Audit 8469

Federal agency: U.S. Department of Health and Human Services Federal program title: Rural Communities Opioid Response Program – Medication Assisted Treatment (MAT) Expansion and COVID-19 Rural Health Clinic Vaccine Confidence Assistance Listing Number: 93.912 Award Period: September 1, 2019 through August 31, 2022 Type of Finding: • Material Weakness in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. The Health System did not have documented formal controls and procedures over compliance with federal awards. Condition: The Health System did not have documented formal review processes over the use of the federal awards or required reporting for the federal awards. Eligible uses of federal awards were tracked in detail, and required reporting under the federal award was completed, but there was not a formal review or approval process in place. Questioned costs: None Context: The Health System maintained detailed records of eligible uses of federal funds for tracking and required reporting purposes. The Health System's CFO maintained this schedule as eligible uses of funds were identified throughout the organization, reviewed activity, and reconciled the schedule to the general ledger. There was not, however, documentation of a formal review or approval, outside of the schedule being maintained and reconciled. Similarly, the Health System CFO completed the required reporting under the federal award based on the schedule discussed above and other supporting documentation, but there was no formal review or approval process for that report. The Health System does have in place review processes and controls over all expenditures (AP, Payroll), they are just not designed specifically to consider compliance with federal programs. Cause: The Health System has not previously received federal awards in an amount sufficient to require an audit under Uniform Guidance. Therefore more formal controls and procedures around the use of federal awards had not been in place. Effect: Without formal control and review processes in place over use of federal funds or required reporting under those awards, there is a greater risk of improper use of funds or misstatement in required reporting. Repeat finding: Yes – 2021-003 Recommendation: We recommend that management implement more formal control process surrounding the use of federal awards where there is segregation between individuals identifying or proposing expenditures/uses of funds and an individual reviewing and approving that expenditure/use. We also recommend for any formal reporting required under federal awards that there be a formal review process where an individual is reviewing and approving the report who did not prepare the report. Documentation of review and approval should be retained in both cases. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Health and Human Services Federal program title: Rural Communities Opioid Response Program – Medication Assisted Treatment (MAT) Expansion and COVID-19 Rural Health Clinic Vaccine Confidence Assistance Listing Number: 93.912 Award Period: September 1, 2019 through August 31, 2022 Type of Finding: • Significant Deficiency in Internal Control over Compliance and Other Matters Criteria or specific requirement: The Code of Federal Regulations section 200.320 states the non-Federal entity must have and use documented procurement procedures following specific requirements for different methods of procurement depending on size and type of purchase. Thresholds for these categories (micro-purchase, simplified acquisition threshold) refer to using the Federal Acquisition Regulations (FAR), unless a different threshold has been specifically approved. Specifically, under FAR multiple quotes are generally required for purchases over the micro-purchase threshold, or documentation should be maintained explaining why multiple quotes were not obtained. Condition: During our testing, we noted the Health System did not have a properly documented procurement policy that met the federal requirements. As a result there were vendors over the micro purchase threshold that were tested where retained documentation was not sufficient to support procurement method or noncompetitive procurement in line with federal requirements. Questioned costs: None Context: The Health System maintained detailed records of eligible uses of federal funds for tracking and required reporting purposes. Eligible expenditures were reviewed by the CFO and followed standard organizational internal control processes (i.e., AP), but ultimately did not follow a procurement policy in line with Uniform Guidance requirements. Cause: The Health System has not previously received federal awards in an amount sufficient to require an audit under Uniform Guidance. Therefore, more formal controls and policies around the use of federal awards had not been in place. Effect: The lack of documented procurement policies over these compliance requirements provides an opportunity for noncompliance. Repeat finding: No Recommendation: We recommend the Health System create and implement a procurement policy that meets the requirements of federal regulations. The Health System should also maintain documentation to support procurement method used and compliance with policy when procuring vendors for federal grant funded projects. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Health and Human Services Federal program title: Rural Communities Opioid Response Program – Medication Assisted Treatment (MAT) Expansion and COVID-19 Rural Health Clinic Vaccine Confidence Assistance Listing Number: 93.912 Award Period: September 1, 2019 through August 31, 2022 Type of Finding: • Significant Deficiency in Internal Control over Compliance and Other Matters Criteria or specific requirement: Per the notice of award, the annual FFR for the MAT grant is due January 30 for budget periods ending in August through October. The Health System's budget period ended on 8/31/21 for the report in question. Condition: The Health System did not have a process in place to ensure timely filing of required reports and report was filed one day late. Questioned costs: None Context: The Health System maintained detailed accounting records to accurately report on annual grant expenditures but did not have a process in place to ensure timely filing of required reports. Cause: The Health System has not previously received federal awards in an amount sufficient to require an audit under Uniform Guidance. Therefore, more formal controls and procedures around the use of federal awards had not been in place. Effect: Without proper control and review processes in place over use of federal funds or required reporting under those awards, there is a greater risk of improper use of funds or misstatement in required reporting. Repeat finding: No Recommendation: We recommend for any formal reporting required under federal awards that there be a formal review process where an individual is reviewing and approving the report who did not prepare the report. Documentation of review and approval should be retained. We also recommend implementing procedures or a schedule to ensure required reporting is filed timely. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Health and Human Services Federal program title: Rural Communities Opioid Response Program – Medication Assisted Treatment (MAT) Expansion and COVID-19 Rural Health Clinic Vaccine Confidence Assistance Listing Number: 93.912 Award Period: September 1, 2019 through August 31, 2022 Type of Finding: • Material Weakness in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. The Health System did not have documented formal controls and procedures over compliance with federal awards. Condition: The Health System did not have documented formal review processes over the use of the federal awards or required reporting for the federal awards. Eligible uses of federal awards were tracked in detail, and required reporting under the federal award was completed, but there was not a formal review or approval process in place. Questioned costs: None Context: The Health System maintained detailed records of eligible uses of federal funds for tracking and required reporting purposes. The Health System's CFO maintained this schedule as eligible uses of funds were identified throughout the organization, reviewed activity, and reconciled the schedule to the general ledger. There was not, however, documentation of a formal review or approval, outside of the schedule being maintained and reconciled. Similarly, the Health System CFO completed the required reporting under the federal award based on the schedule discussed above and other supporting documentation, but there was no formal review or approval process for that report. The Health System does have in place review processes and controls over all expenditures (AP, Payroll), they are just not designed specifically to consider compliance with federal programs. Cause: The Health System has not previously received federal awards in an amount sufficient to require an audit under Uniform Guidance. Therefore more formal controls and procedures around the use of federal awards had not been in place. Effect: Without formal control and review processes in place over use of federal funds or required reporting under those awards, there is a greater risk of improper use of funds or misstatement in required reporting. Repeat finding: Yes – 2021-003 Recommendation: We recommend that management implement more formal control process surrounding the use of federal awards where there is segregation between individuals identifying or proposing expenditures/uses of funds and an individual reviewing and approving that expenditure/use. We also recommend for any formal reporting required under federal awards that there be a formal review process where an individual is reviewing and approving the report who did not prepare the report. Documentation of review and approval should be retained in both cases. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Health and Human Services Federal program title: Rural Communities Opioid Response Program – Medication Assisted Treatment (MAT) Expansion and COVID-19 Rural Health Clinic Vaccine Confidence Assistance Listing Number: 93.912 Award Period: September 1, 2019 through August 31, 2022 Type of Finding: • Significant Deficiency in Internal Control over Compliance and Other Matters Criteria or specific requirement: The Code of Federal Regulations section 200.320 states the non-Federal entity must have and use documented procurement procedures following specific requirements for different methods of procurement depending on size and type of purchase. Thresholds for these categories (micro-purchase, simplified acquisition threshold) refer to using the Federal Acquisition Regulations (FAR), unless a different threshold has been specifically approved. Specifically, under FAR multiple quotes are generally required for purchases over the micro-purchase threshold, or documentation should be maintained explaining why multiple quotes were not obtained. Condition: During our testing, we noted the Health System did not have a properly documented procurement policy that met the federal requirements. As a result there were vendors over the micro purchase threshold that were tested where retained documentation was not sufficient to support procurement method or noncompetitive procurement in line with federal requirements. Questioned costs: None Context: The Health System maintained detailed records of eligible