Audit 397711

Finding No. 2024-005 – Audit requirements for auditees – report submission Federal Program ALN 93.498 Provider Relief Fund - CARES Act ALN 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disaster) Program Name of Federal Agency U.S. Department of Health and Human Services U.S Department of Homeland Security Pass-through Entity Central Office of Recovery Reconstruction and Resiliency (COR3) for ALN 97.036 Category Non-compliance / Significant deficiency in internal controls over compliance Compliance Requirements Reporting Criteria As required by the audit requirements of Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), § 200.512 Report submission (a) (1), “ the audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditors’ report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day”. Condition The data collection form and the reporting package for the year ended on June 30, 2024 was not submitted to the Federal Audit Clearinghouse within the timeframe prescribed by the Uniform Guidance. Cause Accounting and reporting processes are being significantly delayed and thus, the information necessary to complete the financial statement audit procedures was not available within the timeframe prescribed by the Uniform Guidance. Effect As a result of this condition, the federal agencies that have granted funds may issue warnings and/or impose penalties to the Corporation. Also, the federal agencies were prevented from the use of accurate reporting data, which is critical for the effective administration of the federal program and for federal agencies’ budgetary policy analysis. Questioned cost None. Context The Corporation did not comply with the timeframe required to file it’s Uniform Guidance Single Audit Report for the fiscal year ended on June 30, 2024. Identification of a repeat finding This is a repeat finding from the immediate previous audit, Finding No. 2023-006. Recommendation We strongly recommend the Corporation to institute policies and procedures that stipulate the specific tasks and the personnel in charge of filing the required reports. Also, the policies and procedures should designate the member of management in charge of monitoring the compliance with the reporting requirements in order to make sure that the Corporation is filing the reports by their respective due dates. Views of responsible officials and planned corrective actions The Corporation’s management and responsible officers agree with this finding. Please refer to the corrective action plan section for the Corporation’s response on pages 85 to 90.

Finding No. 2024-006 – Purchases and disbursement cycle Federal Program ALN 93.498 Provider Relief Fund - CARES Act Name of Federal Agency U.S. Department of Health and Human Services Category Non-compliance / Material Weakness in internal controls over compliance Compliance Requirement Activities Allowed/Cost Principl Criteria The Purchasing Procedures Manual or “Reglamento de compras” of the Corporation, in its articles 14 “Inicio de las gestiones de compra” and 15 “Subastas informales”, establishes the parameters and process to begin a purchase, that includes the issuance of a purchase requisition as well as of the requirement of a quotation for determined purchases. In addition, 2 CFR §200.302 – Financial Management, states that management must maintain records that sufficiently identify the amount, source, and expenditure of Federal funds for Federal awards. These records must contain information necessary to identify Federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. Also, 2 CFR §200.334 – Retention Requirements for Records, states that the recipient and subrecipient must retain all Federal award records for three years from the date of submission of their final financial report. Records to be retained include but are not limited to, financial records, supporting documentation, and statistical records. Finally, 2 CFR §200.303 – Internal Controls state that the recipient and subrecipient must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition During testing of internal control procedures over purchases and cash disbursements of Provider Relief Funds, we examined processed invoices and payments that lacked properly approved purchase requisitions and quotations. The documents could not be located by management and thus, were not made available for examination. Cause This deficiency is the result of lack of knowledge from the employees and overall absence of implementation, monitoring and proper compliance with internal controls of the Corporation’s procedures. Effect The Corporation did not comply with its purchasing procedures manual. This condition increases the risk of improper or fraudulent purchases, the selection of higher-cost vendors, and other procurement irregularities. Because these transactions were funded with federal awards, this condition also increases the risk of noncompliance with federal requirements and the potential for questioned costs. Questioned cost None. Context During the audit of substantive tests of compliance related to Provider Relief Fund disbursements, from a sample of twenty-five (25) disbursements, we examined twenty-five (25) invoices, in which, six (6) of them lacked an approved requisition, and proper documentation of quotations. Identification of a repeat finding A similar condition was found in the previous audit on Finding 2023-003 which was an Internal Control over Financial Reporting finding. Recommendation We recommend that the Corporation strengthen its internal controls over the purchasing and disbursement processes to ensure compliance with its established policies and procedures. Specifically, all supporting documentation for purchases and cash disbursements should be reviewed for completeness, accuracy, and compliance with procurement requirements prior to the approval and signing of checks. Any exceptions or unusual items should be resolved and documented before payment is processed. In addition, management should implement supervisory review and monitoring procedures to ensure that procurement activities are performed in accordance with the Corporation’s policies and applicable federal requirements. All supporting documentation should be properly maintained to support transactions and facilitate audit and internal review purposes. Views of responsible officials and planned corrective actions The Corporation’s management and responsible officers agree with this finding. Please refer to the corrective action plan section for the Corporation’s response on pages 85 to 90.

Finding No. 2024-007 – Provider Relief Fund Reporting Federal Program ALN 93.498 Provider Relief Fund - CARES Act Name of Federal Agency U.S. Department of Health and Human Services Criteria According to the guidelines governing the Provider Relief Fund (PRF), recipients who received one or more PRF and or American Rescue Plan payments exceeding $10,000, in the aggregate, during a Payment Received Period are required to report in each applicable Reporting Period as outlined in a timetable provided by the Health Resources & Services Administration. The table below is applicable to the funds received by the Corporation: Period Payment Received Period (Payments Exceeding $10,000 in Aggregate Received Period of Availability for Eligible Expenses Period of Availability for Lost Revenues PRF and ARP Rural Portal Reporting Time Period Period 5 January 1, 2022 to June 30, 2022 January 1, 2020 to June 30, 2023 January 1, 2020 to June 30, 2023 July 1, 2023 to September 30, 2023 In addition, CFR 200.334 states that the recipient and subrecipient must retain all Federal award records for three years from the date of submission of their final financial report. For awards that are renewed quarterly or annually, the recipient and subrecipient must retain records for three years from the date of submission of their quarterly or annual financial report, respectively. Records to be retained include but are not limited to, financial records, supporting documentation, and statistical records. Condition The Corporation could not provide evidence that reporting for Period 5 was made within the reporting time period due lack of access to the HRSA (Health Resources and Services Administration) portal. Category Non-compliance / Significant Deficiency in internal controls over compliance. Compliance Requirement Reporting Cause The Corporation did not maintain records that the PRF Portal report was made within the required reporting time period. Currently, management cannot access the portal where the report was submitted and therefore, there is no evidence that the report was submitted in a timely matter. Effect As a result of this condition, the grantor may issue warnings and/or impose penalties to the Corporation. Questioned cost None. Context The Corporation was required to submit the Period 5 report by September 30, 2023. Management provided the report but was not able to provide evidence that submission was made on time. Identification of a repeat finding This is not a repeat finding from the immediate previous audit. Recommendation Management should strengthen its internal controls over the administration and compliance monitoring of federal awards to ensure that all reporting and compliance requirements are met in accordance with program regulations. Specifically, the Corporation should establish formal procedures to track federal reporting deadlines, assign clear responsibility for the preparation and submission of required reports, and ensure continuity of access to federal reporting systems in the event of changes in management or personnel. Management should also implement supervisory review procedures to confirm that required reports are submitted timely and retain appropriate documentation supporting compliance with federal reporting requirements. Additionally, the Corporation should establish and enforce policies requiring that all records related to federal awards be maintained for at least three years after the closeout of the award, in accordance with federal regulations. Views of responsible officials and planned corrective actions The Corporation’s management and responsible officers agree with this finding. Please refer to the corrective action plan section for the Corporation’s response on pages 85 to 90.