Identification of the Federal Program: Grantor: U.S Department of Defense, U.S. Department of Health and Human Services Program Name: Research and Development Cluster Assistance Listing No. / FAIN / Pass-Through Entity (if applicable) / Pass-Through Entity Identifying Number (if applicable): 12.420 / W81XWH2110945 / Royal Institution for the Advancement of Learning / McGill University / PT89891 93.847 / RC2DK125960 93.847 / UC2DK126021 / MDI Biological Laboratory / UC2DK126021-04/ROGOSIN 93.847 / U01DK123786 / University of Washington / UWSC11731 Criteria or Specific Requirement: In accordance with Title 2 U.S. Code of Federal Regulations, Part 200.303, Internal controls, “Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition: Management was unable to provide evidence of a control being consistently performed throughout the audit period to address the risk that the Institute may enter into a covered transaction with an entity that is suspended, debarred, or otherwise excluded. Cause: Management has established a monthly suspension and debarment screening process for activities associated with the Institute’s Research and Development Cluster. However, the process was not designed effectively to ensure that all entities with which the Institute may enter into a covered transaction are included in the monthly screening process. Effect or Potential Effect: The lack of an effective control over suspension and debarment has the potential to result in noncompliance with the requirement. Questioned Costs: None. Context: The Institute assesses vendors upon initial entry into the Institute’s procurement system and performs a monthly screening of the vendors to determine if they are either suspended, debarred or otherwise excluded. The Institute utilizes a third-party service provider to perform the monthly screening of its vendors by providing a file of all vendors from the Institute’s procurement system. For the two months subject to our testing, upon receipt of the output report of screened vendors from the service provider, the Institute did not validate that its full list of vendors sent to the service provider was appropriately screened. For the two months tested, we noted that there were discrepancies between the Institute’s vendor list and the number of vendors screened. Additionally, from a sample of five vendors with activity associated with the Institute’s Research and Development Cluster drawn from our transactional tests of compliance, we noted that evidence of the monthly screening could not be provided for one vendor. In our further testing of compliance, we independently noted no suspended or debarred vendors. Identification as a repeat finding: This finding was reported as finding 2022-002 in the prior year. Recommendation: Management should further enhance the design of its control to ensure that all vendors and subrecipients associated with the Institute’s Research and Development Cluster are subject to the monthly suspension and debarment screening process by performing a monthly reconciliation of the vendor list submitted to the third-party service provider and the screening results output report provided by the service provider. Views of Responsible Officials: Management concurs with this audit finding and will continue to enhance the suspension and debarment review process and controls to meet the requirements of 2 CFR part 200.
Identification of the Federal Program: Grantor: U.S Department of Defense, U.S. Department of Health and Human Services Program Name: Research and Development Cluster Assistance Listing No. / FAIN / Pass-Through Entity (if applicable) / Pass-Through Entity Identifying Number (if applicable): 12.420 / W81XWH2110945 / Royal Institution for the Advancement of Learning / McGill University / PT89891 93.847 / RC2DK125960 93.847 / UC2DK126021 / MDI Biological Laboratory / UC2DK126021-04/ROGOSIN 93.847 / U01DK123786 / University of Washington / UWSC11731 Criteria or Specific Requirement: In accordance with Title 2 U.S. Code of Federal Regulations, Part 200.303, Internal controls, “Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition: Management was unable to provide evidence of a control being consistently performed throughout the audit period to address the risk that the Institute may enter into a covered transaction with an entity that is suspended, debarred, or otherwise excluded. Cause: Management has established a monthly suspension and debarment screening process for activities associated with the Institute’s Research and Development Cluster. However, the process was not designed effectively to ensure that all entities with which the Institute may enter into a covered transaction are included in the monthly screening process. Effect or Potential Effect: The lack of an effective control over suspension and debarment has the potential to result in noncompliance with the requirement. Questioned Costs: None. Context: The Institute assesses vendors upon initial entry into the Institute’s procurement system and performs a monthly screening of the vendors to determine if they are either suspended, debarred or otherwise excluded. The Institute utilizes a third-party service provider to perform the monthly screening of its vendors by providing a file of all vendors from the Institute’s procurement system. For the two months subject to our testing, upon receipt of the output report of screened vendors from the service provider, the Institute did not validate that its full list of vendors sent to the service provider was appropriately screened. For the two months tested, we noted that there were discrepancies between the Institute’s vendor list and the number of vendors screened. Additionally, from a sample of five vendors with activity associated with the Institute’s Research and Development Cluster drawn from our transactional tests of compliance, we noted that evidence of the monthly screening could not be provided for one vendor. In our further testing of compliance, we independently noted no suspended or debarred vendors. Identification as a repeat finding: This finding was reported as finding 2022-002 in the prior year. Recommendation: Management should further enhance the design of its control to ensure that all vendors and subrecipients associated with the Institute’s Research and Development Cluster are subject to the monthly suspension and debarment screening process by performing a monthly reconciliation of the vendor list submitted to the third-party service provider and the screening results output report provided by the service provider. Views of Responsible Officials: Management concurs with this audit finding and will continue to enhance the suspension and debarment review process and controls to meet the requirements of 2 CFR part 200.