uses of federal funds for tracking and required reporting purposes. Eligible expenditures were reviewed by the CFO and followed standard organizational internal control processes (i.e., AP), but ultimately did not follow a procurement policy in line with Uniform Guidance requirements. Cause: The Health System has not previously received federal awards in an amount sufficient to require an audit under Uniform Guidance. Therefore, more formal controls and policies around the use of federal awards had not been in place. Effect: The lack of documented procurement policies over these compliance requirements provides an opportunity for noncompliance. Repeat finding: No Recommendation: We recommend the Health System create and implement a procurement policy that meets the requirements of federal regulations. The Health System should also maintain documentation to support procurement method used and compliance with policy when procuring vendors for federal grant funded projects. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Health and Human Services Federal program title: Rural Communities Opioid Response Program – Medication Assisted Treatment (MAT) Expansion and COVID-19 Rural Health Clinic Vaccine Confidence Assistance Listing Number: 93.912 Award Period: September 1, 2019 through August 31, 2022 Type of Finding: • Significant Deficiency in Internal Control over Compliance and Other Matters Criteria or specific requirement: Per the notice of award, the annual FFR for the MAT grant is due January 30 for budget periods ending in August through October. The Health System's budget period ended on 8/31/21 for the report in question. Condition: The Health System did not have a process in place to ensure timely filing of required reports and report was filed one day late. Questioned costs: None Context: The Health System maintained detailed accounting records to accurately report on annual grant expenditures but did not have a process in place to ensure timely filing of required reports. Cause: The Health System has not previously received federal awards in an amount sufficient to require an audit under Uniform Guidance. Therefore, more formal controls and procedures around the use of federal awards had not been in place. Effect: Without proper control and review processes in place over use of federal funds or required reporting under those awards, there is a greater risk of improper use of funds or misstatement in required reporting. Repeat finding: No Recommendation: We recommend for any formal reporting required under federal awards that there be a formal review process where an individual is reviewing and approving the report who did not prepare the report. Documentation of review and approval should be retained. We also recommend implementing procedures or a schedule to ensure required reporting is filed timely. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Health and Human Services Federal program title: Rural Communities Opioid Response Program – Medication Assisted Treatment (MAT) Expansion and COVID-19 Rural Health Clinic Vaccine Confidence Assistance Listing Number: 93.912 Award Period: September 1, 2019 through August 31, 2022 Type of Finding: • Material Weakness in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. The Health System did not have documented formal controls and procedures over compliance with federal awards. Condition: The Health System did not have documented formal review processes over the use of the federal awards or required reporting for the federal awards. Eligible uses of federal awards were tracked in detail, and required reporting under the federal award was completed, but there was not a formal review or approval process in place. Questioned costs: None Context: The Health System maintained detailed records of eligible uses of federal funds for tracking and required reporting purposes. The Health System's CFO maintained this schedule as eligible uses of funds were identified throughout the organization, reviewed activity, and reconciled the schedule to the general ledger. There was not, however, documentation of a formal review or approval, outside of the schedule being maintained and reconciled. Similarly, the Health System CFO completed the required reporting under the federal award based on the schedule discussed above and other supporting documentation, but there was no formal review or approval process for that report. The Health System does have in place review processes and controls over all expenditures (AP, Payroll), they are just not designed specifically to consider compliance with federal programs. Cause: The Health System has not previously received federal awards in an amount sufficient to require an audit under Uniform Guidance. Therefore more formal controls and procedures around the use of federal awards had not been in place. Effect: Without formal control and review processes in place over use of federal funds or required reporting under those awards, there is a greater risk of improper use of funds or misstatement in required reporting. Repeat finding: Yes – 2021-003 Recommendation: We recommend that management implement more formal control process surrounding the use of federal awards where there is segregation between individuals identifying or proposing expenditures/uses of funds and an individual reviewing and approving that expenditure/use. We also recommend for any formal reporting required under federal awards that there be a formal review process where an individual is reviewing and approving the report who did not prepare the report. Documentation of review and approval should be retained in both cases. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Health and Human Services Federal program title: Rural Communities Opioid Response Program – Medication Assisted Treatment (MAT) Expansion and COVID-19 Rural Health Clinic Vaccine Confidence Assistance Listing Number: 93.912 Award Period: September 1, 2019 through August 31, 2022 Type of Finding: • Significant Deficiency in Internal Control over Compliance and Other Matters Criteria or specific requirement: The Code of Federal Regulations section 200.320 states the non-Federal entity must have and use documented procurement procedures following specific requirements for different methods of procurement depending on size and type of purchase. Thresholds for these categories (micro-purchase, simplified acquisition threshold) refer to using the Federal Acquisition Regulations (FAR), unless a different threshold has been specifically approved. Specifically, under FAR multiple quotes are generally required for purchases over the micro-purchase threshold, or documentation should be maintained explaining why multiple quotes were not obtained. Condition: During our testing, we noted the Health System did not have a properly documented procurement policy that met the federal requirements. As a result there were vendors over the micro purchase threshold that were tested where retained documentation was not sufficient to support procurement method or noncompetitive procurement in line with federal requirements. Questioned costs: None Context: The Health System maintained detailed records of eligible uses of federal funds for tracking and required reporting purposes. Eligible expenditures were reviewed by the CFO and followed standard organizational internal control processes (i.e., AP), but ultimately did not follow a procurement policy in line with Uniform Guidance requirements. Cause: The Health System has not previously received federal awards in an amount sufficient to require an audit under Uniform Guidance. Therefore, more formal controls and policies around the use of federal awards had not been in place. Effect: The lack of documented procurement policies over these compliance requirements provides an opportunity for noncompliance. Repeat finding: No Recommendation: We recommend the Health System create and implement a procurement policy that meets the requirements of federal regulations. The Health System should also maintain documentation to support procurement method used and compliance with policy when procuring vendors for federal grant funded projects. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Health and Human Services Federal program title: Rural Communities Opioid Response Program – Medication Assisted Treatment (MAT) Expansion and COVID-19 Rural Health Clinic Vaccine Confidence Assistance Listing Number: 93.912 Award Period: September 1, 2019 through August 31, 2022 Type of Finding: • Significant Deficiency in Internal Control over Compliance and Other Matters Criteria or specific requirement: Per the notice of award, the annual FFR for the MAT grant is due January 30 for budget periods ending in August through October. The Health System's budget period ended on 8/31/21 for the report in question. Condition: The Health System did not have a process in place to ensure timely filing of required reports and report was filed one day late. Questioned costs: None Context: The Health System maintained detailed accounting records to accurately report on annual grant expenditures but did not have a process in place to ensure timely filing of required reports. Cause: The Health System has not previously received federal awards in an amount sufficient to require an audit under Uniform Guidance. Therefore, more formal controls and procedures around the use of federal awards had not been in place. Effect: Without proper control and review processes in place over use of federal funds or required reporting under those awards, there is a greater risk of improper use of funds or misstatement in required reporting. Repeat finding: No Recommendation: We recommend for any formal reporting required under federal awards that there be a formal review process where an individual is reviewing and approving the report who did not prepare the report. Documentation of review and approval should be retained. We also recommend implementing procedures or a schedule to ensure required reporting is filed timely. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Health and Human Services Federal program title: Rural Communities Opioid Response Program – Medication Assisted Treatment (MAT) Expansion and COVID-19 Rural Health Clinic Vaccine Confidence Assistance Listing Number: 93.912 Award Period: September 1, 2019 through August 31, 2022 Type of Finding: • Material Weakness in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. The Health System did not have documented formal controls and procedures over compliance with federal awards. Condition: The Health System did not have documented formal review processes over the use of the federal awards or required reporting for the federal awards. Eligible uses of federal awards were tracked in detail, and required reporting under the federal award was completed, but there was not a formal review or approval process in place. Questioned costs: None Context: The Health System maintained detailed records of eligible uses of federal funds for tracking and required reporting purposes. The Health System's CFO maintained this schedule as eligible uses of funds were identified throughout the organization, reviewed activity, and reconciled the schedule to the general ledger. There was not, however, documentation of a formal review or approval, outside of the schedule being maintained and reconciled. Similarly, the Health System CFO completed the required reporting under the federal award based on the schedule discussed above and other supporting documentation, but