CONDITION: During my review of the Borough of Ellwood City’s internal controls over federal awards, I noted that the Borough does not have formal written policies and procedures surrounding the management of their federal award funds. Although not all-inclusive, an example of some of the required polices would include written procedures for procurement, conflict of interest, and allowable costs. CRITERIA: Section 2 CFR 200.303 of the Uniform Guidance requires non-federal entities such as the Borough of Ellwood City to maintain effective internal controls over federal awards. In addition, the Uniform Guidance also recommends these internal controls follow guidance in Standards for Internal Control in the Federal Government (the Green Book), issued by the Comptroller General of the United States. EFFECT: The Borough of Ellwood City is not in compliance with Section 2 CFR 200.303 of the Uniform Guidance which requires non-federal entities to maintain effective internal controls over federal awards. QUESTIONED COST: None CAUSE: It was not readily determinable as to why the Borough of Ellwood City had not formally adopted written policies and procedures surrounding the management of their federal award funds. RECOMMENDATION: I recommend that the Borough of Ellwood City adopt the required written policies and procedures surrounding the management of federal award funds as prescribed by Section 2 CFR 200.303 of the Uniform Guidance. The focus of these policies and procedures should be to ensure that the Borough officials who are responsible for carrying out the objectives of the federal financial award understand 1) the federal statutes, regulations, and terms and conditions of the award, 2) how to evaluate and properly monitor compliance, and 3) the steps to take if noncompliance is identified. VIEWS OF RESPONSIBLE OFFICIALS: The Borough of Ellwood City concurs with the above noted finding and addresses this issue in the ‘Corrective Action Plan’ included within this report.
CONDITION: During my review of the Borough of Ellwood City’s internal controls over federal awards, I noted that the Borough does not have formal written policies and procedures surrounding the management of their federal award funds. Although not all-inclusive, an example of some of the required polices would include written procedures for procurement, conflict of interest, and allowable costs. CRITERIA: Section 2 CFR 200.303 of the Uniform Guidance requires non-federal entities such as the Borough of Ellwood City to maintain effective internal controls over federal awards. In addition, the Uniform Guidance also recommends these internal controls follow guidance in Standards for Internal Control in the Federal Government (the Green Book), issued by the Comptroller General of the United States. EFFECT: The Borough of Ellwood City is not in compliance with Section 2 CFR 200.303 of the Uniform Guidance which requires non-federal entities to maintain effective internal controls over federal awards. QUESTIONED COST: None CAUSE: It was not readily determinable as to why the Borough of Ellwood City had not formally adopted written policies and procedures surrounding the management of their federal award funds. RECOMMENDATION: I recommend that the Borough of Ellwood City adopt the required written policies and procedures surrounding the management of federal award funds as prescribed by Section 2 CFR 200.303 of the Uniform Guidance. The focus of these policies and procedures should be to ensure that the Borough officials who are responsible for carrying out the objectives of the federal financial award understand 1) the federal statutes, regulations, and terms and conditions of the award, 2) how to evaluate and properly monitor compliance, and 3) the steps to take if noncompliance is identified. VIEWS OF RESPONSIBLE OFFICIALS: The Borough of Ellwood City concurs with the above noted finding and addresses this issue in the ‘Corrective Action Plan’ included within this report.
2023-001 Suspension and Debarment Prior Year Finding Number: N/A Year of Finding Origination: 2023 Type of Finding: Internal Control Over Compliance and Compliance Severity of Deficiency: Significant Deficiency and Other Matter Federal Agency: U.S. Department of the Treasury Program: 21.027 COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Award Number and Year: SLFRP0804; 2021 Pass-Through Agency: N/A - Direct Criteria: Title 2 U.S. Code of Federal Regulations § 200.303 states that the auditee must establish and maintain effective internal control over the federal award that provides reasonable assurance that the auditee is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Federal requirements prohibit non-federal entities from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Title 2 U.S. Code of Federal Regulations § 180.300 describes a required verification process. Prior to entering into the transaction, one of the following must be performed: (1) checking SAM.gov exclusions, (2) collecting a certification, or (3) adding a clause or condition to the covered transaction. The County's procurement policy requires staff to verify contractors are not suspended, debarred, or otherwise excluded at SAM.gov. Condition: For two of the five covered transactions tested, the County did not verify for suspended or debarred vendors, in accordance with its policy, prior to entering