2023-001 Finding – Federal Award Type: Subrecipient Monitoring – Non-Compliance and Significant Deficiency in Internal Control Over Compliance. (Partial repeat of finding 2022-02) Identification of Federal Program: Research and Development Cluster: AL Number: 81.086 Conservation Research and Development Program Criteria / Requirement: 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. In accordance with 2 CFR section 200.332, a pass-through entity must clearly identify to the subrecipient the award as a subaward by providing the required federal information related to the award, all requirements imposed by the pass-through entity on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the provisions of contracts and grants agreements. The pass-through entity must evaluate risk of non-compliance of each subrecipient, monitoring the subrecipient and ensuring accountability of for-profit subrecipients. Condition / Context: Forth passed through $1,026,831 in funding to subrecipients under Assistance Listing 81.086. During our audit, we noted that Forth did not have documented written procedures or controls in place to ensure compliance with the U.S. Office of Management and Budget’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) subrecipient monitoring requirements. Improvements were made to subrecipient monitoring in 2023, and a policy was established in 2024. It was noted that within subaward contracts, required federal contract information was provided. Further, subrecipients are being evaluated for risk of non-compliance, prior to engaging in a subcontract. While monitoring has improved, as Forth is having regular meetings to ensure tasks are being completed timely and providing technical assistance when needed, it was noted that in the sample of four subrecipients one subrecipient was subject to 2 CFR Subpart F and the audit for this entity was not obtained. Per 2 CFR 200.332(d)(2) & (3), an entity must ensure that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, highlighting the status of action planned or taken to address Single Audit Finding related to the subaward. Further, they must issue a management decision for applicable audit findings. Cause: Procedures were not in place to ensure that Forth is maintaining proper subrecipient monitoring for each federal subrecipient. Effect: Failure to maintain sufficient subrecipient monitoring may result in the wrongful use of federal funds and non‐compliance with the provisions of applicable requirements of the federal award. Questioned Costs: None. Recommendation: The Organization should establish written policies and procedures regarding the contracting and monitoring of subrecipients that are in line with Uniform Guidance requirements, as well as establish organizational controls to ensure that such policies and procedures are being followed. Management’s response: We agree with the auditor’s comments and will implement the following action steps to improve the situation. We will create and document a procedure which ensures we obtain audits on an annual basis from our subrecipients. This procedure will be implemented by October 31, 2024
2023-002 Finding – Federal Award Type: Cash Management (Invoices) – Material Weakness in Internal Control over Compliance. (Repeat 2022-003) Identification of Federal Program: Research and Development Cluster: AL Number: 81.086 Conservation Research and Development Program Criteria / Requirement: 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition / Context: It was noted during the audit that there were insufficient internal controls over invoices submitted for cost reimbursement related to federal grants as invoices were created and approved by one individual. While the internal controls were insufficient, our sample of invoices did not contain errors or undocumented amounts. Cause: Procedures were not in place to ensure that Forth is maintaining adequate internal controls over compliance in regards to cash management requirements. Key duties and functions are not segregated among organization personnel and internal control policies and procedures are inadequate to properly define the roles and responsibilities of accounting personnel performing key functions. Effect: Failure to maintain sufficient internal controls over invoices submitted for cost reimbursement related to federal grants may result in the wrongful use of federal funds and/or non‐compliance with the provisions of applicable requirements. Questioned Costs: None. Recommendation: The Organization should establish written policies and procedures regarding invoicing for cost-reimbursement related to federal grants which include proper segregation of duties. Management’s response: We agree with the auditor’s comments, and the following actions have been or will be taken to improve the situation. We hired a Grants Accountant in 2024 to take over the responsibility of preparing invoices for cost-reimbursement. This allows for the additional control of the Senior Finance Manager reviewing the invoices. This review is now being documented in writing. Additionally, there are procedures in place to ensure if the Senior Finance Manager prepares the invoice, the Director of Finance & Operations reviews and documents approval of the invoice. We will establish written policies and procedures to document this process by October 31, 2024.