there was no formal review or approval process for that report. The Health System does have in place review processes and controls over all expenditures (AP, Payroll), they are just not designed specifically to consider compliance with federal programs. Cause: The Health System has not previously received federal awards in an amount sufficient to require an audit under Uniform Guidance. Therefore more formal controls and procedures around the use of federal awards had not been in place. Effect: Without formal control and review processes in place over use of federal funds or required reporting under those awards, there is a greater risk of improper use of funds or misstatement in required reporting. Repeat finding: Yes – 2021-003 Recommendation: We recommend that management implement more formal control process surrounding the use of federal awards where there is segregation between individuals identifying or proposing expenditures/uses of funds and an individual reviewing and approving that expenditure/use. We also recommend for any formal reporting required under federal awards that there be a formal review process where an individual is reviewing and approving the report who did not prepare the report. Documentation of review and approval should be retained in both cases. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Health and Human Services Federal program title: Rural Communities Opioid Response Program – Medication Assisted Treatment (MAT) Expansion and COVID-19 Rural Health Clinic Vaccine Confidence Assistance Listing Number: 93.912 Award Period: September 1, 2019 through August 31, 2022 Type of Finding: • Significant Deficiency in Internal Control over Compliance and Other Matters Criteria or specific requirement: The Code of Federal Regulations section 200.320 states the non-Federal entity must have and use documented procurement procedures following specific requirements for different methods of procurement depending on size and type of purchase. Thresholds for these categories (micro-purchase, simplified acquisition threshold) refer to using the Federal Acquisition Regulations (FAR), unless a different threshold has been specifically approved. Specifically, under FAR multiple quotes are generally required for purchases over the micro-purchase threshold, or documentation should be maintained explaining why multiple quotes were not obtained. Condition: During our testing, we noted the Health System did not have a properly documented procurement policy that met the federal requirements. As a result there were vendors over the micro purchase threshold that were tested where retained documentation was not sufficient to support procurement method or noncompetitive procurement in line with federal requirements. Questioned costs: None Context: The Health System maintained detailed records of eligible uses of federal funds for tracking and required reporting purposes. Eligible expenditures were reviewed by the CFO and followed standard organizational internal control processes (i.e., AP), but ultimately did not follow a procurement policy in line with Uniform Guidance requirements. Cause: The Health System has not previously received federal awards in an amount sufficient to require an audit under Uniform Guidance. Therefore, more formal controls and policies around the use of federal awards had not been in place. Effect: The lack of documented procurement policies over these compliance requirements provides an opportunity for noncompliance. Repeat finding: No Recommendation: We recommend the Health System create and implement a procurement policy that meets the requirements of federal regulations. The Health System should also maintain documentation to support procurement method used and compliance with policy when procuring vendors for federal grant funded projects. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Health and Human Services Federal program title: Rural Communities Opioid Response Program – Medication Assisted Treatment (MAT) Expansion and COVID-19 Rural Health Clinic Vaccine Confidence Assistance Listing Number: 93.912 Award Period: September 1, 2019 through August 31, 2022 Type of Finding: • Significant Deficiency in Internal Control over Compliance and Other Matters Criteria or specific requirement: Per the notice of award, the annual FFR for the MAT grant is due January 30 for budget periods ending in August through October. The Health System's budget period ended on 8/31/21 for the report in question. Condition: The Health System did not have a process in place to ensure timely filing of required reports and report was filed one day late. Questioned costs: None Context: The Health System maintained detailed accounting records to accurately report on annual grant expenditures but did not have a process in place to ensure timely filing of required reports. Cause: The Health System has not previously received federal awards in an amount sufficient to require an audit under Uniform Guidance. Therefore, more formal controls and procedures around the use of federal awards had not been in place. Effect: Without proper control and review processes in place over use of federal funds or required reporting under those awards, there is a greater risk of improper use of funds or misstatement in required reporting. Repeat finding: No Recommendation: We recommend for any formal reporting required under federal awards that there be a formal review process where an individual is reviewing and approving the report who did not prepare the report. Documentation of review and approval should be retained. We also recommend implementing procedures or a schedule to ensure required reporting is filed timely. Views of responsible officials: There is no disagreement with the audit finding.