Audit 354818

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.

Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.