2023-003 Finding – Federal Award Type: Reporting (Special Reporting – FFATA / FSRS) – Material Non-Compliance and Material Weakness in Internal Control over Compliance. (Repeat 2022-003) Identification of Federal Program: Research and Development Cluster: AL Number: 81.086 Conservation Research and Development Program Criteria / Requirement: 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The subawards meeting the above definition are to be reported no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition / Context: During 2023, Forth entered into 18 first-tier subawards greater than $30,000. KT tested 4 of these subawards, noting that these were reported under the Federal Funding Accountability and Transparency Act to the Federal Subaward Reporting System. However, the reports submitted were not made within the required timeframe. Cause: Procedures were not in place to ensure that Forth is maintaining adequate internal controls over compliance in regards to federal special reporting. Procedures are not in place to track and report first-tier subawards. Effect: Failure to maintain sufficient internal controls and proper procedures, including tracking over reporting first-tier subawards may result in wrongful use of federal funds and non-compliance with federal awards. Questioned Costs: None. Recommendation: The Organization should establish written policies and procedures regarding first-tier subawards including tracking and proper internal control procedures. Management’s response: We agree with the auditor’s comments and the following actions have been taken to improve the situation. We hired a Contracts & Compliance Manager in 2024 who is now responsible for reporting first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) by the reporting due date. Additionally, we established written policies and procedures regarding first-tier subawards including tracking and proper internal control procedures.
2023-004 Finding – Federal Award Type: Allowable Costs – Non-Compliance and Material Weakness in Internal Control over Compliance. Identification of Federal Program: Research and Development Cluster: AL Number: 81.086 Conservation Research and Development Program Criteria / Requirement: 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition / Context: It was noted during the audit that there were insufficient internal controls over expenses recorded through allocations related to federal grants, as allocation journal entries were created and posted by one individual. Of 25 expenditures sampled, 12 were allocation journal entries. The payroll allocation journal entries are a manual process in which time is tracked per timesheets but then is input into a workbook to allocate expenses to funders based on percentage of time dedicated to certain programs. Of the 10 allocated payroll expenditures, there were 2 instances where the payrate used to calculate the allocation did not match the approved current payrate with the associated employee. Cause: Procedures were not in place to ensure that Forth is maintaining adequate internal controls over compliance in regards to allocated expenditures. Additionally, the manual process in which these allocations are calculated leaves open the possibility of misallocating amounts among funders. Effect: Failure to maintain sufficient internal controls and proper procedures may result in over-allocation or under-allocation of expenditures related federal awards and non-compliance with federal awards. Questioned Costs: None. Recommendation: The Organization should establish written policies and procedures regarding allocation processes, including ensuring internal controls are in place. It would also be beneficial to eliminate or reduce the amount of manual inputs into the allocation process. Management’s response: We agree with the auditor’s comments, and the following action will be taken to improve the situation. We will establish written policies and procedures regarding allocation processes, including ensuring internal controls are in place by November 30, 2024. Simultaneously, we will also consider options to eliminate or reduce the amount of manual inputs into the allocation process.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
Finding 2023-001 Identification of the Federal Program: Federal Grantor: United States Department of Health and Human Services and Department of Defense Assistance Listing No.: Various; Research and Development Cluster Period of Performance: January 1, 2023 – December 31, 2023 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and screening of its vendors and suppliers for suspension and debarment. AdventHealth relied on the results of the suspension and debarment checks performed by the third-party service provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC 1 (System and Organization Controls) Report. (b) AdventHealth does not receive a listing, from the third-party service provider, of all vendors and suppliers screened on a monthly basis. While AdventHealth does receive a listing of vendors and suppliers with a “match” or “potential match”, since the full listing of all vendors and suppliers screened was not available, it could not be determined whether all vendors and suppliers were appropriately screened by the third-party service provider. On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers that were screened for suspension and debarment by the third-party service provider. However, a reconciliation between the vendor and supplier list provided by AdventHealth and the list that is received from the third-party service provider was not performed. Cause: AdventHealth did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party service provider aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, AdventHealth did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor and supplier list sent to the third-party service provider and the results provided by the third-party service provider. Effect or Potential Effect: AdventHealth’s screening for suspension and debarment through the third-party service provider may not be accurate. By not performing a reconciliation between the vendor and supplier list in AdventHealth’s database and the results provided by the third-party service provider, there exists a risk that certain vendors and suppliers were not screened by the third-party service provider. Questioned costs: None Context: AdventHealth, as part of its internal control process, internally performs screening for all “new” vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were added to the database in fiscal year 2023 and found no issues. As such, there exists a process to ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since the issue relates to the on-going monitoring performed by the third-party service provider, for which appropriate controls were not put in place, this resulted in a deficiency in internal control process. The federal portion of expenditures subject to suspension and debarment was approximately $354,000, which represents approximately 5.5% of the total Research and Development Cluster federal expenditures. The total amount reported on the SEFA for R&D cluster is $6,392,558. Identification as a repeat finding, if applicable: Not a repeat finding Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management should implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed. Views of Responsible Officials: Management agrees with the finding. Management plans to add controls to validate the accuracy of the suspension and debarment search results performed by the third-party service provider when the search results in no match. In addition, management plans to implement a process over the reconciliation of the vendor and supplier list to the third-party service provider list to ensure completeness of the suspension and debarment checks performed.
