Findings Citing § 200.320

Reference Number: 2024-001 United States Department of Agriculture Federal Assistance Listing Number & Program Name: 10.553 & 10.555 Child Nutrition Cluster Description: Procurement Criteria: 2 CFR 200.320 Methods of Procurement state that if the Sealed Bids method is used - This is a procurement method in which bids are publicly solicited through an invitation and a firm fixed-price contract (lump sum or unit price) is awarded to the responsible bidder whose bid conforms to all the material terms and conditions of the invitation and is the lowest in price. The Organization’s procurement policy also states that purchases ranging from >$100,000 require a minimum of three written bids. Condition: During our testing of procurement transactions, we totaled purchases by vendor and one vendor above $100,000 purchases had no price quotes as required by the Organization’s procurement policy. Cause: The Organization did not follow their Federal Funds Procurement policy related to the appropriate methods of procurement. Effect: Obtaining price quotes or proposals from an adequate number of vendors allows the Organization to use federal funds in the most fiscally responsible way. The lack of quotes and proposals may cause the Organization to overpay for supplies or services. Identification of a Repeat Finding: This is a repeat finding. Auditors’ Recommendation: We recommend the Organization review their procurement policy and adhere to current policy for going out for the minimum amount of bids on required vendors. Corrective Action Plan: See attachment for Organization’s corrective action plan.

2024-007 U.S. Department of the Treasury, For the period July 1, 2023, through June 30, 2024, Assistance Listing #21.027 – Internal Controls over State and Local Fiscal Recovery Fund Criteria: As required under 2 CFR §200.320, the City must follow Federal procurement standards to ensure contracts are procured at the lowest price and with adequate competition. In addition, as required by 2 CFR §180.300, the City is not allowed to use grant funds to contract with vendors who are suspended or disbarred from receiving Federal funds. Condition: Of the six contracts tested under the SLFRF program: • Three contracts lacked documentation demonstrating that appropriate bidding procedures were followed or that a cost or price analysis was performed prior to award. • Two contracts had no evidence that suspension and debarment procedures were followed, such as checking the System for Award Management (SAM.gov) or obtaining certifications from contractors. Cause: The City’s procurement documentation practices were inconsistent across departments. The high volume of SLFRF-funded projects and decentralized contract management contributed to lapses in maintaining required procurement records and verifying contractor eligibility. Effect: The City did not comply with federal procurement standards, increasing the risk of awarding contracts to ineligible vendors, procuring contracts with unfavorable terms, and potentially incurring unallowable costs. Recommendation: We recommend the City strengthen its procurement procedures by: • Ensuring all departments consistently document bidding processes and cost/price analyses. • Implementing centralized oversight or checklists to verify compliance with suspension and debarment requirements. • Providing targeted training to procurement staff on federal requirements under the Uniform Guidance. Questioned Costs: None.

2024-002 – Procurement and Suspension and Debarment Federal Agency: U.S. Department of Education Federal Program: Arts in Education Federal Assistance Listing Number: 84.351A Pass-through Entity: Not applicable. Award Identification Number: S351A210115 Year: 2023 and 2024 Criteria: 2 CFR §200.320(b) requires that for purchases exceeding the micro-purchase threshold, price or rate quotations must be obtained from an adequate number of qualified sources. If a noncompetitive (single-source) procurement is used, the entity must document the justification in accordance with 2 CFR §200.320(c). Condition: During testing, we identified three vendors with transactions exceeding the micro purchase threshold. For one vendor, the Organization obtained competitive price quotations in accordance with procurement requirements. For the remaining two vendors, the Organization did not retain documentation supporting compliance procurement decisions in accordance with the Organization's. Context: Documentation for two of the three transactions did not align with the competitive procurement requirements. Given that two-thirds of the population were affected, this indicates an area where compliance practices could be strengthened. Cause: Although the Organization has a formal procurement policy outlining requirements for competitive quotes and single-source justifications in accordance with 2 CFR §200.320, these procedures were not consistently followed for the transactions tested. Effect: Failure to obtain competitive quotes or document single-source justifications increases the risk of noncompliance with federal procurement requirements and may result in unallowable costs being charged to the federal program. Questioned Costs: Known questioned costs total $167,348, representing the federal share of the transactions where procurement requirements were not met. Repeat Finding: Yes Recommendation: We recommend the Organization ensure that its procurement policy is fully implemented. Staff should be trained and held accountable for obtaining competitive price or rate quotations for all purchases exceeding the micro-purchase threshold, or for documenting appropriate single-source justifications when applicable. Views of Responsible Officials: See Corrective Action Plan.

2 CFR § 1000.10 gives regulatory effect to the Department of Treasury for 2 CFR § 200.320 that states that the non-Federal entity must have and use documented procurement procedures, consistent with the standards of 2 CFR § 200.317 - 200.320. Furthermore, 2 CFR 200.§ 320(a)(2) states that "small purchases are the acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity." 31 CFR 19.305 states that Non-Federal entities may not enter into a covered transaction with an excluded person, unless the Department of the Treasury grants an exception under 31 CFR § 19.120. 31 CFR 19.200 identifies “covered transactions” as nonprocurement or procurement transactions subject to the prohibitions of 31 CFR Part 19 which is either at the primary tier, between a Federal agency and a person, or at a lower tier, between a participant in a covered transaction and another person. 31 CFR 19.220 indicates that procurement contracts for goods or services awarded by a participant in a nonprocurement transaction are covered transactions if the amount of the contract is expected to equal or exceed $25,000 or meets certain other specified criteria outlined in 31 CFR § 19.220. All nonprocurement transactions, irrespective of award amount, are considered covered transactions, unless exempt by 31 CFR 19.215. 31 CFR 19.300 provide that when a non-Federal entity enters into a covered transaction, the non-Federal entity must verify that the entity is not excluded or disqualified. This verification may be accomplished by checking the System for Award Management (SAM) exclusions (https://sam.gov), collecting a certification from the entity, or adding a clause or condition to the covered transaction with that entity. The District has an established procurement policy and procedures manual, DJF-R, Purchasing Procedures, which states that for purchases above the micro purchases threshold of $10,000 and below the simplified acquisition threshold of $250,000, the District must obtain price rates or quotes from a minimum of two vendors or providers. The District Policy also states that no purchase will be made with federal funds unless the District verifies that the contractor is not suspended or debarred. Additionally, the District is responsible for checking the Ohio Auditor of State website, pursuant to Ohio Revised Code § 9.24 for certified unresolved findings of recovery for any sub-award or contract exceeding $25,000, or when the aggregate amount provided under multiple contracts with a single person or entity during the preceding fiscal year exceeded $50,000 and shall also confirm that the supplier is not debarred or suspended by doing one of the following: (i) checking the Federal government's SAM, which maintains a list of such debarred or suspended suppliers at www.sam.gov; (ii) collecting a certification from the supplier; or (iii) adding a clause or condition to the covered transaction with that supplier. The District did not have proper internal controls in place to document procurement procedures or to verify that all entities with whom the District had entered into covered transactions had not been suspended or debarred. During testing of the AL #21.027 Coronavirus State and Local Fiscal Recovery Funds program, we noted the District could not provide documentation supporting that rates or quotes were obtained from an appropriate number of vendors or providers for all three small purchase contracts reviewed. Additionally, we noted no evidence the District checked the SAM exclusions, collected a certification from the entity, or added a clause or condition to the covered transaction with the vendor for two out of three small purchase contracts that exceeded $25,000. The above-listed noncompliance also resulted in a qualified opinion over the AL #21.027 Coronavirus State and Local Fiscal Recovery Funds program. Failure to follow the applicable federal procurement, suspension & debarment requirements could result in unallowable purchases, misuse of public funds, questioned costs related to federal monies, or vendors receiving federal funds that are suspended or debarred. The District should implement internal control procedures to ensure they are following the established District policy as well as the federal procurement requirements for small purchases. Additionally, prior to entering into a contract for covered transactions, the District should verify the vendor is not suspended or debarred by checking the SAM exclusions, collecting a certification from the vendor, or adding a clause or condition to the covered transaction with the vendor.

