Audit 400220

Finding 2025-001 Controls over Revenue Recognition and Review / Preparation of the SEFA Finding Type Significant deficiency in internal control over financial reporting, other matters compliance finding, and significant deficiency in internal control over compliance. Criteria Organizations should maintain internal control to provide for the recognition of revenue in accordance with the provisions of U.S. Generally Accepted Accounting Principles (GAAP). In addition, Section 200.510(b) of 2 CFR Part 200 (the Uniform Guidance) requires recipients of federal awards to prepare a complete and accurate schedule of expenditures of federal awards (SEFA). Condition and Context During the audit, upon management’s completion of the final SEFA reconciliations, it was determined that an adjusting entry was required in order to reduce recognized federal awards revenue in the financial statements and expenditures on the SEFA for the year ended September 30, 2025 by $407,237. Cause ASTHO did not timely complete its final reconciliation of total federal award revenue to total federal award expenses. Effect Had the error not been corrected, Federal award revenue and the SEFA expenditures would have been overstated by $407,237. Repeat Finding No. Recommendation We recommend that ASTHO implement a procedure to provide for the reconciliation of total federal award revenue to the total federal award expenses on a monthly basis. This should reduce the likelihood of similar future errors. Views of Responsible Officials and Planned Corrective Action See attached corrective action plan. Questioned Costs None.

Finding 2025-002 Subrecipient Monitoring Finding Type Other matters compliance finding and significant deficiency in internal control over compliance. Agency U.S. Department of Health and Human Services Assistance Listing Numbers 93.421, Strengthening Public Health Systems and Services through National Partnerships to Improve and Protect the Nation’s Health 93.078, Strengthening Emergency Care Delivery in the United States Healthcare System through Health Information and Promotion Criteria Section 200.332(c) of the Uniform Guidance requires recipients of federal awards to evaluate each subrecipient’s risk of noncompliance for the purpose of determining the appropriate subrecipient monitoring related to the subaward. One of the risk assessment procedures includes considering whether or not a subrecipient receives a Single audit and the extent to which the same or similar subawards have been audited as a major program. In addition, Section 200.332(e)(2) of the Uniform Guidance requires pass-through entities to ensure that subrecipients take corrective action on all significant developments that negatively affect the subaward, including Single Audit findings related to the subaward. Condition and Context During our audit procedures, we selected four subrecipients for subrecipient monitoring procedures testing. We noted that during the year ended September 30, 2025, ASTHO had not asked these subrecipients if they had Single Audits. Likewise, during the year ended September 30, 2025, ASTHO had not obtained copies of the subrecipients’ most recent Single Audits. However, ASTHO performed other subrecipient monitoring procedures such as checking for debarment, reviewing documentation for reimbursement requests, and obtaining progress reports from the subrecipients. Cause ASTHO did not complete its procedures to annually obtain and review the required information related to its subrecipients’ Single Audits. Effect ASTHO was not in compliance with the subrecipient monitoring requirements of the Uniform Guidance. However, the other subrecipient monitoring procedures performed by ASTHO served to mitigate the risk of a material noncompliance related to the major programs. Repeat Finding No. Recommendation We recommend that ASTHO implement a procedure to allow for the consistent ability to obtain and review the required Single Audit information from its subrecipients on an annual basis. Views of Responsible Officials and Planned Corrective Action See attached corrective action plan. Questioned Costs None.