into the covered transactions. Questioned Costs: None Context: Our sample of covered transactions included three payments to beneficiaries who signed certifications that they were not suspended or debarred in the grant agreements for receipt of their funds. The sample size was based on guidance from Chapter 11 of the AICPA Audit Guide, Government Auditing and Single Audits. Effect: Failure to verify vendors are not suspended, debarred, or otherwise excluded may result in the County entering into a transaction with a vendor that is not authorized to provide goods and services under the federal award. Cause: The County has procedures in place to perform verification and retain documentation, but not all department heads are aware of the procedures or federal requirements. Recommendation: We recommend the County verify and maintain documentation to demonstrate that vendors are not debarred, suspended, or otherwise excluded from conducting business with the County; the County should complete this documentation prior to entering into a covered transaction. In addition, the County should provide training to department heads to ensure staff are aware of federal requirements and County procedures. View of Responsible Official: Concur
2023-002 Eligibility Prior Year Finding Number: N/A Year of Finding Origination: 2023 Type of Finding: Internal Control Over Compliance and Compliance Severity of Deficiency: Material Weakness and Modified Opinion Federal Agency: U.S. Department of Health and Human Services Program: 93.778 Medical Assistance Program Award Number and Year: 2305MN5ADM; 2023 Pass-Through Agency: Minnesota Department of Human Services Criteria: Title 2 U.S. Code of Federal Regulations § 200.303 states that the auditee must establish and maintain effective internal control over the federal award that provides reasonable assurance that the auditee is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The Minnesota Department of Human Services maintains the computer system, MAXIS, which is used by Clay County to support the eligibility determination process. In the case files reviewed for eligibility, not all documentation to support participant eligibility was available or input into MAXIS. The following exceptions were noted in the sample of 40 case files tested: • Two case files had no application on file with the County, and one case file was missing the signature page of the application. • In four case files, the documented method used to verify citizenship in MAXIS was different than documented in the case file. • Four case files had an asset listed in MAXIS that did not match the documentation in the case file. Questioned Costs: Not applicable. The County administers the program, but the State of Minnesota pays benefits to program participants. Context: The State of Minnesota and the County split the eligibility determination process. Pursuant to Minnesota statutes, Clay County performs the “intake function” needed for this program, while the state maintains the MAXIS system, which supports the eligibility determination process. Participants receive benefit payments from the state. The sample size was based on the guidance from chapter 11 of the AICPA Audit Guide, Government Auditing Standards and Single Audits. Effect: The lack of updated information in MAXIS to document verification of key eligibility-determining factors increases the risk that program participants will receive benefits when they are not eligible. Cause: Program personnel entering case data into MAXIS did not obtain and/or update the information in the system. Recommendation: We recommend Clay County implement additional procedures to provide reasonable assurance that all documentation is obtained and properly input or updated in MAXIS. View of Responsible Official: Concur
2023-001 OVERPAYMENTS TO SUBRECIPIENT Federal agency: U.S. Department of Department of Health and Human Services Federal Program Title & Assistance Listing Number: Substance Abuse and Mental Health Services Projects of Regional and National Significance -93.243 Award Period: 12/31/2022 - 12/30/2024 Type of Finding: Significant Deficiency Compliance Areas: Allowable Costs, Cash Management Questioned Costs: None Condition During our testing of subrecipient disbursements, we found that management does not require invoices from subrecipients before making disbursements. Instead, they allocate a predetermined monthly amount based on prorated subaward totals, making adjustments upon receipt of invoices and again at year-end. An error in a subrecipient's invoice led to an overpayment of $27,525 and remained uncorrected during the year. As a result, UVNR over recognized federal revenue by the same amount. An audit adjustment was made to correct both federal expenditures and revenues in 2023. Criteria An improper payment, as defined in 2 CFR §200.1, is any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements. According to §200.303 Internal controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Organization, federal reimbursement requests are completed monthly. Effect Overstatement of federal revenues and expenditures, respectively. The overpayment would also necessitate certain adjustments to the award amounts given to the subrecipient in the following year. Cause Management admittedly overlooked the error in the subrecipient’s submitted invoice during review.