Finding 2024-001: Significant Deficiency – Lack of Procurement Policy and Documentation on Sole Source Contracts and Verification of Vendors Federal Grantor: Department of Health and Human Services Condition: The Organization does not have a procurement policy in place that complies with Uniform Guidance. The Organization contracted with a vendor on a sole-source basis and did not document justification for the use of a sole source vendor. In addition, the Organization did not verify that the vendor was not on the list of vendors suspended or debarred from federal contracting before contracting with the vendor. Criteria: Entities are required to have written standards of conduct that cover conflicts of interest and govern the performance of its employees engaged in the selection, award, and administration of contracts (2 CFR section 200.318(c) and 48 CFR sections 52.203-13 and 52.303-16). Entities are required to follow the procurement standards in 2 CFR sections 200.318 through 200.327, including ensuring that the procurement method used for the contracts are appropriate based on the dollar amount and conditions specified in 2 CFR section 200.320 and noncompetitive procurements. Entities also must comply with 2 CFR Part 1326 that prohibits entities that have been debarred, suspended or voluntarily excluded from participating in Federal procurement. Cause: The Organization does not have a procurement policy that addresses sole source contracting and verifying vendor certification that they are not debarred, suspended, ineligible or voluntarily excluded from Federal procurements. Effect: The Department of Health and Human Services may impose additional conditions on the receipt of a subsequent tranche of future award funds, if any, or take other available remedies as set forth in 2 C.F.C. section 200.339. Recommendation: We recommend the Organization review policies with staff to ensure procurement requirements are followed, and that staff are familiar with federal procurement requirements. Management’s Response: The Organization will develop a procurement policy that complies with federal requirements and will document its justification for vendor selections.

FA 2024-001 Improve Controls over Procurement Compliance Requirement: Procurement and Suspension and Debarment Internal Control Impact: Material Weakness Compliance Impact: Material Noncompliance Federal Awarding Agency: U.S. Department of Agriculture Pass-Through Entity: Georgia Department of Education AL Numbers and Titles: 10.553 – School Breakfast Program 10.555 – National School Lunch Program COVID-19 - 10.555 – National School Lunch Program 10.582 – Fresh Fruit and Vegetable Program Federal Award Numbers: 245GA324N1199 (Year: 2024) 245GA324L1603 (Year: 2024) 245GA324L1603 (Year: 2024) Questioned Costs: $5,380.74 Description: A review of expenditures charged to the Child Nutrition Cluster revealed that the School District’s internal control procedures were not operating appropriately to ensure that the School District’s procurement procedures were followed. Background Information: The Child Nutrition Cluster (CNC) is comprised of various programs that are intended to assist states in administering and overseeing food service program operators that provide healthful, nutritious meals to eligible children in public and non-profit private schools, residential child care institutions, and summer programs. This Cluster of programs also fosters healthy eating habits in children by providing fresh fruits and fresh vegetables to children attending elementary and secondary schools and encourages the domestic consumption of nutritious agricultural commodities. CNC funding was granted to the Georgia Department of Education (GaDOE) by the U.S. Department of Agriculture. GaDOE is responsible for distributing funds to local educational agencies (LEAs) and overseeing the various CNC programs. CNC funds totaling $450,874.38 were expended and reported on the Quitman County Board of Education’s Schedule of Expenditures of Federal Awards (SEFA) for fiscal year 2024. Criteria: As a recipient of federal awards, the School District is required to establish and maintain effective internal control over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Section 200.303 – Internal Controls. Additionally, provisions included in the Uniform Guidance, Section 200.318 – General Procurement Standards state in part that “(a) the non-Federal entity must use its own documented procurement procedures, which reflects applicable State and local laws and regulations and… (b) non-Federal entities must maintain oversight to ensure that contractors perform in accordance with the terms, conditions, and specifications of their contracts or purchase orders.” In addition, provisions included in the Uniform Guidance, Section 200.320 – Methods of Procurement to Be Followed provide guidance for procurement through small purchase procedures and state “If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources…” Condition: A sample of 22 procurement transactions was randomly selected for testing using a non-statistical sampling approach. These transactions were reviewed to determine if appropriate internal controls were implemented and applicable compliance requirements were met. The School District could not provide evidence that an adequate number of rate or price quotations were obtained from qualified sources for ten small purchase expenditures. Questioned Costs: Upon testing a sample of $25,223.43 in procurement transactions, known questioned costs of $5,380.74 were identified for expenditures that did not follow the School District’s procurement procedures. Using the total population of $302,197.99 in procurement transactions, we project the likely questioned costs to be approximately $64,465.81. The following Assistance Listing Numbers were affected by known and likely questioned costs: 10.553, 10.555, and 10.582. Cause: In discussing these deficiencies with the School District, they indicated the errors occurred due to oversight in following board-approved policies related to procurement. Effect: The School District is not in compliance with the Uniform Guidance and GaDOE guidance. Failure to appropriately implement procedures to address procurement compliance requirements exposes the School District to unnecessary risk of error and misuse of federal funds and could result in the expenditure of federal funds with unqualified vendors. In addition, this deficiency could lead to the return of grant funds associated with unallowable expenditures in the future. Recommendation: The School District should evaluate and improve internal control procedures to ensure that required procurement methods are properly identified and followed and appropriate procurement documentation is obtained and retained on-file. In addition, management should develop a monitoring process to ensure that these procedures are operating appropriately. Views of Responsible Officials: We concur with this finding

