2023-001 Activities Allowed or Unallowed, Allowable Costs/Cost Principles and Reporting; Federal Agency: U.S. Department of Health and Human Services; Program: COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution (ALN 93.498); Pass-through Entity: N/A; Federal Assistance Identification Number or Pass-Through Number: N/A; Federal Award Year: Year ended June 30, 2023; Type of Finding: Material Weakness in Internal Control over Compliance; Other Matter Compliance Finding; Criteria: 2 CFR 200.303(a) requires that each non-Federal entity must "Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."; In addition, per the Health Resources and Services Administration (HRSA) reporting guidance, providers who accepted provider relief fund (PRF) payments agreed to the Terms and Conditions of the program, which included a requirement to report on the use of funds. Providers who received one or more payments totaling greater than $10,000 in the aggregate during a payment received period must report on use of funds in each applicable reporting period. Condition: UW Health did not maintain effective internal controls over allowable costs, cost principles and reporting for the PRF program for Periods 4 and 5. In addition, during our testing we noted errors in the amount of revenue reported in the portal. This resulted in an overstatement of actual 2020 revenues of $10,000 and an understatement of actual 2021 revenues of $1,000,002 on the Period 4 and Period 5 portal submissions, respectively, for the University of Wisconsin Medical Foundation, Inc. (UWMF). Cause: The client did not perform internal control procedures that had been in place in previous years as much of the information in the PRF submission had been reviewed previously. Effect: Revenue reported in the UWMF's PRF reporting portal was misstated for several quarters, resulting in a total overstatement of actual 2020 revenues of $10,000, and a total understatement of actual 2021 revenues of $1,000,002. However, if the revenues were reported correctly, it would have still resulted in enough lost revenue to fully earn the funds received. Context: The errors were present in the UWMF reporting submissions completed for reporting Period 4 and 5. Questioned Costs: None; Repeat Finding?: No; Recommendation: We recommend management conduct training with individuals involved in the administration of federal and state grants to stress the importance of performing internal control activities for all compliance requirements. View of responsible officials of the auditee: Management agrees with the finding. See corrective action plan.
2023-002 Activities Allowed or Unallowed, Allowable Costs/Cost Principles and Period of Performance; Federal Agency: Department of Health and Human Services; Program: Social Services Research and Demonstration (ALN 93.647); Pass-through Entity: N/A; Federal Assistance Identification Number or Pass-Through Numbers: N/A; Federal Award Years: Year ended June 30, 2023; Type of Finding: Significant Deficiency in Internal Control over Compliance; Criteria: 2 CFR 200.303(a) requires that each non-Federal entity must "Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Expenditures are to be made for allowable activities and must be in accordance with 2 CFR Part 200, Subpart E and must be within the appropriate period of performance. Condition: During our testing, we noted that internal controls were not properly designed over activities allowed or unallowed, allowable costs/cost principles and period of performance to identify program expenditures from other expenditures in the cost center. Additionally, we noted controls were not operating as designed to ensure payroll expenses charged to the program were properly approved. In our sample of 20 payroll expenditures, two had no evidence of timesheet approval. Cause: There are multiple funding sources within the cost center and the client did not consistently use the fund # identifier to distinguish the expenditures that were program expenditures. Also, the client's payroll processing system allows unapproved timesheets to be processed and paid for one pay period before additional internal controls occur. Effect: Due to the issues noted with internal controls, inappropriate expenditures could have been charged to the program. Context: Applies to the entire population of expenditures. In addition, out of the population of payroll expenditures charged to the program, we noted that two out of our sample of 20 had no evidence of timesheet approval. The sample size was based on guidance from chapter 11 of the AICPA Audit Guide, Government Auditing Standards and Single Audits. Questioned Costs: None; Repeat Finding?: No; Recommendation: We recommend that internal controls over activities allowed or unallowed, allowable costs/cost principles and period of performance be strengthened. In addition, we recommend that internal controls in place when timesheets are not approved for more than one pay period be implemented any time a timesheet is not approved and that approval is always obtained. View of responsible officials of the auditee: Management agrees with the finding. See corrective action plan.