2023-001 Procurement, Suspension, and Debarment Prior Year Finding Number: N/A Year of Finding Origination: 2023 Type of Finding: Internal Control Over Compliance and Compliance Severity of Deficiency: Significant Deficiency and Other Matter Federal Agency: U.S. Department of Health and Human Services Program: 93.104 Comprehensive Community Mental Health Services for Children with Serious Emotional Disturbances (SED) (Journey to Independence) Award Number and Year: 5H79SM082970-03; 2023 and 5H79SM082970-04; 2024 Pass-Through Agency: Direct Award Criteria: Title 2 U.S. Code of Federal Regulations § 200.303 states that the auditee must establish and maintain effective internal control over the federal award that provides reasonable assurance that the auditee is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 2 U.S. Code of Federal Regulations § 200.318(i) states that the non-federal entity must maintain records sufficient to detail the history of procurement. These records will include, but are not necessarily limited to, the following: rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. Federal requirements prohibit non-federal entities from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Title 2 U.S. Code of Federal Regulations § 180.300 describes a required verification process. Prior to entering into the transaction, one of the following must be performed: (1) checking SAM.gov exclusions, (2) collecting a certification, or (3) adding a clause or condition to the covered transaction. PACT’s procurement policy requires that the contractor submit a certification that they are not suspended and debarred and also requires PACT staff to verify the vendor is not suspended, debarred, or otherwise excluded at SAM.gov. Condition: For the one contractor not considered a sole source vendor, PACT obtained three quotes or proposals but did not have documentation supporting the selection of this vendor. In addition, PACT did not collect a certification that the contractor is not suspended or debarred or document its verification that this contractor was not suspended, debarred, or otherwise excluded at SAM.gov before entering into the covered transaction. Questioned Costs: None Context: The majority of costs associated with this federal grant are payroll related with only five vendors providing goods or services that exceeded the micro-purchase threshold ($10,000). Other expenditures incurred are typically not related to contracts. PACT’s policy for non-payroll disbursements requires an approved Expenditure Authorization Form (EAF) as support documenting the reason for the purchase. PACT’s policy does not require documentation supporting the reason for the vendor selection. The sample size was based on guidance from Chapter 11 of the AICPA Audit Guide, Government Auditing and Single Audits. Effect: It cannot be determined that the contracting process was open and fair because PACT did not document the rationale for the contractor selection. It also cannot be determined that an entity was not suspended, debarred, or otherwise excluded because PACT did not document that it performed a search on SAM.gov and did not collect a certification. Cause: PACT was not aware of the requirement to document the reasoning behind its contractor selections and believed obtaining quotes was sufficient. In addition, PACT believed that performing the search was sufficient and that documentation of the search or collection of a certification was not necessary. Revised procedures were in the process of being implemented during 2023. Recommendation: We recommend PACT develop formal procedures to document why a vendor is selected when price is not the sole factor (i.e., checklist or other criteria developed ahead of time). We recommend that PACT keep printouts (with dates) from SAM.gov to support that contractors were not suspended, debarred, or otherwise excluded prior to entering into covered transactions and collect certifications as required by policy. View of Responsible Official: Acknowledge
FINDING 2023-002 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Reporting Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): FY2021 Compliance Requirement: Reporting Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Recipients are required to submit quarterly or annually Project and Expenditure (P&E) reports to the U.S. Department of the Treasury (Treasury). The reporting periods, as well as the respective due dates, are based upon type of recipient and its population, as well as the recipient's allocation amount. Information to be reported includes projects funded, expenditures, and contracts for the appropriate reporting period. INDIANA STATE BOARD OF ACCOUNTS 16 WAYNE COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) The County was classified as a metropolitan county with a population below 250,000 residents that received an allocation of more than $10 million in Coronavirus State and Local Fiscal Recovery Funds (SLFRF). Therefore, quarterly P&E reports were due by January 31, 2022, and the last day of the month after the end of each quarter thereafter. The County filed the applicable quarterly P&E reports as required; however, the ARP Grant Manager prepared and submitted the reports without an oversight or review process in place to prevent, or detect and correct, errors. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause A proper system of internal controls was not designed by management of the County, which would include segregation of key functions. Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the County's management of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. There was no indication of an internal control process over reporting in place per inquiry with the officials and review of the reports. Effect Without the proper design or implementation of the components of a system of internal controls, including policies and procedures that provide segregation of duties and additional oversight as needed, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the County design and implement a proper system of internal controls, including policies and procedures that would provide segregation of duties to ensure that appropriate reviews, approvals, and oversight are taking place so that the County continues to provide the Treasury with complete and accurate information in the P&E report. INDIANA STATE BOARD OF ACCOUNTS 17 WAYNE COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