Coronavirus State and Local Fiscal Recovery Funds – Assistance Listing No. 21.027 U.S. Department of Treasury Missouri Primary Care Association Criteria or specific requirement – Procurement (2 CFR 200.319 and 2 CFR 200.320) Condition – The Organization’s internal controls over compliance were not sufficient to ensure the appropriate procurement method was utilized based on the value of the procurement transaction or to ensure procurement transactions were conducted in a manner that provided full and open competition. Cause – The Organization did not follow its policy when procuring services during the pre-construction phase of a project later funded by federal grants. Effect or potential effect – A contract for services was entered into during 2022 with estimated fees in excess of the threshold requiring a formal procurement method. The request for proposal did not allow for full and open competition as the Organization did not publicly request proposals or bids and only one proposal was obtained. Services purchased in 2024 under this contract may not have been obtained in the most effective manner. Questioned costs – Unknown Context – A sample of one procurement totaling $336,274 was tested out of a population of three procurements. The sample was not, and is not intended to be, statistically valid. The Organization’s procurement records were insufficient in accordance with the Organization’s procurement policy and Uniform Guidance. Identification as a repeat finding, if applicable – Not a repeat finding Recommendation – The Organization should educate employees on its procurement policy, which is compliant with Uniform Guidance. The Organization should also implement additional internal controls, such as the creation of a standard form or template for purchase orders, contracts, requests for proposals/bids, cost/price analyses, bid evaluation, etc., to ensure compliance with its procurement policy and that procurement records sufficient to detail the history of each procurement transaction are maintained. Views of responsible officials and planned corrective actions – This error occurred during fiscal year 2022, when the architect for an upcoming project was chosen. We are in a very rural area, where architects are not easy to come by. For this project, we had decided to utilize a local firm we had a good track record with. We presented it to our board for approval, and it was approved by them at that time so we originally had thought we could justify with having them as a sole source vendor. At the time, the total amount of the project was unknown, and has even changed significantly since that date. However, come to find out, due to the size of the project it should have been bid out. We have revised our procurement policy since this date and have educated all staff on proper procurement procedures.

Coronavirus State and Local Fiscal Recovery Funds – Assistance Listing No. 21.027 U.S. Department of Treasury Missouri Primary Care Association Criteria or specific requirement – Procurement (2 CFR 200.319 and 2 CFR 200.320) Condition – The Organization’s internal controls over compliance were not sufficient to ensure the appropriate procurement method was utilized based on the value of the procurement transaction or to ensure procurement transactions were conducted in a manner that provided full and open competition. Cause – The Organization did not follow its policy when procuring services during the pre-construction phase of a project later funded by federal grants. Effect or potential effect – A contract for services was entered into during 2022 with estimated fees in excess of the threshold requiring a formal procurement method. The request for proposal did not allow for full and open competition as the Organization did not publicly request proposals or bids and only one proposal was obtained. Services purchased in 2024 under this contract may not have been obtained in the most effective manner. Questioned costs – Unknown Context – A sample of one procurement totaling $336,274 was tested out of a population of three procurements. The sample was not, and is not intended to be, statistically valid. The Organization’s procurement records were insufficient in accordance with the Organization’s procurement policy and Uniform Guidance. Identification as a repeat finding, if applicable – Not a repeat finding Recommendation – The Organization should educate employees on its procurement policy, which is compliant with Uniform Guidance. The Organization should also implement additional internal controls, such as the creation of a standard form or template for purchase orders, contracts, requests for proposals/bids, cost/price analyses, bid evaluation, etc., to ensure compliance with its procurement policy and that procurement records sufficient to detail the history of each procurement transaction are maintained. Views of responsible officials and planned corrective actions – This error occurred during fiscal year 2022, when the architect for an upcoming project was chosen. We are in a very rural area, where architects are not easy to come by. For this project, we had decided to utilize a local firm we had a good track record with. We presented it to our board for approval, and it was approved by them at that time so we originally had thought we could justify with having them as a sole source vendor. At the time, the total amount of the project was unknown, and has even changed significantly since that date. However, come to find out, due to the size of the project it should have been bid out. We have revised our procurement policy since this date and have educated all staff on proper procurement procedures.

Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds; Health Center Program Cluster Assistance Listing Number: 21.027; 93.224/93.527 Pass-Through Entity: Cook County Department of Public Health, N/A Pass-Through Number: None; N/A Award Periods: May 1, 2023-November 30, 2026; July 1, 2021 – June 30, 2023. Type of Finding: Material weakness in internal control over compliance Criteria: 2 CFR section 200.320 outlines the acceptable methods of procurement. Purchases below the simplified acquisition threshold, but above the micro-purchase threshold, require price or rate quotations to be obtained from an adequate number of qualified sources. Noncompetitive procurement can be used in certain circumstances however the non-Federal entity is to maintain appropriate documentation justifying the use of sole source procurement consistent with 2 CFR 200.320(c). Condition: Legacy did not maintain appropriate documentation to support the procurement method utilized for procurements selected for testing. Questioned Costs: Unknown. Context: One (1) of two (2) transactions selected for testing within 21.027 and three (3) of three (3) transactions selected for testing within 93.224/93.527. Cause: Legacy did not maintain appropriate documentation based on the method of procurement utilized. Effect: Legacy may inadvertently select vendors without regard to fair competition and cost analysis. Repeat Finding: Yes. Prior Year Finding: 2023-005. Recommendation: We recommend Legacy consistently follow its established policies and procedures related to maintaining necessary documentation to support the method of procurement utilized. Legacy may also consider qualifying multiple vendors for particular goods/service and then utilizing an approved vendors list. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds; Health Center Program Cluster Assistance Listing Number: 21.027; 93.224/93.527 Pass-Through Entity: Cook County Department of Public Health, N/A Pass-Through Number: None; N/A Award Periods: May 1, 2023-November 30, 2026; July 1, 2021 – June 30, 2023. Type of Finding: Material weakness in internal control over compliance Criteria: 2 CFR section 200.320 outlines the acceptable methods of procurement. Purchases below the simplified acquisition threshold, but above the micro-purchase threshold, require price or rate quotations to be obtained from an adequate number of qualified sources. Noncompetitive procurement can be used in certain circumstances however the non-Federal entity is to maintain appropriate documentation justifying the use of sole source procurement consistent with 2 CFR 200.320(c). Condition: Legacy did not maintain appropriate documentation to support the procurement method utilized for procurements selected for testing. Questioned Costs: Unknown. Context: One (1) of two (2) transactions selected for testing within 21.027 and three (3) of three (3) transactions selected for testing within 93.224/93.527. Cause: Legacy did not maintain appropriate documentation based on the method of procurement utilized. Effect: Legacy may inadvertently select vendors without regard to fair competition and cost analysis. Repeat Finding: Yes. Prior Year Finding: 2023-005. Recommendation: We recommend Legacy consistently follow its established policies and procedures related to maintaining necessary documentation to support the method of procurement utilized. Legacy may also consider qualifying multiple vendors for particular goods/service and then utilizing an approved vendors list. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds; Health Center Program Cluster Assistance Listing Number: 21.027; 93.224/93.527 Pass-Through Entity: Cook County Department of Public Health, N/A Pass-Through Number: None; N/A Award Periods: May 1, 2023-November 30, 2026; July 1, 2021 – June 30, 2023. Type of Finding: Material weakness in internal control over compliance Criteria: 2 CFR section 200.320 outlines the acceptable methods of procurement. Purchases below the simplified acquisition threshold, but above the micro-purchase threshold, require price or rate quotations to be obtained from an adequate number of qualified sources. Noncompetitive procurement can be used in certain circumstances however the non-Federal entity is to maintain appropriate documentation justifying the use of sole source procurement consistent with 2 CFR 200.320(c). Condition: Legacy did not maintain appropriate documentation to support the procurement method utilized for procurements selected for testing. Questioned Costs: Unknown. Context: One (1) of two (2) transactions selected for testing within 21.027 and three (3) of three (3) transactions selected for testing within 93.224/93.527. Cause: Legacy did not maintain appropriate documentation based on the method of procurement utilized. Effect: Legacy may inadvertently select vendors without regard to fair competition and cost analysis. Repeat Finding: Yes. Prior Year Finding: 2023-005. Recommendation: We recommend Legacy consistently follow its established policies and procedures related to maintaining necessary documentation to support the method of procurement utilized. Legacy may also consider qualifying multiple vendors for particular goods/service and then utilizing an approved vendors list. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds; Health Center Program Cluster Assistance Listing Number: 21.027; 93.224/93.527 Pass-Through Entity: Cook County Department of Public Health, N/A Pass-Through Number: None; N/A Award Periods: May 1, 2023-November 30, 2026; July 1, 2021 – June 30, 2023. Type of Finding: Material weakness in internal control over compliance Criteria: 2 CFR section 200.320 outlines the acceptable methods of procurement. Purchases below the simplified acquisition threshold, but above the micro-purchase threshold, require price or rate quotations to be obtained from an adequate number of qualified sources. Noncompetitive procurement can be used in certain circumstances however the non-Federal entity is to maintain appropriate documentation justifying the use of sole source procurement consistent with 2 CFR 200.320(c). Condition: Legacy did not maintain appropriate documentation to support the procurement method utilized for procurements selected for testing. Questioned Costs: Unknown. Context: One (1) of two (2) transactions selected for testing within 21.027 and three (3) of three (3) transactions selected for testing within 93.224/93.527. Cause: Legacy did not maintain appropriate documentation based on the method of procurement utilized. Effect: Legacy may inadvertently select vendors without regard to fair competition and cost analysis. Repeat Finding: Yes. Prior Year Finding: 2023-005. Recommendation: We recommend Legacy consistently follow its established policies and procedures related to maintaining necessary documentation to support the method of procurement utilized. Legacy may also consider qualifying multiple vendors for particular goods/service and then utilizing an approved vendors list. Views of Responsible Officials: There is no disagreement with the audit finding.

2024-006 Procurement Program Information Federal Organization U.S Department of Health and Human Services Assistance Listing Numbers 93.224 & 93.527 Health Center Program Cluster Award Numbers H80CS00513, H8FCS41684, H8GC48547, H8LCS51197 Criteria [X] Compliance Finding [ ] Significant Deficiency [X] Material Weakness Entities receiving federal awards must have and use their documented procurement policies. Title 2 CFR 200.320 outlines the acceptable methods of procurement and establishes the maximum thresholds allowed. Purchases below the simplified acquisition threshold, but above the micro-purchase threshold, require price or rate quotations to be obtained from an adequate number of qualified sources. Noncompetitive procurement can be used only in certain circumstances as allowed for in 2 CFR 200.320(c). Condition The Organization’s procurement policy allows the Board to authorize noncompetitive procurement for certain types expenditures which are outside the circumstances allowing for noncompetitive bids under 2 CFR 200.320(c). In addition, the Organization did not follow its documented procurement policy. Cause The Organization’s procurement policy was not compared with the federal regulations when it was developed. Management did not follow its established procurement policy and documentation was not maintained evidencing its compliance with the policy. Effect The Organization may overpay for goods and services due to selecting vendors without appropriate consideration of the competitive bids and cost analysis. Questioned Costs $514,086 (of which $318,272 was previously reported in findings 2024-004 and 2024-005 above) Context In a sample of sixty invoices, we noted fourteen with issues related to the procurement process. Four of these related to the Organization’s procurement policy being non-compliant with the federal requirements. Two of these were due to the Organization not following their established procurement policy and eight were due to the lack of appropriate documentation of the competitive bids. Recommendation We recommend the Organization maintain documentation supporting reports filed with awarding agencies. Views of responsible officials and planned corrective action Management is in agreement with this finding and will take corrective action as outlined below.

2024-006 Procurement Program Information Federal Organization U.S Department of Health and Human Services Assistance Listing Numbers 93.224 & 93.527 Health Center Program Cluster Award Numbers H80CS00513, H8FCS41684, H8GC48547, H8LCS51197 Criteria [X] Compliance Finding [ ] Significant Deficiency [X] Material Weakness Entities receiving federal awards must have and use their documented procurement policies. Title 2 CFR 200.320 outlines the acceptable methods of procurement and establishes the maximum thresholds allowed. Purchases below the simplified acquisition threshold, but above the micro-purchase threshold, require price or rate quotations to be obtained from an adequate number of qualified sources. Noncompetitive procurement can be used only in certain circumstances as allowed for in 2 CFR 200.320(c). Condition The Organization’s procurement policy allows the Board to authorize noncompetitive procurement for certain types expenditures which are outside the circumstances allowing for noncompetitive bids under 2 CFR 200.320(c). In addition, the Organization did not follow its documented procurement policy. Cause The Organization’s procurement policy was not compared with the federal regulations when it was developed. Management did not follow its established procurement policy and documentation was not maintained evidencing its compliance with the policy. Effect The Organization may overpay for goods and services due to selecting vendors without appropriate consideration of the competitive bids and cost analysis. Questioned Costs $514,086 (of which $318,272 was previously reported in findings 2024-004 and 2024-005 above) Context In a sample of sixty invoices, we noted fourteen with issues related to the procurement process. Four of these related to the Organization’s procurement policy being non-compliant with the federal requirements. Two of these were due to the Organization not following their established procurement policy and eight were due to the lack of appropriate documentation of the competitive bids. Recommendation We recommend the Organization maintain documentation supporting reports filed with awarding agencies. Views of responsible officials and planned corrective action Management is in agreement with this finding and will take corrective action as outlined below.