FINDING 2023-003 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Period of Performance Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): FY 2023 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Period of Performance Audit Findings: Material Weakness, Modified Opinion Condition and Context Recipients may use COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (SLFRF) funds for any eligible expenses subject to the restrictions set forth in sections 602 and 603 of the Social Security Act as added by section 9901 of the American Rescue Plan Act of 2021 and amended by the Consolidated Appropriations Act of 2023. The SLFRF program provides substantial flexibility for each recipient to meet local needs within seven separate eligible use categories. Recipients may use SLFRF funds to: Respond to the COVID-19 public health emergency and its negative economic impacts; Respond to workers performing essential work during the COVID-19 public health emergency by providing premium pay to eligible workers of eligible employers that have eligible workers who are performing essential work; Provide government services, to the extent COVID-19 caused a reduction in revenues collected in the most recent full fiscal year of the recipient; Make necessary investments in water, sewer, or broadband infrastructure; Provide emergency relief from natural disasters or their negative economic impacts; Fund eligible Surface Transportation projects; and Fund Title I projects that are eligible activities under the Community Development Block Grant and Indiana Community Development Block Grant programs. As part of sound management of the federal award, the City was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The City did not properly design or implement such a system. The City elected to receive the standard revenue loss allowance, allowing it to claim its total SLFRF allocation of $2,290,914 as revenue loss to use for government services. The allocated funds may only be used to cover costs incurred from the period beginning on March 3, 2021, and ending on December 31, 2024. Obligations for costs incurred are required to be liquidated no later than December 31, 2026 (the end of the period of performance). During the audit period, the City completed three separate transfers of SLFRF funds from the ARPA Coronavirus Local Fiscal fund to the Comm Crossing Grant Fund and Water Utility-Operating funds, totaling $976,431 and $494,159, respectively. The transfers allowed for federal grant funds to be commingled with other grant and operating funds. Subsequently, expenditures were disbursed from the Comm Crossing Grant Fund and Water Utility-Operating funds. However, since the transfer of SLFRF funds into the Comm Crossing Grant Fund and Water Utility-Operating funds commingled receipts, and the City did not ensure there was an appropriate system of internal controls in place to account for the federal expenditures separately from other grant and operating expenditures, we were unable to determine a complete population of federal expenditures. Without a complete population of expenditures, we were unable to determine the City's compliance with the Activities Allowed or Unallowed, the Allowable Costs/Cost Principles, and the Period of Performance compliance requirements. As such, the $976,431 and $494,159 transferred from the ARPA Coronavirus Local Fiscal fund are considered questioned costs. The lack of internal controls and appropriate documentation to test the compliance requirements was isolated to the situation described above. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.300(b) states in part: "The non-Federal entity is responsible for complying with all requirements of the Federal award. . . ." 2 CFR 200.302 states in part: "(a) Each state must expend and account for the Federal award in accordance with state laws and procedures for expending and accounting for the state's own funds. In addition, the state's and the other non-Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. . . . (b) The financial management system of each non-Federal entity must provide for the following . . . (1) Identification, in its accounts, of all Federal awards received and expended and the Federal programs under which they were received. Federal program and Federal award identification must include, as applicable, the Assistance Listings title and number, Federal award identification number and year, name of the Federal agency, and name of the pass-through entity, if any. (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . . (3) Records that identify adequately the source and application of funds for federallyfunded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. (4) Effective control over, and accountability for, all funds, property, and other assets. . . ." Cause Due to the lack of internal controls, the City was unable to differentiate expenditures made from federal and nonfederal funds once it commingled other grant, operating, and federal grant awards into a single fund within its ledger without consideration of the need to separately identify and account for federal expenditures. Effect Without the proper implementation of an effectively designed system of internal controls, the Town cannot identify the expenditures paid with federal grant funds. As such the Town cannot ensure nor can we determine that expenditures of the grant were not unallowable and fell within the period of performance. Questioned Costs We identified $1,470,590 in known questioned costs as noted above in the Condition and Context. Recommendation We recommended that management of the City establish a system of internal controls to ensure that grant award funds are accounted for and tracked in a designated grant fund. All activity of the grant should be in this fund with supporting documentation for each transaction. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2023-004 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Suspension and Debarment Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): FY 2023 Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Other Matters Condition and Context The City elected to receive the standard revenue loss allowance, allowing the City to claim its total COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (SLFRF) allocation of $2,290,914 as revenue loss to use for government services. As such, all SLFRF program funds were expended under the revenue loss eligible use category. The U. S. Department of the Treasury (Treasury) determined that there are no subawards under this eligible use category and that recipients' use of revenue loss funds would not give rise to subrecipient relationships given that there is no federal program or purpose to carry out in the case of the revenue loss portion of the award. Prior to entering into subawards and covered transactions with SLFRF award funds, recipients are required to verify that such contractors and subrecipients are not suspended, debarred, or otherwise excluded. "Covered transactions" include, but are not limited to, contracts for goods and services awarded under a nonprocurement transaction (i.e., grant agreement) that are expected to equal or exceed $25,000. The verification is to be done by checking the Excluded Parties List System (EPLS), collecting a certification from that person or entity, or adding a clause or condition to the covered transaction with that person or entity. Due to the Treasury's determination that the revenue loss eligible use category does not give rise to subawards, the City was only required to comply with suspension and debarment requirements related to covered transactions. Four covered transactions for goods or services that equaled or exceeded $25,000 that were paid from SLFRF funds during the audit period were selected for testing. Supporting documentation for each transaction was examined to determine whether the City verified the suspension and debarment status of the vendors prior to payment. The examined supporting documentation did not include evidence the City verified the suspension and debarment status of any of the four vendors that were paid federal funds. Upon inquiry, it was identified that the City had not established policies and procedures related to suspension and debarment requirements. As such, the City did not verify the vendors were neither suspended nor debarred or otherwise excluded or disqualified from participating in federal assistance programs or activities prior to payment. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 31 CFR 19.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the EPLS; or (b) Collecting a certification from that person if allowed by this rule; or (c) Adding a clause or condition to the covered transaction with that person." Cause A proper system of internal controls which would include a review of suspension and debarment identification process documentation was not designed by management of the City. Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the City's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. Effect Without the proper implementation of an effectively designed system of internal controls, the City cannot ensure the vendors paid with federal funds are eligible to participate in federal programs. Any program funds the City used to pay vendors that have been suspended or debarred would be unallowable, and the funding agency could potentially recover them. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the City establish and implement a system of internal controls to ensure that all vendors that are paid $25,000 or more, all or in part with federal funds, are not suspended, debarred, or otherwise excluded from participating in federal programs prior to entering into any covered transactions. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2023-005 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Suspension and Debarment Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): SWIF223990 Pass-Through Entity: Indiana Finance Authority Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Other Matters Condition and Context Prior to entering into subawards and covered transactions with the COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (SLFRF), recipients are required to verify that such contractors and subrecipients are not suspended, debarred, or otherwise excluded. "Covered transactions" include, but are not limited to, contracts for goods and services awarded under a nonprocurement transaction (i.e., grant agreement) that are expected to equal or exceed $25,000. The verification is to be done by checking the Excluded Parties List System (EPLS), collecting a certification from that person or entity, or adding a clause or condition to the covered transaction with that person or entity. All covered transactions involving one vendor for goods or services that equaled or exceeded $25,000 that were paid from SLFRF funds related to the State Water Infrastructure Fund (SWIF) grant funds during the audit period were selected for testing. Supporting documentation for the transactions were examined to determine whether the City verified the suspension and debarment status of the vendor prior to payment. The examined supporting documentation did not include evidence the City verified the suspension and debarment status of the vendor paid federal funds. Upon inquiry, it was identified that the City had not established policies and procedures related to suspension and debarment requirements. As such, the City did not verify the vendor was neither suspended nor debarred or otherwise excluded or disqualified from participating in federal assistance programs or activities prior to payment. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 31 CFR 19.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the EPLS; or (b) Collecting a certification from that person if allowed by this rule; or (c) Adding a clause or condition to the covered transaction with that person." Cause A proper system of internal controls which would include a review of suspension and debarment identification process documentation was not designed by management of the City. Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the City's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. Effect Without the proper implementation of an effectively designed system of internal controls, the City cannot ensure the vendors paid with federal funds are eligible to participate in federal programs. Any program funds the City used to pay vendors that have been suspended or debarred would be unallowable, and the funding agency could potentially recover them. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the City establish and implement a system of internal controls to ensure that all vendors that are paid $25,000 or more, all or in part with federal funds, are not suspended, debarred, or otherwise excluded from participating in federal programs prior to entering into any covered transactions. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2023-006 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Reporting Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): FY 2023 Compliance Requirement: Reporting Audit Finding: Material Weakness Condition and Context Recipients are required to submit an initial interim report and quarterly or annually submit Project and Expenditure (P&E) reports to the U.S. Department of the Treasury (Treasury). The reporting periods, as well as the respective due dates are based upon type of recipient and its population, as well as the recipient's allocation amount. Information to be reported includes projects funded, expenditures, and contracts for the appropriate reporting period. The City was classified as a city with a population below 250,000 residents that was allocated less than $10 million in COVID-19 - Coronavirus State and Local Fiscal Recovery Funds. As such, an annual P&E report, covering one calendar year from April 1, 2022 to March 31, 2023, was prepared and submitted by the Deputy Clerk-Treasurer to the Treasury by April 30, 2023. However, the City did not provide evidence the completed and filed report was reviewed by another individual to ensure the accuracy of the information provided. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause A proper system of internal controls which would include segregation of key functions was not designed by management of the City. Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the City's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. Effect Without the proper design or implementation of the components of a system of internal controls, including policies and procedures that provide segregation of duties and additional oversight as needed, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the City design and implement a proper system of internal controls, including policies and procedures that would provide segregation of duties to ensure appropriate reviews, approvals, and oversight are taking place to ensure the required reports are completed and filed. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
2023-002 Local Collaborative Time Study (LCTS) Annual Spending Report Prior Year Finding Number: N/A Year of Finding Origination: 2023 Type of Finding: Internal Control Over Compliance and Compliance Severity of Deficiency: Significant Deficiency and Other Matter Federal Agency: U.S. Department of Health and Human Services Program: 93.778 Medical Assistance Program Award Number and Year: 2305MN5ADM, 2023 Pass-Through Agency: Minnesota Department of Human Services Criteria: Title 2 U.S. Code of Federal Regulations § 200.303 states that the auditee must establish and maintain effective internal control over the federal award that provides reasonable assurance that the auditee is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. For County federal awards received from the Minnesota Department of Human Services (DHS), the County should establish and maintain internal control to provide assurance that program reports submitted to DHS are completed accurately and in accordance with reporting instructions. As part of Watonwan County’s reporting requirements for the Medical Assistance Program, the County submits the Local Collaborative Time Study (LCTS) Annual Spending Report on an annual basis. Condition: The following exceptions were noted in the 2023 LCTS Annual Spending Report reviewed: • Reported LCTS funds received were understated by $9,796. • Reported LCTS funds spent on services and administration were understated by $4,560. Questioned Costs: None. Context: DHS relies on accurate reporting of program costs to ensure that resulting grant funds paid to the County are for allowable federal program activities/costs and provide detailed information necessary for maintaining proper oversight over federal programs. The County has since reviewed the LCTS Annual Spending Report to correct the errors identified in the audit and has resubmitted the report to DHS. Effect: The 2023 LCTS Annual Spending Report sumbitted to DHS was not accurate. Cause: The County’s controls over preparation of the report were not sufficient to identify the reporting errors. Recommendation: We recommend Watonwan County implement controls to ensure accurate reporting to DHS in accordance with federal program guidance and DHS instructions. View of Responsible Official: Acknowledge
Federal Agency: U.S. Department of Health and Human Services Federal Program: Medical Assistance Assistance Listing Number: 93.778 Federal Award Identification Number and Year: 2305MN5MAP -2023, 2305MN5ADM -2023 Compliance Requirement Affected: Eligibility Award Period: Year Ended December 31, 2023 Type of Finding: Significant Deficiency in Internal Controls over Compliance Criteria or Specific Requirement: Title 2 U.S. Code of Federal Regulations § 200.303 states that the auditee must establish and maintain effective internal control over the federal award that provides reasonable assurance that the auditee is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The County did not have adequate internal controls over the casefiles. Questioned Costs: None Context: The County did not have anyone internally reviewing the casefiles. Cause: Limited number of personnel. Effect: The County could be reporting inaccurate information effecting the status of eligibility. Repeat Finding: No Recommendation: We recommend the County designate qualified personnel responsible for conducting casefile reviews. The reviews should be performed on predetermined frequencies and documented. Formal procedures should be documented to ensure consistency and effectiveness of the quality review process. Views of Responsible Officials: There is no disagreement with the audit finding.