Identification of the Federal Program: Grantor: U.S Department of Defense, U.S. Department of Health and Human Services Program Name: Research and Development Cluster Assistance Listing No. / FAIN / Pass-Through Entity (if applicable) / Pass-Through Entity Identifying Number (if applicable): 12.420 / W81XWH2110945 / Royal Institution for the Advancement of Learning / McGill University / PT89891 93.847 / RC2DK125960 93.847 / UC2DK126021 / MDI Biological Laboratory / UC2DK126021-04/ROGOSIN 93.847 / U01DK123786 / University of Washington / UWSC11731 Criteria or Specific Requirement: In accordance with Title 2 U.S. Code of Federal Regulations, Part 200.303, Internal controls, “Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition: Management was unable to provide evidence of a control being consistently performed throughout the audit period to address the risk that the Institute may enter into a covered transaction with an entity that is suspended, debarred, or otherwise excluded. Cause: Management has established a monthly suspension and debarment screening process for activities associated with the Institute’s Research and Development Cluster. However, the process was not designed effectively to ensure that all entities with which the Institute may enter into a covered transaction are included in the monthly screening process. Effect or Potential Effect: The lack of an effective control over suspension and debarment has the potential to result in noncompliance with the requirement. Questioned Costs: None. Context: The Institute assesses vendors upon initial entry into the Institute’s procurement system and performs a monthly screening of the vendors to determine if they are either suspended, debarred or otherwise excluded. The Institute utilizes a third-party service provider to perform the monthly screening of its vendors by providing a file of all vendors from the Institute’s procurement system. For the two months subject to our testing, upon receipt of the output report of screened vendors from the service provider, the Institute did not validate that its full list of vendors sent to the service provider was appropriately screened. For the two months tested, we noted that there were discrepancies between the Institute’s vendor list and the number of vendors screened. Additionally, from a sample of five vendors with activity associated with the Institute’s Research and Development Cluster drawn from our transactional tests of compliance, we noted that evidence of the monthly screening could not be provided for one vendor. In our further testing of compliance, we independently noted no suspended or debarred vendors. Identification as a repeat finding: This finding was reported as finding 2022-002 in the prior year. Recommendation: Management should further enhance the design of its control to ensure that all vendors and subrecipients associated with the Institute’s Research and Development Cluster are subject to the monthly suspension and debarment screening process by performing a monthly reconciliation of the vendor list submitted to the third-party service provider and the screening results output report provided by the service provider. Views of Responsible Officials: Management concurs with this audit finding and will continue to enhance the suspension and debarment review process and controls to meet the requirements of 2 CFR part 200.
Identification of the Federal Program: Grantor: U.S Department of Defense, U.S. Department of Health and Human Services Program Name: Research and Development Cluster Assistance Listing No. / FAIN / Pass-Through Entity (if applicable) / Pass-Through Entity Identifying Number (if applicable): 12.420 / W81XWH2110945 / Royal Institution for the Advancement of Learning / McGill University / PT89891 93.847 / RC2DK125960 93.847 / UC2DK126021 / MDI Biological Laboratory / UC2DK126021-04/ROGOSIN 93.847 / U01DK123786 / University of Washington / UWSC11731 Criteria or Specific Requirement: In accordance with Title 2 U.S. Code of Federal Regulations, Part 200.303, Internal controls, “Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition: Management was unable to provide evidence of a control being consistently performed throughout the audit period to address the risk that the Institute may enter into a covered transaction with an entity that is suspended, debarred, or otherwise excluded. Cause: Management has established a monthly suspension and debarment screening process for activities associated with the Institute’s Research and Development Cluster. However, the process was not designed effectively to ensure that all entities with which the Institute may enter into a covered transaction are included in the monthly screening process. Effect or Potential Effect: The lack of an effective control over suspension and debarment has the potential to result in noncompliance with the requirement. Questioned Costs: None. Context: The Institute assesses vendors upon initial entry into the Institute’s procurement system and performs a monthly screening of the vendors to determine if they are either suspended, debarred or otherwise excluded. The Institute utilizes a third-party service provider to perform the monthly screening of its vendors by providing a file of all vendors from the Institute’s procurement system. For the two months subject to our testing, upon receipt of the output report of screened vendors from the service provider, the Institute did not validate that its full list of vendors sent to the service provider was appropriately screened. For the two months tested, we noted that there were discrepancies between the Institute’s vendor list and the number of vendors screened. Additionally, from a sample of five vendors with activity associated with the Institute’s Research and Development Cluster drawn from our transactional tests of compliance, we noted that evidence of the monthly screening could not be provided for one vendor. In our further testing of compliance, we independently noted no suspended or debarred vendors. Identification as a repeat finding: This finding was reported as finding 2022-002 in the prior year. Recommendation: Management should further enhance the design of its control to ensure that all vendors and subrecipients associated with the Institute’s Research and Development Cluster are subject to the monthly suspension and debarment screening process by performing a monthly reconciliation of the vendor list submitted to the third-party service provider and the screening results output report provided by the service provider. Views of Responsible Officials: Management concurs with this audit finding and will continue to enhance the suspension and debarment review process and controls to meet the requirements of 2 CFR part 200.