2024-006 Procurement Program Information Federal Organization U.S Department of Health and Human Services Assistance Listing Numbers 93.224 & 93.527 Health Center Program Cluster Award Numbers H80CS00513, H8FCS41684, H8GC48547, H8LCS51197 Criteria [X] Compliance Finding [ ] Significant Deficiency [X] Material Weakness Entities receiving federal awards must have and use their documented procurement policies. Title 2 CFR 200.320 outlines the acceptable methods of procurement and establishes the maximum thresholds allowed. Purchases below the simplified acquisition threshold, but above the micro-purchase threshold, require price or rate quotations to be obtained from an adequate number of qualified sources. Noncompetitive procurement can be used only in certain circumstances as allowed for in 2 CFR 200.320(c). Condition The Organization’s procurement policy allows the Board to authorize noncompetitive procurement for certain types expenditures which are outside the circumstances allowing for noncompetitive bids under 2 CFR 200.320(c). In addition, the Organization did not follow its documented procurement policy. Cause The Organization’s procurement policy was not compared with the federal regulations when it was developed. Management did not follow its established procurement policy and documentation was not maintained evidencing its compliance with the policy. Effect The Organization may overpay for goods and services due to selecting vendors without appropriate consideration of the competitive bids and cost analysis. Questioned Costs $514,086 (of which $318,272 was previously reported in findings 2024-004 and 2024-005 above) Context In a sample of sixty invoices, we noted fourteen with issues related to the procurement process. Four of these related to the Organization’s procurement policy being non-compliant with the federal requirements. Two of these were due to the Organization not following their established procurement policy and eight were due to the lack of appropriate documentation of the competitive bids. Recommendation We recommend the Organization maintain documentation supporting reports filed with awarding agencies. Views of responsible officials and planned corrective action Management is in agreement with this finding and will take corrective action as outlined below.

2024-006 Procurement Program Information Federal Organization U.S Department of Health and Human Services Assistance Listing Numbers 93.224 & 93.527 Health Center Program Cluster Award Numbers H80CS00513, H8FCS41684, H8GC48547, H8LCS51197 Criteria [X] Compliance Finding [ ] Significant Deficiency [X] Material Weakness Entities receiving federal awards must have and use their documented procurement policies. Title 2 CFR 200.320 outlines the acceptable methods of procurement and establishes the maximum thresholds allowed. Purchases below the simplified acquisition threshold, but above the micro-purchase threshold, require price or rate quotations to be obtained from an adequate number of qualified sources. Noncompetitive procurement can be used only in certain circumstances as allowed for in 2 CFR 200.320(c). Condition The Organization’s procurement policy allows the Board to authorize noncompetitive procurement for certain types expenditures which are outside the circumstances allowing for noncompetitive bids under 2 CFR 200.320(c). In addition, the Organization did not follow its documented procurement policy. Cause The Organization’s procurement policy was not compared with the federal regulations when it was developed. Management did not follow its established procurement policy and documentation was not maintained evidencing its compliance with the policy. Effect The Organization may overpay for goods and services due to selecting vendors without appropriate consideration of the competitive bids and cost analysis. Questioned Costs $514,086 (of which $318,272 was previously reported in findings 2024-004 and 2024-005 above) Context In a sample of sixty invoices, we noted fourteen with issues related to the procurement process. Four of these related to the Organization’s procurement policy being non-compliant with the federal requirements. Two of these were due to the Organization not following their established procurement policy and eight were due to the lack of appropriate documentation of the competitive bids. Recommendation We recommend the Organization maintain documentation supporting reports filed with awarding agencies. Views of responsible officials and planned corrective action Management is in agreement with this finding and will take corrective action as outlined below.

2024-006 Procurement Program Information Federal Organization U.S Department of Health and Human Services Assistance Listing Numbers 93.224 & 93.527 Health Center Program Cluster Award Numbers H80CS00513, H8FCS41684, H8GC48547, H8LCS51197 Criteria [X] Compliance Finding [ ] Significant Deficiency [X] Material Weakness Entities receiving federal awards must have and use their documented procurement policies. Title 2 CFR 200.320 outlines the acceptable methods of procurement and establishes the maximum thresholds allowed. Purchases below the simplified acquisition threshold, but above the micro-purchase threshold, require price or rate quotations to be obtained from an adequate number of qualified sources. Noncompetitive procurement can be used only in certain circumstances as allowed for in 2 CFR 200.320(c). Condition The Organization’s procurement policy allows the Board to authorize noncompetitive procurement for certain types expenditures which are outside the circumstances allowing for noncompetitive bids under 2 CFR 200.320(c). In addition, the Organization did not follow its documented procurement policy. Cause The Organization’s procurement policy was not compared with the federal regulations when it was developed. Management did not follow its established procurement policy and documentation was not maintained evidencing its compliance with the policy. Effect The Organization may overpay for goods and services due to selecting vendors without appropriate consideration of the competitive bids and cost analysis. Questioned Costs $514,086 (of which $318,272 was previously reported in findings 2024-004 and 2024-005 above) Context In a sample of sixty invoices, we noted fourteen with issues related to the procurement process. Four of these related to the Organization’s procurement policy being non-compliant with the federal requirements. Two of these were due to the Organization not following their established procurement policy and eight were due to the lack of appropriate documentation of the competitive bids. Recommendation We recommend the Organization maintain documentation supporting reports filed with awarding agencies. Views of responsible officials and planned corrective action Management is in agreement with this finding and will take corrective action as outlined below.

