Finding 2025-004: Non-Compliance with Suspension and Debarment (Significant Deficiency) Federal Agency: National Institute of Health Federal Program: All of Us Research Program Assistance Listing Number: 93.368 Criteria: 2 CFR §200.213 non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. The non-Federal entity must verify that the person with whom you intend to do business with, is not excluded or disqualified, by (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. Condition: We noted that while the Foundation does conduct screenings on all vendors, suppliers and consultants, the date that the screening is conducted is not documented. As such, we are unable to determine if the screening was conducted prior to payment or signing of the contract. Cause: The Foundation does not require that the date the screening is conducted be documented. Effect or Potential Effect: Failure to screen potential and current vendors, suppliers or contractors prior to payment or contract signing increases the potential that Federal funds be inadvertently provided to parties deemed to be suspended or disbarred by the United States Government. Questioned Costs: None noted as this compliance requirement is an administrative reporting requirement that does not impact cost eligibility. Context: Our audit procedures consisted of testwork completed on individual expenditures charged to the Federal awards. The report in which samples were selected was generated directly from the Foundation's general ledger (accounting system). We consider our sample to be representative of the population. The condition appeared to be systematic in nature. Identification as a Repeat Finding: Refer to Finding 2024-004. Recommendation: We recommend that the Foundation revise their policy regarding suspension and debarment to require that all screenings are accompanied by the documented date on which they were conducted.
Finding 2025-005: Reporting (Significant Deficiency) Federal Agency: National Institute of Health Federal Program: All of Us Research Program Assistance Listing Number: 93.368 Criteria: As noted in 2 CFR §200.303 "The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted one instance in which there was no documented approval date of a report, and one instance in which the submission of a report was not timely in accordance with the award agreement. Cause: The Foundation does not have the appropriate internal controls in place to ensure that all internal reviews over reports are documented with a date of review. In addition, the Foundation is lacking internal controls to ensure that all reports are submitted timely in line with award agreement requirements. Effect or Potential Effect: Without proper dating of internal review and approval over reports, there exists the possibility that the review was not done prior to submission and information reported is inaccurate. Untimely submission of reports could result in withholding of funding. Questioned Costs: None noted as this compliance requirement is an administrative reporting requirement that does not impact cost eligibility. Context: Our audit procedures consisted of testwork performed over a sample of reports required to be submitted during the year under audit. We consider our sample to be representative of the population. The issue appears to be systematic in nature. Identification as a Repeat Finding: Refer to finding 2024-005. Recommendation: We recommend that the Foundation ensure that all approvals over performance and financial reporting are documented along with the date of review. In addition, we recommend the Foundation implement procedures to ensure that all reports are submitted within the specific timeframes specified in award agreements.
Finding 2025-006: Timekeeping and Payroll Allocations (Material Weakness) Federal Agency: National Institute of Health Federal Program: All of Us Research Program Assistance Listing Number: 93.368 Criteria: According to 2 CFR Section 200.430(i) charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: i. Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; ii. Be incorporated into the official records of the non-Federal entity; iii. Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; iv. Encompass Federally-assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity’s written policy; v. Comply with the established accounting policies and practices of the non-Federal entity; vii. Support the distribution of the employee’s salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non- Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. viii. Budget estimates (i.e., estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards.” Condition: We noted that while the Foundation does keep timesheets, we noted several instances in which the timesheets lacked evidence of supervisory approval. In addition, we noted several instances in which the timesheet was not dated when approved. In addition, we noted several instances in which an employee's timesheet was not available for examination. Cause: The Foundation does not document their review and approval process consistently over timesheets. In addition, the Foundation does not ensure adequate retention of timesheets or ensure that timesheets are properly completed for all employees. Effect or Potential Effect: Without the proper, documented, approval processes in place over timesheets, there exists the potential for allocation errors. Questioned Costs: Undetermined, as the allocations are based on employee timesheets, but it is undeterminable if those timesheets were truly accurate due to the lack of consistent, documented approval over the timesheets by a supervisor. Context: Our audit procedures consisted of testwork performed over a sample of timesheets submitted during the year under audit. We consider our sample to be representative of the population. The issue appears to be systematic in nature. Identification as a Repeat Finding: Not a repeat finding. Recommendation: We recommend that the Foundation ensure that all approvals over timesheets are clearly documented and dated.
Finding 2025-007: Pre-Award Risk Assessment for Sub-Recipient (Significant Deficiency) Federal Agency: National Institute of Health Federal Program: All of Us Research Program Assistance Listing Number: 93.368 Criteria: As stated in 2 CFR 200.331 part (b), all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures to prescribe to each individual subrecipient. Condition: During our testing performed over subrecipient expenditures, we were unable to obtain evidence that pre-award risk assessment procedures were performed over subrecipients, consistent with 2 CFR §200.332(b). As such, the Foundation did not adequately determine appropriate monitoring procedures over the sub-recipients. Cause: The Foundation does not have established internal controls or policies regarding subrecipients. Effect or Potential Effect: The Organization could inadvertently be engaged in relationships with subrecipients of higher risk without the appropriate level of oversight to ensure subrecipients are expending funds in accordance with the provisions and terms of the subaward. Questioned Costs: None noted as this compliance requirement is a administrative reporting requirement that does not impact cost eligibility. Context: Our audit procedures consisted of substantive testwork over a sample of subrecipients. We consider our sample to be representative of the population. The samples were made using statistical sampling and we believe the condition appeared to be systematic in nature. Identification as a Repeat Finding: Not a repeat finding. Recommendation: We recommend the Foundation formalize internal control procedures and policies with respect to sub-recipient pre-award risk assessment. The risk assessments should be conducted in order to establish appropriate monitoring procedures.
Finding 2025-008: Reporting for Federal Fund and Accountability Transparency Act (Significant Deficiency) Federal Agency: National Institute of Health Federal Program: All of Us Research Program Assistance Listing Number: 93.368 Criteria: In accordance with 2 CFR Chapter 1, Part 170, prime awardees of a Federal grant are required to file a FFATA sub-award report by the end of the month following the month in which the prime awardee awards any sub-award equal to or greater than $30,000 in Federal funds that does not include recovery funds. Condition: We identified three instances in which the Foundation did not submit a sub-recipient's FFATA report. Cause: The Foundation does not have internal policies or procedures outlining the FFATA requirements and management and staff within the Foundation were unaware of the requirement. Effect or Potential Effect: The Foundation was not in compliance with FFATA reporting requirements. Questioned Costs: None noted as this compliance requirement is a administrative reporting requirement that does not impact cost eligibility. Context: We performed statistical sampling procedures over the Foundation's sub-recipients required to be reported under FFATA. We consider this sample representative of the population. Identification as a Repeat Finding: Not a repeat finding. Recommendation: We recommend that the Foundation establish internal policies and procedures with respect to FFATA requirements, clearly communicate FFATA reporting requirements to responsible staff, and conduct regular trainings to ensure that there is an understanding of requirements to be in compliance with FFATA.