Identification of the Federal Program: Grantor: U.S Department of Defense, U.S. Department of Health and Human Services Program Name: Research and Development Cluster Assistance Listing No. / FAIN / Pass-Through Entity (if applicable) / Pass-Through Entity Identifying Number (if applicable): 12.420 / W81XWH2110945 / Royal Institution for the Advancement of Learning / McGill University / PT89891 93.847 / RC2DK125960 93.847 / UC2DK126021 / MDI Biological Laboratory / UC2DK126021-04/ROGOSIN 93.847 / U01DK123786 / University of Washington / UWSC11731 Criteria or Specific Requirement: In accordance with Title 2 U.S. Code of Federal Regulations, Part 200.303, Internal controls, “Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition: Management was unable to provide evidence of a control being consistently performed throughout the audit period to address the risk that the Institute may enter into a covered transaction with an entity that is suspended, debarred, or otherwise excluded. Cause: Management has established a monthly suspension and debarment screening process for activities associated with the Institute’s Research and Development Cluster. However, the process was not designed effectively to ensure that all entities with which the Institute may enter into a covered transaction are included in the monthly screening process. Effect or Potential Effect: The lack of an effective control over suspension and debarment has the potential to result in noncompliance with the requirement. Questioned Costs: None. Context: The Institute assesses vendors upon initial entry into the Institute’s procurement system and performs a monthly screening of the vendors to determine if they are either suspended, debarred or otherwise excluded. The Institute utilizes a third-party service provider to perform the monthly screening of its vendors by providing a file of all vendors from the Institute’s procurement system. For the two months subject to our testing, upon receipt of the output report of screened vendors from the service provider, the Institute did not validate that its full list of vendors sent to the service provider was appropriately screened. For the two months tested, we noted that there were discrepancies between the Institute’s vendor list and the number of vendors screened. Additionally, from a sample of five vendors with activity associated with the Institute’s Research and Development Cluster drawn from our transactional tests of compliance, we noted that evidence of the monthly screening could not be provided for one vendor. In our further testing of compliance, we independently noted no suspended or debarred vendors. Identification as a repeat finding: This finding was reported as finding 2022-002 in the prior year. Recommendation: Management should further enhance the design of its control to ensure that all vendors and subrecipients associated with the Institute’s Research and Development Cluster are subject to the monthly suspension and debarment screening process by performing a monthly reconciliation of the vendor list submitted to the third-party service provider and the screening results output report provided by the service provider. Views of Responsible Officials: Management concurs with this audit finding and will continue to enhance the suspension and debarment review process and controls to meet the requirements of 2 CFR part 200.
Identification of the Federal Program: Grantor: U.S Department of Defense, U.S. Department of Health and Human Services Program Name: Research and Development Cluster Assistance Listing No. / FAIN / Pass-Through Entity (if applicable) / Pass-Through Entity Identifying Number (if applicable): 12.420 / W81XWH2110945 / Royal Institution for the Advancement of Learning / McGill University / PT89891 93.847 / RC2DK125960 93.847 / UC2DK126021 / MDI Biological Laboratory / UC2DK126021-04/ROGOSIN 93.847 / U01DK123786 / University of Washington / UWSC11731 Criteria or Specific Requirement: In accordance with Title 2 U.S. Code of Federal Regulations, Part 200.303, Internal controls, “Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition: Management was unable to provide evidence of a control being consistently performed throughout the audit period to address the risk that the Institute may enter into a covered transaction with an entity that is suspended, debarred, or otherwise excluded. Cause: Management has established a monthly suspension and debarment screening process for activities associated with the Institute’s Research and Development Cluster. However, the process was not designed effectively to ensure that all entities with which the Institute may enter into a covered transaction are included in the monthly screening process. Effect or Potential Effect: The lack of an effective control over suspension and debarment has the potential to result in noncompliance with the requirement. Questioned Costs: None. Context: The Institute assesses vendors upon initial entry into the Institute’s procurement system and performs a monthly screening of the vendors to determine if they are either suspended, debarred or otherwise excluded. The Institute utilizes a third-party service provider to perform the monthly screening of its vendors by providing a file of all vendors from the Institute’s procurement system. For the two months subject to our testing, upon receipt of the output report of screened vendors from the service provider, the Institute did not validate that its full list of vendors sent to the service provider was appropriately screened. For the two months tested, we noted that there were discrepancies between the Institute’s vendor list and the number of vendors screened. Additionally, from a sample of five vendors with activity associated with the Institute’s Research and Development Cluster drawn from our transactional tests of compliance, we noted that evidence of the monthly screening could not be provided for one vendor. In our further testing of compliance, we independently noted no suspended or debarred vendors. Identification as a repeat finding: This finding was reported as finding 2022-002 in the prior year. Recommendation: Management should further enhance the design of its control to ensure that all vendors and subrecipients associated with the Institute’s Research and Development Cluster are subject to the monthly suspension and debarment screening process by performing a monthly reconciliation of the vendor list submitted to the third-party service provider and the screening results output report provided by the service provider. Views of Responsible Officials: Management concurs with this audit finding and will continue to enhance the suspension and debarment review process and controls to meet the requirements of 2 CFR part 200.
