Audit 405426

Finding 2025-001 Program Name: Research and Development Cluster Federal Department/Agency: Various Assistance Listing Number: Various assistance listing numbers Federal Award Year: October 1, 2024 – September 30, 2025 Compliance Requirements: Procurement Criteria Per 2 CFR 200.320, an organization is required to follow simplified acquisition procedures if the aggregate dollar amount of a procurement transaction is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If simplified acquisition procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources. Unless specified by the Federal agency, the recipient or subrecipient may exercise judgment in determining what number is adequate. Condition 40 procurement transactions were selected from all procurement transactions and Brown Health’s records were inspected for compliance with Brown Health’s procurement policy, which satisfied the requirements set forth within 2 CFR 200.320. Of the 40 transactions selected, 21 were transactions between the micro-purchase threshold and the simplified acquisition threshold. For 9 of the 21 procurement transactions selected, evidence could not be located to support that the procurement policy was followed. Specifically, evidence could not be located to support that Brown Health had obtained multiple price or rate quotations for each transaction or had documented its rationale for a sole sourced purchase. Cause As a result of turnover during the fiscal year, internal controls were not operating effectively regarding the retention of procurement documentation evidencing that the procurement policy was followed. Specifically, evidence of the gathering of multiple quotations or sole source justification was not routinely retained. Possible Asserted Effect Absent procurement controls operating effectively, Brown Health could initiate procurement transactions above the micro-purchase threshold without following the requisite protocols, which could result in noncompliance with Federal regulations. Questioned costs None. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding This is not a repeat finding. Recommendation We recommend that Brown Health management strengthen its internal controls over the procurement process to ensure compliance with Federal regulations. Specifically, Brown Health should revise its procurement review procedures to require the retention of evidence of obtaining multiple price quotations or sole source justification. View of Responsible Officials Brown Health management concurs with this finding. Based on the review, the underlying procurement procedures were generally performed in accordance with established policy; however, supporting documentation was not consistently retained to evidence compliance. We have already initiated re-training at the department level and will be performing a detailed review of current purchase history to ensure appropriate documentation is retained. For fiscal year 2026, we will be reviewing all federal grant activity to ensure the appropriate documentation is maintained and/or sole source documentation is prepared including a lookback analysis of expenditures to date that did not retain the proper documentation. Additionally, we will review automated control enhancements within our ERP system where possible to assist in recognizing compliance rules in advance of spend. We will report our results to the granting agency by October 31, 2026.

Program Name: Research and Development Cluster Federal Department/Agency: National Heart, Lung and Blood Institute Assistance Listing Number: 93.837 Federal Award Year: October 1, 2024 – September 30, 2025 Compliance Requirements: Allowability Criteria Congress legislatively mandates a limitation on salary for individuals under National Institutes of Health (NIH) grant and cooperative agreement awards. The mandate appears in the annual appropriation act that provides authority for NIH to incur obligations for a given fiscal year. The amount of salary that can be provided to an individual through grant and cooperative agreement funds cannot exceed Executive Level II of the Federal Executive Pay Scale. For the period from October 1, 2024 to December 31, 2024, the annualized salary cap was $221,900. For the period from January 1, 2025 to September 30, 2025, the annualized salary cap was $225,700. Condition For 1 of the 40 transactions selected for testwork, we identified that the individual’s direct payroll costs allocated to a grant exceeded the NIH salary cap. The individual was identified during the year and the current and future direct payroll costs were appropriately allocated; however, a payroll adjustment was not made for the months prior to identification. This resulted in unallowable direct payroll costs. Cause Although Brown Health’s controls did identify the error during the year, due to the timing of identification in relation to the implementation of a new IT system, Brown Health was unable to make the necessary correction during the fiscal year. Possible Asserted Effect Without the proper operation of an effectively designed system of internal controls, the internal control system cannot be relied upon to effectively prevent or detect noncompliance. Questioned costs $42,232 Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding This is not a repeat finding. Recommendation We recommend that Brown Health management strengthen its internal controls over the monitoring of NIH salary caps and the corresponding process of adjusting direct payroll costs. View of Responsible Officials Brown Health management concurs with this finding. We have already initiated re-training at the department level. For fiscal year 2026, we will perform a detailed review of all salaries charged to federal grants to ensure there is no salary over the cap. Additionally, we will review automated control enhancements within our ERP system where possible to assist in recognizing compliance rules and/or enhance monitoring controls where possible. We will report our results to the granting agency by October 31, 2026.