2023-003 Procurement; Federal Agency: Department of Health and Human Services; Program: Social Services Research and Demonstration (ALN 93.647); Pass-through Entity: N/A; Federal Assistance Identification Number or Pass-Through Numbers: N/A; Federal Award Years: Year ended June 30, 2023; Type of Finding: Material Weakness in Internal Control over Compliance; Other Matter Compliance Finding; Criteria: 2 CFR 200.303(a) requires that each non-Federal entity must "Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." 2 CFR 200.320 requires that each non-Federal entity must "have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award." Condition: While testing the procurement requirement, we were able to test compensating controls, but noted that internal controls were not properly designed over the procurement requirement. Prior to receiving federal funding beginning in August 2022, the program conducted a request for proposal (RFP) process and began contracting with a vendor. When federal funding was obtained, the vendor was not reevaluated in accordance with the Uniform Guidance to ensure the procurement requirements were being met. In addition, we noted UW Health – Madison’s procurement policy documents do not include all of the information that is required by the Uniform Guidance. Cause: Because the vendor was already in place for the program prior to receiving federal funds, management did not recognize the need to reevaluate the vendor under the requirements of the Uniform Guidance. In addition, management also did not recognize the need to include additional information in its procurement policy documents related to the Uniform Guidance. Effect: Without appropriate internal controls, there is an increased risk of noncompliance related to federal funding. Context: We identified and tested one vendor that was direct and material to the program and related to the procurement and suspension and debarment requirements. The sample size was based on guidance from chapter 11 of the AICPA Audit Guide, Government Auditing Standards and Single Audits.Questioned Costs: None. Repeat Finding?: No; Recommendation: While it was determined that the requirements of the Uniform Guidance were met related to the vendor tested, we suggest that management reevaluate all vendors that were previously used prior to receiving federal funding. In addition, we recommend that management update its procurement policies to incorporate the requirements of the Uniform Guidance. View of responsible officials of the auditee: Management agrees with the finding. See corrective action plan.
2023-001 Activities Allowed or Unallowed, Allowable Costs/Cost Principles and Reporting; Federal Agency: U.S. Department of Health and Human Services; Program: COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution (ALN 93.498); Pass-through Entity: N/A; Federal Assistance Identification Number or Pass-Through Number: N/A; Federal Award Year: Year ended June 30, 2023; Type of Finding: Material Weakness in Internal Control over Compliance; Other Matter Compliance Finding; Criteria: 2 CFR 200.303(a) requires that each non-Federal entity must "Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."; In addition, per the Health Resources and Services Administration (HRSA) reporting guidance, providers who accepted provider relief fund (PRF) payments agreed to the Terms and Conditions of the program, which included a requirement to report on the use of funds. Providers who received one or more payments totaling greater than $10,000 in the aggregate during a payment received period must report on use of funds in each applicable reporting period. Condition: UW Health did not maintain effective internal controls over allowable costs, cost principles and reporting for the PRF program for Periods 4 and 5. In addition, during our testing we noted errors in the amount of revenue reported in the portal. This resulted in an overstatement of actual 2020 revenues of $10,000 and an understatement of actual 2021 revenues of $1,000,002 on the Period 4 and Period 5 portal submissions, respectively, for the University of Wisconsin Medical Foundation, Inc. (UWMF). Cause: The client did not perform internal control procedures that had been in place in previous years as much of the information in the PRF submission had been reviewed previously. Effect: Revenue reported in the UWMF's PRF reporting portal was misstated for several quarters, resulting in a total overstatement of actual 2020 revenues of $10,000, and a total understatement of actual 2021 revenues of $1,000,002. However, if the revenues were reported correctly, it would have still resulted in enough lost revenue to fully earn the funds received. Context: The errors were present in the UWMF reporting submissions completed for reporting Period 4 and 5. Questioned Costs: None; Repeat Finding?: No; Recommendation: We recommend management conduct training with individuals involved in the administration of federal and state grants to stress the importance of performing internal control activities for all compliance requirements. View of responsible officials of the auditee: Management agrees with the finding. See corrective action plan.
