Audit 412408

Finding 2025-003 I. Procurement and Suspension and Debarment Identification of the Federal Program: Grantor: Department of Agriculture, Department of Defense, National Aeronautics and Space Administration, Promotion of the Arts Grants to Organizations and Individuals, National Science Foundation, Department of Veteran Affairs, Environmental Protection Agency, Department of Health and Human Services Program Name: Research and Development Cluster Assistance Listing No.: Various Criteria or Specific Requirement: 2 CFR 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 2 CFR 200.214 – Suspension and debarment – Non-Federal entities are subject to the non-procurement debarment and suspension regulations that restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities under 2 CFR 180. 2 CFR 180.300 further states that non-federal entities are responsible for verifying the eligibility of vendors and contractors prior to entering into covered transactions. Condition: Management was unable to provide evidence of a control being consistently performed throughout the entire audit period to address the risk that the System may enter into a transaction with an entity that is suspended, debarred, or otherwise excluded, due to the timing of the implementation of the prior year corrective action plan. We noted the following matters during our testing of suspension and debarment: (a) The System did not obtain a detailed listing of all vendors screened with related results from its third-party service provider. The System received a summarized results report with the total number of vendors screened for suspension and debarment by the third-party service provider. However, a reconciliation was not performed and retained between the vendors provided by the System and the service provider’s summarized results report to evidence that all vendors submitted were screened. (b) The System did not retain evidence of review of the results provided by the third-party service provider, including evidence that unverified vendors or those that were indicated as excluded were investigated and evaluated by the System. (c) The System did not retain evidence of review of new vendors being screened for suspension and debarment prior to entering into a transaction. Cause: The System did not have a process in place for the entire year to review the results of screened vendors to verify that all vendors are screened. Effect or Potential Effect: The lack of effective controls over suspension and debarment has the potential to result in noncompliance with the requirement. By not performing a reconciliation between the listings submitted by the System and the results provided by the third-party service provider, there is a risk that vendors are not screened by the third-party service provider and such vendors used for federally funded activities may be suspended or debarred. Questioned Costs: None identified. Context: Management was unable to provide evidence of a control being consistently performed throughout the entire audit period, as described in the Condition section above. Identification as a repeat finding, if applicable: Yes. Prior year finding 2024-008 Recommendation: Management should enhance the design of the System’s controls related to the screening of new vendors prior to entering into transactions, as well as the on-going monitoring and screening of its vendors for suspension and debarment. In addition, management should perform and retain documentation to support reconciliation of the vendor list submitted to the third-party service provider and the results obtained to support that the screening process is completed for all vendors and that no suspended or debarred vendors are utilized by the System prior to entering into transactions. Views of Responsible Officials: Mount Sinai has taken corrective actions to address this issue which were completed by December 31, 2025. During 2025, the Health System created a process to ensure a vendor is not considered suspended or debarred. All existing vendors in the vendor master file, as well as all newly onboarded vendors through our credentialing process, are screened monthly through our designated sanction screening provider. In addition, we have implemented a new monthly manual control to review, confirm, and reconcile our vendor master against the files submitted to our sanction-screening provider. Our Internal Audit team also performs periodic, independent sanction screening checks on a sample of vendors to validate the accuracy and completeness of the third party screening results.