Audit 405741

Type of Finding Compliance Internal Control over Compliance – Significant Deficiency Criteria or Specific Requirement According to 2 CFR Section 200.512(a) of the Uniform Guidance, auditees are required to submit the audit report and Data Collection Form (DCF) to the Federal Audit Clearinghouse (FAC) within the earlier of 30 calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition and Context The DCF was not submitted by its due date of June 30, 2024. Cause Delays in the audit process led to the delay in the federal single audit being completed. Effect or Potential Effect Delays in the audit resulted in the FAC deadline being missed. Failure to submit the single audit report timely constitutes noncompliance with federal audit requirements. No questioned costs are reported as this requirement is administrative in nature. Recommendation Improve the timeliness of financial information and submit the DCF by the due date. Views of Responsible Official Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

Federal Program Information Federal Agency: U.S. Department of Health and Human Services Award Name: COVID-19 Medical Assistance Program Assistance Listing Number(s): 93.778 Award Year: 2023 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding Internal Control Over Compliance – Significant Deficiency Criteria or Specific Requirement Management of the Organization is responsible for establishing and maintaining effective internal control over compliance with federal requirements that have a direct and material effect on a federal program. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a Federal program on a timely basis. Management of the Organization is also responsible for establishing the appropriate modified total direct cost base and applying the de minimis indirect cost rate appropriately. Condition and Context There is no documented review of the application of the de minimis indirect cost rate by someone independent of the calculation process. Cause The Organization did not have adequate controls in place to ensure proper application of the de minimis indirect cost rate to the appropriate modified total direct cost base. Effect or Potential Effect There is a risk that the de minimis indirect cost rate may be applied in a manner that does not comply with applicable cost principles, potentially resulting in unallowable costs. No questioned costs are reported as this is an internal control over compliance finding. Recommendation The Organization should address the weakness in internal controls noted above by requiring two individuals to be involved in the application of the de minimis indirect cost rate, and that the review be documented. Views of Responsible Official Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.