Identification of the Federal Program: Grantor: U.S Department of Defense, U.S. Department of Health and Human Services Program Name: Research and Development Cluster Assistance Listing No. / FAIN / Pass-Through Entity (if applicable) / Pass-Through Entity Identifying Number (if applicable): 12.420 / W81XWH2110945 / Royal Institution for the Advancement of Learning / McGill University / PT89891 93.847 / RC2DK125960 93.847 / UC2DK126021 / MDI Biological Laboratory / UC2DK126021-04/ROGOSIN 93.847 / U01DK123786 / University of Washington / UWSC11731 Criteria or Specific Requirement: In accordance with Title 2 U.S. Code of Federal Regulations, Part 200.303, Internal controls, “Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition: Management was unable to provide evidence of a control being consistently performed throughout the audit period to address the risk that the Institute may enter into a covered transaction with an entity that is suspended, debarred, or otherwise excluded. Cause: Management has established a monthly suspension and debarment screening process for activities associated with the Institute’s Research and Development Cluster. However, the process was not designed effectively to ensure that all entities with which the Institute may enter into a covered transaction are included in the monthly screening process. Effect or Potential Effect: The lack of an effective control over suspension and debarment has the potential to result in noncompliance with the requirement. Questioned Costs: None. Context: The Institute assesses vendors upon initial entry into the Institute’s procurement system and performs a monthly screening of the vendors to determine if they are either suspended, debarred or otherwise excluded. The Institute utilizes a third-party service provider to perform the monthly screening of its vendors by providing a file of all vendors from the Institute’s procurement system. For the two months subject to our testing, upon receipt of the output report of screened vendors from the service provider, the Institute did not validate that its full list of vendors sent to the service provider was appropriately screened. For the two months tested, we noted that there were discrepancies between the Institute’s vendor list and the number of vendors screened. Additionally, from a sample of five vendors with activity associated with the Institute’s Research and Development Cluster drawn from our transactional tests of compliance, we noted that evidence of the monthly screening could not be provided for one vendor. In our further testing of compliance, we independently noted no suspended or debarred vendors. Identification as a repeat finding: This finding was reported as finding 2022-002 in the prior year. Recommendation: Management should further enhance the design of its control to ensure that all vendors and subrecipients associated with the Institute’s Research and Development Cluster are subject to the monthly suspension and debarment screening process by performing a monthly reconciliation of the vendor list submitted to the third-party service provider and the screening results output report provided by the service provider. Views of Responsible Officials: Management concurs with this audit finding and will continue to enhance the suspension and debarment review process and controls to meet the requirements of 2 CFR part 200.
2023-001 Finding – Federal Award Type: Subrecipient Monitoring – Non-Compliance and Significant Deficiency in Internal Control Over Compliance. (Partial repeat of finding 2022-02) Identification of Federal Program: Research and Development Cluster: AL Number: 81.086 Conservation Research and Development Program Criteria / Requirement: 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. In accordance with 2 CFR section 200.332, a pass-through entity must clearly identify to the subrecipient the award as a subaward by providing the required federal information related to the award, all requirements imposed by the pass-through entity on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the provisions of contracts and grants agreements. The pass-through entity must evaluate risk of non-compliance of each subrecipient, monitoring the subrecipient and ensuring accountability of for-profit subrecipients. Condition / Context: Forth passed through $1,026,831 in funding to subrecipients under Assistance Listing 81.086. During our audit, we noted that Forth did not have documented written procedures or controls in place to ensure compliance with the U.S. Office of Management and Budget’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) subrecipient monitoring requirements. Improvements were made to subrecipient monitoring in 2023, and a policy was established in 2024. It was noted that within subaward contracts, required federal contract information was provided. Further, subrecipients are being evaluated for risk of non-compliance, prior to engaging in a subcontract. While monitoring has improved, as Forth is having regular meetings to ensure tasks are being completed timely and providing technical assistance when needed, it was noted that in the sample of four subrecipients one subrecipient was subject to 2 CFR Subpart F and the audit for this entity was not obtained. Per 2 CFR 200.332(d)(2) & (3), an entity must ensure