Findings and Questioned Costs Relating to Federal Awards Finding Reference Number: 2025-001 Bassett Health Network Research and Development Cluster (93.262) Federal Award Number: U54OH007542, 23U01OH012656, R01OH011668, U13OH01282 Federal Award Year: 2025 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness and Material Noncompliance Prior Year Finding: N/A Statistically Valid Sample: No Criteria Title 2 of the Code of Federal Regulations, Part 200 — Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200) section 200.332(c) states a passthrough entity should evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider: 1) The subrecipient’s prior experience with the same or similar subawards; 2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; 3) Whether the subrecipient has new personnel or new or substantially changed systems; and 4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). Further, 2 CFR 200.332(e) states that a pass-through entity must monitor the activities of a subrecipient as necessary to ensure compliance with Federal statutes, regulations, and subaward terms and conditions and to ensure the goals and objectives of the subaward are achieved. At a minimum, monitoring must include: (1) Reviewing financial and performance reports; (2) Ensuring the subrecipient takes corrective action on significant developments that negatively affect the subaward (including relevant Single Audit findings, other audit findings, site visits, and written notifications of adverse conditions); (3) Issuing a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity, as required by § 200.521; and (4) Resolving audit findings specifically related to the subaward. Additionally, 2 CFR 200.332(f) states a pass-through must, depending upon the pass-through entity's assessment of the risk posed by the subrecipient (as described in 2 CFR 200.332(c)), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; (2) Performing site visits to review the subrecipient's program operations; and (3) Arranging for agreed-upon-procedures engagements as described in 2 CFR 200.425. Also, 2 CFR 200.332(g) requires the pass-through entity to verify that a subrecipient is audited as required by Subpart F of Part 200. Lastly 2 CFR 200.303(a) states, recipient and subrecipients of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During the year ended December 31, 2025 Bassett Health Network (the Network) passed through $166,774 of federal funding to subrecipients as it relates to the Research and Development Cluster. As part of our testing related to subrecipient monitoring, we identified the following: A. For 3 out of 3 subrecipients selected for testwork, the Network was unable to provide support evidencing the evaluation of the subrecipients’ fraud risk and risk of noncompliance risk. B. For 3 out of 3 subrecipients selected for testwork, the Network was unable to provide evidence of considering or performing additional monitoring procedures based on the subrecipient’s risk evaluation. C. For 3 out of 3 subrecipients selected for testwork, the Network was unable to provide evidence that the Network reviewed that the subrecipient receives a Single Audit in accordance with subpart F. Cause The cause of the condition was a lack of sufficiently documented and implemented policies, procedures, and internal controls to ensure that required subrecipient monitoring activities were performed and adequately documented in accordance with federal requirements. Effect Failure to perform annual risk assessments to determine appropriate subrecipient monitoring procedures, as well as failure to verify and review subrecipient Single Audit reports, may result in insufficient oversight to detect subrecipient noncompliance with Federal statutes, regulations, and the terms and conditions of the award. Further, the lack of timely audit reviews limits the Network’s ability to ensure subrecipients take prompt corrective action on significant developments or deficiencies affecting the subaward. Questioned Costs None. Recommendation We recommend the Network develop written policies and procedures to ensure that all required subrecipient monitoring activities, both identified through risk assessments and through review of Single Audits, are consistently performed and adequately documented in accordance with Federal requirements and the terms and conditions of the subawards. Such documentation should provide clear and sufficient evidence that required risk assessment and monitoring procedures have been completed, including documentation that demonstrates what was performed, when it was performed, who performed it, the results of the monitoring activities, and any follow‑up actions or issues identified, as applicable. View of Responsible Officials Recommendation accepted. Please see corrective action plan.