2024-006 Procurement Program Information Federal Organization U.S Department of Health and Human Services Assistance Listing Numbers 93.224 & 93.527 Health Center Program Cluster Award Numbers H80CS00513, H8FCS41684, H8GC48547, H8LCS51197 Criteria [X] Compliance Finding [ ] Significant Deficiency [X] Material Weakness Entities receiving federal awards must have and use their documented procurement policies. Title 2 CFR 200.320 outlines the acceptable methods of procurement and establishes the maximum thresholds allowed. Purchases below the simplified acquisition threshold, but above the micro-purchase threshold, require price or rate quotations to be obtained from an adequate number of qualified sources. Noncompetitive procurement can be used only in certain circumstances as allowed for in 2 CFR 200.320(c). Condition The Organization’s procurement policy allows the Board to authorize noncompetitive procurement for certain types expenditures which are outside the circumstances allowing for noncompetitive bids under 2 CFR 200.320(c). In addition, the Organization did not follow its documented procurement policy. Cause The Organization’s procurement policy was not compared with the federal regulations when it was developed. Management did not follow its established procurement policy and documentation was not maintained evidencing its compliance with the policy. Effect The Organization may overpay for goods and services due to selecting vendors without appropriate consideration of the competitive bids and cost analysis. Questioned Costs $514,086 (of which $318,272 was previously reported in findings 2024-004 and 2024-005 above) Context In a sample of sixty invoices, we noted fourteen with issues related to the procurement process. Four of these related to the Organization’s procurement policy being non-compliant with the federal requirements. Two of these were due to the Organization not following their established procurement policy and eight were due to the lack of appropriate documentation of the competitive bids. Recommendation We recommend the Organization maintain documentation supporting reports filed with awarding agencies. Views of responsible officials and planned corrective action Management is in agreement with this finding and will take corrective action as outlined below.

2024-006 Procurement Program Information Federal Organization U.S Department of Health and Human Services Assistance Listing Numbers 93.224 & 93.527 Health Center Program Cluster Award Numbers H80CS00513, H8FCS41684, H8GC48547, H8LCS51197 Criteria [X] Compliance Finding [ ] Significant Deficiency [X] Material Weakness Entities receiving federal awards must have and use their documented procurement policies. Title 2 CFR 200.320 outlines the acceptable methods of procurement and establishes the maximum thresholds allowed. Purchases below the simplified acquisition threshold, but above the micro-purchase threshold, require price or rate quotations to be obtained from an adequate number of qualified sources. Noncompetitive procurement can be used only in certain circumstances as allowed for in 2 CFR 200.320(c). Condition The Organization’s procurement policy allows the Board to authorize noncompetitive procurement for certain types expenditures which are outside the circumstances allowing for noncompetitive bids under 2 CFR 200.320(c). In addition, the Organization did not follow its documented procurement policy. Cause The Organization’s procurement policy was not compared with the federal regulations when it was developed. Management did not follow its established procurement policy and documentation was not maintained evidencing its compliance with the policy. Effect The Organization may overpay for goods and services due to selecting vendors without appropriate consideration of the competitive bids and cost analysis. Questioned Costs $514,086 (of which $318,272 was previously reported in findings 2024-004 and 2024-005 above) Context In a sample of sixty invoices, we noted fourteen with issues related to the procurement process. Four of these related to the Organization’s procurement policy being non-compliant with the federal requirements. Two of these were due to the Organization not following their established procurement policy and eight were due to the lack of appropriate documentation of the competitive bids. Recommendation We recommend the Organization maintain documentation supporting reports filed with awarding agencies. Views of responsible officials and planned corrective action Management is in agreement with this finding and will take corrective action as outlined below.

2024-006 Procurement Program Information Federal Organization U.S Department of Health and Human Services Assistance Listing Numbers 93.224 & 93.527 Health Center Program Cluster Award Numbers H80CS00513, H8FCS41684, H8GC48547, H8LCS51197 Criteria [X] Compliance Finding [ ] Significant Deficiency [X] Material Weakness Entities receiving federal awards must have and use their documented procurement policies. Title 2 CFR 200.320 outlines the acceptable methods of procurement and establishes the maximum thresholds allowed. Purchases below the simplified acquisition threshold, but above the micro-purchase threshold, require price or rate quotations to be obtained from an adequate number of qualified sources. Noncompetitive procurement can be used only in certain circumstances as allowed for in 2 CFR 200.320(c). Condition The Organization’s procurement policy allows the Board to authorize noncompetitive procurement for certain types expenditures which are outside the circumstances allowing for noncompetitive bids under 2 CFR 200.320(c). In addition, the Organization did not follow its documented procurement policy. Cause The Organization’s procurement policy was not compared with the federal regulations when it was developed. Management did not follow its established procurement policy and documentation was not maintained evidencing its compliance with the policy. Effect The Organization may overpay for goods and services due to selecting vendors without appropriate consideration of the competitive bids and cost analysis. Questioned Costs $514,086 (of which $318,272 was previously reported in findings 2024-004 and 2024-005 above) Context In a sample of sixty invoices, we noted fourteen with issues related to the procurement process. Four of these related to the Organization’s procurement policy being non-compliant with the federal requirements. Two of these were due to the Organization not following their established procurement policy and eight were due to the lack of appropriate documentation of the competitive bids. Recommendation We recommend the Organization maintain documentation supporting reports filed with awarding agencies. Views of responsible officials and planned corrective action Management is in agreement with this finding and will take corrective action as outlined below.

Finding 2023-001 Noncompliance and material weakness in internal control over compliance with procurement requirements Federal Agency: Department of Housing and Urban Development Assistance Listing Number: 14.251 Assistance Listing Name: Community Project Funding Award Number: B-23-CP-WA-1530 Criteria Nonfederal entities must follow the procurement standards set out at 2 CFR sections 200.318 through 200.326. For acquisitions exceeding the simplified acquisition threshold, the nonfederal entity must use one of the following procurement methods: the sealed bid method if the acquisition meets the criteria in 2 CFR section 200.320(b)(i); the competitive proposals method under the conditions specified in 2 CFR section 200.320(b)(2); or the noncompetitive proposals method (i.e., solicit a proposal from only one source) but only when one or more of four circumstances are met, in accordance with 2 CFR section 200.320(c)). Condition and Effect During our testing of the procurement compliance requirement, we noted that the Aquarium had not performed the required procurement procedures for one of the vendors in our sample. For this one vendor the acquisition exceeded the simplified acquisition threshold. The Aquarium used a noncompetitive method to select the vendor; however, the acquisition did not meet one of the four qualifying circumstances for a noncompetitive procurement. Cause The Aquarium’s system of internal control did not operate effectively to prevent the Aquarium from incorrectly using a noncompetitive procurement process, when instead a proscribed competitive procurement process should have been followed. Context During the year under audit there was a total population of nine vendors to which the procurement compliance requirement applied. For our testing of the procurement compliance requirement, we tested a sample of two vendors from the total population of nine. As noted in the condition section above, our testing found that the Aquarium did not comply with the procurement compliance requirements for one of the vendors tested. We also noted that the procurement activity for this vendor occurred in 2017 and prior to the Aquarium seeking federal funding for the Ocean Pavilion project. Questioned Costs Payments to that one vendor during 2023 that were charged to the major federal program totaled $118,845. Repeat Finding This is not a repeat finding. Recommendation We recommend management provide training for those involved with procurement activities for acquisitions that will be charged to federal awards to ensure the Aquarium’s procurement policies and procedures are consistently applied. We also recommend management update the Aquarium’s procurement policies and procedures to ensure they incorporate the required procedures and controls to ensure compliance with the procurement requirements in 2 CFR 200 (the Uniform Guidance) for acquisitions that will be charged to federal awards. Views of Responsible Officials and Corrective Action Plan Management agrees with the finding and has provided the accompanying corrective action plan.