that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, highlighting the status of action planned or taken to address Single Audit Finding related to the subaward. Further, they must issue a management decision for applicable audit findings. Cause: Procedures were not in place to ensure that Forth is maintaining proper subrecipient monitoring for each federal subrecipient. Effect: Failure to maintain sufficient subrecipient monitoring may result in the wrongful use of federal funds and non‐compliance with the provisions of applicable requirements of the federal award. Questioned Costs: None. Recommendation: The Organization should establish written policies and procedures regarding the contracting and monitoring of subrecipients that are in line with Uniform Guidance requirements, as well as establish organizational controls to ensure that such policies and procedures are being followed. Management’s response: We agree with the auditor’s comments and will implement the following action steps to improve the situation. We will create and document a procedure which ensures we obtain audits on an annual basis from our subrecipients. This procedure will be implemented by October 31, 2024
2023-002 Finding – Federal Award Type: Cash Management (Invoices) – Material Weakness in Internal Control over Compliance. (Repeat 2022-003) Identification of Federal Program: Research and Development Cluster: AL Number: 81.086 Conservation Research and Development Program Criteria / Requirement: 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition / Context: It was noted during the audit that there were insufficient internal controls over invoices submitted for cost reimbursement related to federal grants as invoices were created and approved by one individual. While the internal controls were insufficient, our sample of invoices did not contain errors or undocumented amounts. Cause: Procedures were not in place to ensure that Forth is maintaining adequate internal controls over compliance in regards to cash management requirements. Key duties and functions are not segregated among organization personnel and internal control policies and procedures are inadequate to properly define the roles and responsibilities of accounting personnel performing key functions. Effect: Failure to maintain sufficient internal controls over invoices submitted for cost reimbursement related to federal grants may result in the wrongful use of federal funds and/or non‐compliance with the provisions of applicable requirements. Questioned Costs: None. Recommendation: The Organization should establish written policies and procedures regarding invoicing for cost-reimbursement related to federal grants which include proper segregation of duties. Management’s response: We agree with the auditor’s comments, and the following actions have been or will be taken to improve the situation. We hired a Grants Accountant in 2024 to take over the responsibility of preparing invoices for cost-reimbursement. This allows for the additional control of the Senior Finance Manager reviewing the invoices. This review is now being documented in writing. Additionally, there are procedures in place to ensure if the Senior Finance Manager prepares the invoice, the Director of Finance & Operations reviews and documents approval of the invoice. We will establish written policies and procedures to document this process by October 31, 2024.
2023-003 Finding – Federal Award Type: Reporting (Special Reporting – FFATA / FSRS) – Material Non-Compliance and Material Weakness in Internal Control over Compliance. (Repeat 2022-003) Identification of Federal Program: Research and Development Cluster: AL Number: 81.086 Conservation Research and Development Program Criteria / Requirement: 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The subawards meeting the above definition are to be reported no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition / Context: During 2023, Forth entered into 18 first-tier subawards greater than $30,000. KT tested 4 of these subawards, noting that these were reported under the Federal Funding Accountability and Transparency Act to the Federal Subaward Reporting System. However, the reports submitted were not made within the required timeframe. Cause: Procedures were not in place to ensure that Forth is maintaining adequate internal controls over compliance in regards to federal special reporting. Procedures are not in place to track and report first-tier subawards. Effect: Failure to maintain sufficient internal controls and proper procedures, including tracking over reporting first-tier subawards may result in wrongful use of federal funds and non-compliance with federal awards. Questioned Costs: None. Recommendation: The Organization should establish written policies and procedures regarding first-tier subawards including tracking and proper internal control procedures. Management’s response: We agree with the auditor’s comments and the following actions have been taken to improve the situation. We hired a Contracts & Compliance Manager in 2024 who is now responsible for reporting first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) by the reporting due date. Additionally, we established written policies and procedures regarding first-tier subawards including tracking and proper internal control procedures.