FINDING 2023-002 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Suspension and Debarment Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): CY 2021 Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-003. Condition and Context Prior to entering into subawards and covered transactions with COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (SLFRF), recipients are required to verify that such contractors and subrecipients are not suspended, debarred, or otherwise excluded. "Covered transactions" include, but are not limited to, contracts for goods and services awarded under a nonprocurement transaction (i.e., grant agreement) that are expected to equal or exceed $25,000. The verification is to be done by checking the Excluded Parties List System (EPLS), collecting a certification from that person, or adding a clause or condition to the covered transaction with that person. Upon inquiry of the City in order to review the procedures in place for verifying that an entity with which it plans to enter into a covered transaction is not suspended, debarred, or otherwise excluded, the City explained that they were checking for suspension and debarment status through the EPLS but were not retaining the search results. A population of two vendors with which there were nine covered transactions totaling $5,103,638 was identified. Both vendors were selected for testing. For each of the two vendors, the City did not retain any documentation that it verified the vendors were not suspended nor debarred or otherwise excluded or disqualified from participating in federal assistance programs or activities. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 15 CITY OF WEST LAFAYETTE SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 31 CFR 19.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you do business is not excluded or disqualified. You do this by: (a) Checking the EPLS; or (b) Collecting a certification from that person if allowed by this rule; or (c) Adding a clause or condition to the covered transaction with that person." Cause The City's policies and procedures did not include the retention of the EPLS search results conducted on vendors with whom a covered transaction was entered. Effect Without the proper implementation of an effectively designed system of internal controls, we could not verify that the City ensured vendors paid with federal funds were eligible to participate in federal programs. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the City strengthen its policies and procedures to include documentation of the EPLS verification. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
Finding 2023-001 - Controls Over Payroll Expenditures (Material Weakness) Criteria: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable, under federal awards, cost must meet certain criteria: a)Be necessary and reasonable for the performance of the Federal award and be allocable thereto underthese principles. b)Conform to any limitations or exclusions set forth in these principles or in the Federal award as to typesor amount of cost items. c)Be consistent with policies and procedures that apply uniformly to both federally-financed and otheractivities of the non-Federal entity. d)Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if anyother cost incurred for the same purpose in like circumstances has been allocated to the Federal award asan indirect cost. e)Be determined in accordance with generally accepted accounting principles (GAAP), except, for stateand local governments and Indian tribes only, as otherwise provided for in this part. f)Not be included as a cost or used to meet cost sharing or matching requirements of any other federallyfinanced program in either the current or a prior period. g)Be adequately documented. h)Cost must be incurred during the approved budget period. Additionally, 2 CFR 200.303 indicates that non-Federal Entities receiving Federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonFederal entity is managing the Federal award in compliance with Federal statutes, regulations and terms and conditions of the Federal award. The Corporation should have controls in place to document that salaries and overtime paid with federal funds were allowable. Timecards supporting hours worked should be approved and pay rates reviewed. Condition and Context: A summary of allowable charges for the grant was prepared for submission. Within a sample of 45, we noted that 25 timecards did not have a documented review. Effect: Payroll expenditures could be inaccurately charged to the federal grant. Cause: Management noted that time is tracked in a spreadsheet and is reviewed but formal documentation of review is not maintained. Questioned Costs: None Identification as a repeat finding, if applicable: This is a repeat finding. Appeared as finding 2022-002 in the prior report. Recommendation: We recommend the Corporation maintain documented approval of all timecards. Views of responsible officials and planned corrective actions: Management agrees with the finding and has prepared a corrective action plan.
Finding 2023-001 - Controls Over Payroll Expenditures (Material Weakness) Criteria: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable, under federal awards, cost must meet certain criteria: a)Be necessary and reasonable for the performance of the Federal award and be allocable thereto underthese principles. b)Conform to any limitations or exclusions set forth in these principles or in the Federal award as to typesor amount of cost items. c)Be consistent with policies and procedures that apply uniformly to both federally-financed and otheractivities of the non-Federal entity. d)Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if anyother cost incurred for the same purpose in like circumstances has been allocated to the Federal award asan indirect cost. e)Be determined in accordance with generally accepted accounting principles (GAAP), except, for stateand local governments and Indian tribes only, as otherwise provided for in this part. f)Not be included as a cost or used to meet cost sharing or matching requirements of any other federallyfinanced program in either the current or a prior period. g)Be adequately documented. h)Cost must be incurred during the approved budget period. Additionally, 2 CFR 200.303 indicates that non-Federal Entities receiving Federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonFederal entity is managing the Federal award in compliance with Federal statutes, regulations and terms and conditions of the Federal award. The Corporation should have controls in place to document that salaries and overtime paid with federal funds were allowable. Timecards supporting hours worked should be approved and pay rates reviewed. Condition and Context: A summary of allowable charges for the grant was prepared for submission. Within a sample of 45, we noted that 25 timecards did not have a documented review. Effect: Payroll expenditures could be inaccurately charged to the federal grant. Cause: Management noted that time is tracked in a spreadsheet and is reviewed but formal documentation of review is not maintained. Questioned Costs: None Identification as a repeat finding, if applicable: This is a repeat finding. Appeared as finding 2022-002 in the prior report. Recommendation: We recommend the Corporation maintain documented approval of all timecards. Views of responsible officials and planned corrective actions: Management agrees with the finding and has prepared a corrective action plan.
