recommend the Hospital redesign its internal controls to consider continuity of
controls when key personnel depart.
Views of responsible officials: Management concurs with the finding and has developed a corrective
action plan.