2023-004 Finding – Federal Award Type: Allowable Costs – Non-Compliance and Material Weakness in Internal Control over Compliance. Identification of Federal Program: Research and Development Cluster: AL Number: 81.086 Conservation Research and Development Program Criteria / Requirement: 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition / Context: It was noted during the audit that there were insufficient internal controls over expenses recorded through allocations related to federal grants, as allocation journal entries were created and posted by one individual. Of 25 expenditures sampled, 12 were allocation journal entries. The payroll allocation journal entries are a manual process in which time is tracked per timesheets but then is input into a workbook to allocate expenses to funders based on percentage of time dedicated to certain programs. Of the 10 allocated payroll expenditures, there were 2 instances where the payrate used to calculate the allocation did not match the approved current payrate with the associated employee. Cause: Procedures were not in place to ensure that Forth is maintaining adequate internal controls over compliance in regards to allocated expenditures. Additionally, the manual process in which these allocations are calculated leaves open the possibility of misallocating amounts among funders. Effect: Failure to maintain sufficient internal controls and proper procedures may result in over-allocation or under-allocation of expenditures related federal awards and non-compliance with federal awards. Questioned Costs: None. Recommendation: The Organization should establish written policies and procedures regarding allocation processes, including ensuring internal controls are in place. It would also be beneficial to eliminate or reduce the amount of manual inputs into the allocation process. Management’s response: We agree with the auditor’s comments, and the following action will be taken to improve the situation. We will establish written policies and procedures regarding allocation processes, including ensuring internal controls are in place by November 30, 2024. Simultaneously, we will also consider options to eliminate or reduce the amount of manual inputs into the allocation process.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
FINDING 2023-003 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Period of Performance Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): FY 2023 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Period of Performance Audit Findings: Material Weakness, Modified Opinion Condition and Context Recipients may use COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (SLFRF) funds for any eligible expenses subject to the restrictions set forth in sections 602 and 603 of the Social Security Act as added by section 9901 of the American Rescue Plan Act of 2021 and amended by the Consolidated Appropriations Act of 2023. The SLFRF program provides substantial flexibility for each recipient to meet local needs within seven separate eligible use categories. Recipients may use SLFRF funds to: Respond to the COVID-19 public health emergency and its negative economic impacts; Respond to workers performing essential work during the COVID-19 public health emergency by providing premium pay to eligible workers of eligible employers that have eligible workers who are performing essential work; Provide government services, to the extent COVID-19 caused a reduction in revenues collected in the most recent full fiscal year of the recipient; Make necessary investments in water, sewer, or broadband infrastructure; Provide emergency relief from natural disasters or their negative economic impacts; Fund eligible Surface Transportation projects; and Fund Title I projects that are eligible activities under the Community Development Block Grant and Indiana Community Development Block Grant programs. As part of sound management of the federal award, the City was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The City did not properly design or implement such a system. The City elected to receive the standard revenue loss allowance, allowing it to claim its total SLFRF allocation of $2,290,914 as revenue loss to use for government services. The allocated funds may only be used to cover costs incurred from the period beginning on March 3, 2021, and ending on December 31, 2024. Obligations for costs incurred are required to be liquidated no later than December 31, 2026 (the end of the period of performance). During the audit period, the City completed three separate transfers of SLFRF funds from the ARPA Coronavirus Local Fiscal fund to the Comm Crossing Grant Fund and Water Utility-Operating funds, totaling $976,431 and $494,159, respectively. The transfers allowed for federal grant funds to be commingled with other grant and operating funds. Subsequently, expenditures were disbursed from the Comm Crossing Grant Fund and Water Utility-Operating funds. However, since the transfer of SLFRF funds into the Comm Crossing Grant Fund and Water Utility-Operating funds commingled receipts, and the City did not ensure there was an appropriate system of internal controls in place to account for the federal expenditures separately from other grant and operating expenditures, we were unable to determine a complete population of federal expenditures. Without a complete population of expenditures, we were unable to determine the City's compliance with the Activities Allowed or Unallowed, the Allowable Costs/Cost Principles, and the Period of Performance compliance requirements. As such, the $976,431 and $494,159 transferred from the ARPA Coronavirus Local Fiscal fund are considered questioned costs. The lack of internal controls and appropriate documentation to test the compliance requirements was isolated to the situation described above. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.300(b) states in part: "The non-Federal entity is responsible for complying with all requirements of the Federal award. . . ." 2 CFR 200.302 states in part: "(a) Each state must expend and account for the Federal award in accordance with state laws and procedures for expending and accounting for the state's own funds. In addition, the state's and the other non-Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. . . . (b) The financial management system of each non-Federal entity must provide for the following . . . (1) Identification, in its accounts, of all Federal awards received and expended and the Federal programs under which they were received. Federal program and Federal award identification must include, as applicable, the Assistance Listings title and number, Federal award identification number and year, name of the Federal agency, and name of the pass-through entity, if any. (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . . (3) Records that identify adequately the source and application of funds for federallyfunded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. (4) Effective control over, and accountability for, all funds, property, and other assets. . . ." Cause Due to the lack of internal controls, the City was unable to differentiate expenditures made from federal and nonfederal funds once it commingled other grant, operating, and federal grant awards into a single fund within its ledger without consideration of the need to separately identify and account for federal expenditures. Effect Without the proper implementation of an effectively designed system of internal controls, the Town cannot identify the expenditures paid with federal grant funds. As such the Town cannot ensure nor can we determine that expenditures of the grant were not unallowable and fell within the period of performance. Questioned Costs We identified $1,470,590 in known questioned costs as noted above in the Condition and Context. Recommendation We recommended that management of the City establish a system of internal controls to ensure that grant award funds are accounted for and tracked in a designated grant fund. All activity of the grant should be in this fund with supporting documentation for each transaction. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.