2023-002 Activities Allowed or Unallowed, Allowable Costs/Cost Principles and Period of Performance; Federal Agency: Department of Health and Human Services; Program: Social Services Research and Demonstration (ALN 93.647); Pass-through Entity: N/A; Federal Assistance Identification Number or Pass-Through Numbers: N/A; Federal Award Years: Year ended June 30, 2023; Type of Finding: Significant Deficiency in Internal Control over Compliance; Criteria: 2 CFR 200.303(a) requires that each non-Federal entity must "Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Expenditures are to be made for allowable activities and must be in accordance with 2 CFR Part 200, Subpart E and must be within the appropriate period of performance. Condition: During our testing, we noted that internal controls were not properly designed over activities allowed or unallowed, allowable costs/cost principles and period of performance to identify program expenditures from other expenditures in the cost center. Additionally, we noted controls were not operating as designed to ensure payroll expenses charged to the program were properly approved. In our sample of 20 payroll expenditures, two had no evidence of timesheet approval. Cause: There are multiple funding sources within the cost center and the client did not consistently use the fund # identifier to distinguish the expenditures that were program expenditures. Also, the client's payroll processing system allows unapproved timesheets to be processed and paid for one pay period before additional internal controls occur. Effect: Due to the issues noted with internal controls, inappropriate expenditures could have been charged to the program. Context: Applies to the entire population of expenditures. In addition, out of the population of payroll expenditures charged to the program, we noted that two out of our sample of 20 had no evidence of timesheet approval. The sample size was based on guidance from chapter 11 of the AICPA Audit Guide, Government Auditing Standards and Single Audits. Questioned Costs: None; Repeat Finding?: No; Recommendation: We recommend that internal controls over activities allowed or unallowed, allowable costs/cost principles and period of performance be strengthened. In addition, we recommend that internal controls in place when timesheets are not approved for more than one pay period be implemented any time a timesheet is not approved and that approval is always obtained. View of responsible officials of the auditee: Management agrees with the finding. See corrective action plan.
2023-003 Procurement; Federal Agency: Department of Health and Human Services; Program: Social Services Research and Demonstration (ALN 93.647); Pass-through Entity: N/A; Federal Assistance Identification Number or Pass-Through Numbers: N/A; Federal Award Years: Year ended June 30, 2023; Type of Finding: Material Weakness in Internal Control over Compliance; Other Matter Compliance Finding; Criteria: 2 CFR 200.303(a) requires that each non-Federal entity must "Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." 2 CFR 200.320 requires that each non-Federal entity must "have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award." Condition: While testing the procurement requirement, we were able to test compensating controls, but noted that internal controls were not properly designed over the procurement requirement. Prior to receiving federal funding beginning in August 2022, the program conducted a request for proposal (RFP) process and began contracting with a vendor. When federal funding was obtained, the vendor was not reevaluated in accordance with the Uniform Guidance to ensure the procurement requirements were being met. In addition, we noted UW Health – Madison’s procurement policy documents do not include all of the information that is required by the Uniform Guidance. Cause: Because the vendor was already in place for the program prior to receiving federal funds, management did not recognize the need to reevaluate the vendor under the requirements of the Uniform Guidance. In addition, management also did not recognize the need to include additional information in its procurement policy documents related to the Uniform Guidance. Effect: Without appropriate internal controls, there is an increased risk of noncompliance related to federal funding. Context: We identified and tested one vendor that was direct and material to the program and related to the procurement and suspension and debarment requirements. The sample size was based on guidance from chapter 11 of the AICPA Audit Guide, Government Auditing Standards and Single Audits.Questioned Costs: None. Repeat Finding?: No; Recommendation: While it was determined that the requirements of the Uniform Guidance were met related to the vendor tested, we suggest that management reevaluate all vendors that were previously used prior to receiving federal funding. In addition, we recommend that management update its procurement policies to incorporate the requirements of the Uniform Guidance. View of responsible officials of the auditee: Management agrees with the finding. See corrective action plan.