Finding 2023-001 - Controls Over Payroll Expenditures (Material Weakness) Criteria: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable, under federal awards, cost must meet certain criteria: a)Be necessary and reasonable for the performance of the Federal award and be allocable thereto underthese principles. b)Conform to any limitations or exclusions set forth in these principles or in the Federal award as to typesor amount of cost items. c)Be consistent with policies and procedures that apply uniformly to both federally-financed and otheractivities of the non-Federal entity. d)Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if anyother cost incurred for the same purpose in like circumstances has been allocated to the Federal award asan indirect cost. e)Be determined in accordance with generally accepted accounting principles (GAAP), except, for stateand local governments and Indian tribes only, as otherwise provided for in this part. f)Not be included as a cost or used to meet cost sharing or matching requirements of any other federallyfinanced program in either the current or a prior period. g)Be adequately documented. h)Cost must be incurred during the approved budget period. Additionally, 2 CFR 200.303 indicates that non-Federal Entities receiving Federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonFederal entity is managing the Federal award in compliance with Federal statutes, regulations and terms and conditions of the Federal award. The Corporation should have controls in place to document that salaries and overtime paid with federal funds were allowable. Timecards supporting hours worked should be approved and pay rates reviewed. Condition and Context: A summary of allowable charges for the grant was prepared for submission. Within a sample of 45, we noted that 25 timecards did not have a documented review. Effect: Payroll expenditures could be inaccurately charged to the federal grant. Cause: Management noted that time is tracked in a spreadsheet and is reviewed but formal documentation of review is not maintained. Questioned Costs: None Identification as a repeat finding, if applicable: This is a repeat finding. Appeared as finding 2022-002 in the prior report. Recommendation: We recommend the Corporation maintain documented approval of all timecards. Views of responsible officials and planned corrective actions: Management agrees with the finding and has prepared a corrective action plan.
Finding 2023-001 - Controls Over Payroll Expenditures (Material Weakness) Criteria: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable, under federal awards, cost must meet certain criteria: a)Be necessary and reasonable for the performance of the Federal award and be allocable thereto underthese principles. b)Conform to any limitations or exclusions set forth in these principles or in the Federal award as to typesor amount of cost items. c)Be consistent with policies and procedures that apply uniformly to both federally-financed and otheractivities of the non-Federal entity. d)Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if anyother cost incurred for the same purpose in like circumstances has been allocated to the Federal award asan indirect cost. e)Be determined in accordance with generally accepted accounting principles (GAAP), except, for stateand local governments and Indian tribes only, as otherwise provided for in this part. f)Not be included as a cost or used to meet cost sharing or matching requirements of any other federallyfinanced program in either the current or a prior period. g)Be adequately documented. h)Cost must be incurred during the approved budget period. Additionally, 2 CFR 200.303 indicates that non-Federal Entities receiving Federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonFederal entity is managing the Federal award in compliance with Federal statutes, regulations and terms and conditions of the Federal award. The Corporation should have controls in place to document that salaries and overtime paid with federal funds were allowable. Timecards supporting hours worked should be approved and pay rates reviewed. Condition and Context: A summary of allowable charges for the grant was prepared for submission. Within a sample of 45, we noted that 25 timecards did not have a documented review. Effect: Payroll expenditures could be inaccurately charged to the federal grant. Cause: Management noted that time is tracked in a spreadsheet and is reviewed but formal documentation of review is not maintained. Questioned Costs: None Identification as a repeat finding, if applicable: This is a repeat finding. Appeared as finding 2022-002 in the prior report. Recommendation: We recommend the Corporation maintain documented approval of all timecards. Views of responsible officials and planned corrective actions: Management agrees with the finding and has prepared a corrective action plan.