Finding 2023-003: Significant Deficiency - Internal Control Over Procurement, Suspension and Debarment Program Water and Waste Disposal Systems for Rural Communities Federal Agency U.S. Department of Agriculture Assistance Listing Number 10.760 Criteria: For federal awards after January 1, 2018, guidance provided in 2 CFR part 200.318 requires nonfederal entities to establish and follow their own documented procurement procedures that conform to applicable federal law and standards. 2 CFR part 200.320 includes different allowable methods of procurement. There are also requirements to verify the vendors are not suspended or debarred. Condition/Context: During our testing for this program, we noted that the City did not have a written procurement policy to conform with Uniform Guidance requirements. The City contracted with a thirdparty administrator who provided the services related to procurement for this grant program. Cause: The City was not aware that a written policy was required to be in place outside of the terms and condition in the grant agreement. Effect: Without an adequate policy in place, procurement procedures may not adhere to requirements of federal awards. Questioned Costs: None noted. Recommendation: Program personnel should become familiar with the procurement, suspension and debarment rules for Federal programs and implement a formal written policy to conform with Uniform Guidance requirements. Views of Responsible Officials: Management agrees with the finding and will make efforts to implement a formal procurement policy.

Assistance Listing, Federal Agency, and Program Name - ALN 47.074, National Science Foundation, Biological Sciences - Collaborative Research: Phenobase: Community, Infrastructure, and Data for Global Scale Analyses of Plant Phenology; ALN 47.074, National Science Foundation, Biological Sciences - REU Site: Plant Biology and Conservation Research Experiences for Undergraduates Federal Award Identification Number and Year - DBI-2223510, DBI2149888 Pass through Entity - N/A Finding Type - Material weakness and material noncompliance with laws and regulations Repeat Finding - No Criteria - 2 CFR 180.300 - When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded of disqualified. You do this by: (a) checking SAM exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. 2 CFR 200.318(i) - The entity must maintain records sufficient to detail the history of procurement. These records will include, but are not limited to, the following: Rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. 2 CFR 200.319(a) - All procurement transactions for the acquisition of property or services required under a federal award must be conducted in a manner providing full and open competition consistent with the standards of this section and § 200.320. 2 CFR 200.320(a)(2)(i) - If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non Federal entity. Condition - The Society did not have documentation to support that two covered transactions were checked for potential suspension or debarment before entering into the transaction. There was one covered transaction where the Society did not have documentation to support the procurement process followed or that more than one vendor was reviewed for pricing before selecting the vendor chosen. Questioned Costs - The Society charged a total of $31,000 to grant DBI-2223510 during 2023 for a covered transaction in which there was not supporting documentation that the service was procured under the requirements above. Identification of How Questioned Costs Were Computed - The amount of the covered transaction that was submitted for reimbursement during 2023. Context - Two covered transactions with total expenditures charged to the grants of $85,735 were reviewed. The population subject to testing included a total of three covered transactions. Cause and Effect - The Society experienced significant personnel turnover during the year within its accounting and grants departments, which resulted in issues with documentation retention and records retrieval. Recommendation - The Society should implement an internal review process of its record retention to ensure that all procurement documentation is appropriately retained in accordance with its formal policies. Views of Responsible Officials and Planned Corrective Actions - Staff turnover in early 2023 resulted in limited capacity for dedicated staff to check for potential suspension or debarment before adding vendors to the system. We have dedicated staff who will be managing this process going forward. The Society has written procurement policies and procedures. Key leadership stakeholders have been apprised of our policies and procedures. The Society will be implementing a training series for government funded procurement stakeholders within the Society to ensure compliance.

Assistance Listing, Federal Agency, and Program Name - ALN 47.074, National Science Foundation, Biological Sciences - Collaborative Research: Phenobase: Community, Infrastructure, and Data for Global Scale Analyses of Plant Phenology; ALN 47.074, National Science Foundation, Biological Sciences - REU Site: Plant Biology and Conservation Research Experiences for Undergraduates Federal Award Identification Number and Year - DBI-2223510, DBI2149888 Pass through Entity - N/A Finding Type - Material weakness and material noncompliance with laws and regulations Repeat Finding - No Criteria - 2 CFR 180.300 - When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded of disqualified. You do this by: (a) checking SAM exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. 2 CFR 200.318(i) - The entity must maintain records sufficient to detail the history of procurement. These records will include, but are not limited to, the following: Rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. 2 CFR 200.319(a) - All procurement transactions for the acquisition of property or services required under a federal award must be conducted in a manner providing full and open competition consistent with the standards of this section and § 200.320. 2 CFR 200.320(a)(2)(i) - If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non Federal entity. Condition - The Society did not have documentation to support that two covered transactions were checked for potential suspension or debarment before entering into the transaction. There was one covered transaction where the Society did not have documentation to support the procurement process followed or that more than one vendor was reviewed for pricing before selecting the vendor chosen. Questioned Costs - The Society charged a total of $31,000 to grant DBI-2223510 during 2023 for a covered transaction in which there was not supporting documentation that the service was procured under the requirements above. Identification of How Questioned Costs Were Computed - The amount of the covered transaction that was submitted for reimbursement during 2023. Context - Two covered transactions with total expenditures charged to the grants of $85,735 were reviewed. The population subject to testing included a total of three covered transactions. Cause and Effect - The Society experienced significant personnel turnover during the year within its accounting and grants departments, which resulted in issues with documentation retention and records retrieval. Recommendation - The Society should implement an internal review process of its record retention to ensure that all procurement documentation is appropriately retained in accordance with its formal policies. Views of Responsible Officials and Planned Corrective Actions - Staff turnover in early 2023 resulted in limited capacity for dedicated staff to check for potential suspension or debarment before adding vendors to the system. We have dedicated staff who will be managing this process going forward. The Society has written procurement policies and procedures. Key leadership stakeholders have been apprised of our policies and procedures. The Society will be implementing a training series for government funded procurement stakeholders within the Society to ensure compliance.

Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Identification Number and Year: SLFRP0135 – 2021 Pass-Through Agency: Wisconsin Department of Administration Pass-Through Number(s): ARPA-NIF-072 Award Period: March 3, 2021 through December 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance and Other Matter Criteria or specific requirement: 2 CFR 200.320 Methods of Procurement state that if the small purchases method is used, price or rate quotations must be obtained from an adequate number of qualified sources. The City should have internal controls designed to ensure compliance with those provisions. Condition: The City did not follow controls related to ensuring procurement policies were followed. Questioned Costs: None Context: There were 55 transactions that exceeded procurement thresholds during the granting period. The sample size selected tested was 19. During our testing, it was noted on 6 of the 19 items tested that the City was not following the requirements under the adopted procurement policies. Cause: The City did not follow the requirements under the adopted procurement policies. Effect: The County is not in compliance with procurement requirements. Contracts for construction, non- construction related procurements, and those over the simplified acquisition threshold may not be in compliance with the Uniform Guidance. Repeat Finding: The finding is not a repeat of a finding in the immediately prior year. Recommendation: We recommend the City design controls to ensure an adequate review process is in place to review potential contractors to determine they are not suspended or debarred. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Identification Number and Year: SLFRP0135 – 2021 Pass-Through Agency: Wisconsin Department of Administration Pass-Through Number(s): ARPA-NIF-072 Award Period: March 3, 2021 through December 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance and Other Matter Criteria or specific requirement: 2 CFR 200.320 Methods of Procurement state that if the small purchases method is used, price or rate quotations must be obtained from an adequate number of qualified sources. The City should have internal controls designed to ensure compliance with those provisions. Condition: The City did not follow controls related to ensuring procurement policies were followed. Questioned Costs: None Context: There were 55 transactions that exceeded procurement thresholds during the granting period. The sample size selected tested was 19. During our testing, it was noted on 6 of the 19 items tested that the City was not following the requirements under the adopted procurement policies. Cause: The City did not follow the requirements under the adopted procurement policies. Effect: The County is not in compliance with procurement requirements. Contracts for construction, non- construction related procurements, and those over the simplified acquisition threshold may not be in compliance with the Uniform Guidance. Repeat Finding: The finding is not a repeat of a finding in the immediately prior year. Recommendation: We recommend the City design controls to ensure an adequate review process is in place to review potential contractors to determine they are not suspended or debarred. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Identification Number and Year: SLFRP0135 – 2021 Pass-Through Agency: Wisconsin Department of Administration Pass-Through Number(s): ARPA-NIF-072 Award Period: March 3, 2021 through December 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance and Other Matter Criteria or specific requirement: 2 CFR 200.320 Methods of Procurement state that if the small purchases method is used, price or rate quotations must be obtained from an adequate number of qualified sources. The City should have internal controls designed to ensure compliance with those provisions. Condition: The City did not follow controls related to ensuring procurement policies were followed. Questioned Costs: None Context: There were 55 transactions that exceeded procurement thresholds during the granting period. The sample size selected tested was 19. During our testing, it was noted on 6 of the 19 items tested that the City was not following the requirements under the adopted procurement policies. Cause: The City did not follow the requirements under the adopted procurement policies. Effect: The County is not in compliance with procurement requirements. Contracts for construction, non- construction related procurements, and those over the simplified acquisition threshold may not be in compliance with the Uniform Guidance. Repeat Finding: The finding is not a repeat of a finding in the immediately prior year. Recommendation: We recommend the City design controls to ensure an adequate review process is in place to review potential contractors to determine they are not suspended or debarred. Views of responsible officials: There is no disagreement with the audit finding.

Finding 2023-001: Procurement Policy Information on the Federal Program: All Criteria: According to 2 CFR §200.303, the non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States or the internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, according to 2 CFR §200.318 Procurement standards, the non-Federal entity must maintain records sufficient to detail the history of procurement. These records will include, but are not necessarily limited to, the following: Rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. Title 2, Subtitle A Chapter II Part 200 Subpart D 200.319 Procurement Standards. All procurement transactions for the acquisition of property or services required under a Federal award must be conducted in a manner providing full and open competition consistent with the standards of this section and §200.320. The non-Federal entity must have written procedures for procurement transactions." Additionally, according to 2 CFR §200.318 Procurement standards, the non-Federal entity must maintain records sufficient to detail the history of procurement. These records will include, but are not necessarily limited to, the following: Rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. Title 2, Subtitle A Chapter II Part 200 Subpart D 200.319 Procurement Standards. All procurement transactions for the acquisition of property or services required under a Federal award must be conducted in a manner providing full and open competition consistent with the standards of this section and §200.320. The non-Federal entity must have written procedures for procurement transactions. Condition: During our testing performed over procurement and through inquiries with management, we noted the Organization does not have a formally documented procurement policy in place that is consistent with 2 CFR §200.318(a). Cause: Management has not formalized and implemented an official organizational procurement policy. Effect or Potential Effect: An official procurement policy will outline specified thresholds for which procurement is required, required documentation needed for each threshold, and individuals responsible for ensuring procurement is performed in all required circumstances. When no policy is in place, there is a risk that procurement would not be performed, or adequate documentation would not be obtained, when required. Questioned Costs: None noted. Context: We noted that the Organization does not have a documented procurement policy in effect.Identification as a Repeat Finding, if Applicable: Not a repeat finding. Recommendation: We recommend that management formalize and implement an official procurement policy. This policy should include thresholds for which various levels of procurement are required. The policy should also include what documentation is required for each level of procurement. Additionally, the policy should specify individuals responsible for conducting procurement, and approving the final selection.

Federal Agency: U.S. Department of Health and Human Services Program Title: Consolidated Health Centers Assistance Listing Number: 93.224 and 93.527 Award Period: January 1, 2023 to December 31, 2023 Type of Finding: Compliance and Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: § 200.320 Methods of procurement to be followed: The non-Federal entity must have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the approved procurement methods used for the acquisition of property or services required under a Federal award or sub-award. Condition: The Organization did not have documentation of multiple quotes for certain capital purchases as stated under their procurement policy. Questioned costs: None Cause: In certain circumstances the Organization utilizes a supply chain vendor for equipment and supply acquisitions, however the documentation around multiple quotes was not received and maintained. Effect: The Organization may inadvertently select vendors without regard to fair competition and cost analysis. Recommendation: Management should adhere to or revise the Organization’s existing procurement policy and implement a system of processes and internal controls to ensure that the appropriate level of documentation is maintained based on the procurement methodology selected for a transaction of contract. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management identified that subsequent to the conclusion of the 2022 audit in May of 2023 procedures were implemented to the procurement process to assure adherence with the Organization’s policy on a go forward basis. The expenditures in question tested for 2023 were spent in the first quarter of 2023 prior to the procedure improvements and therefore caused the repeat finding.

Federal Agency: U.S. Department of Health and Human Services Program Title: Consolidated Health Centers Assistance Listing Number: 93.224 and 93.527 Award Period: January 1, 2023 to December 31, 2023 Type of Finding: Compliance and Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: § 200.320 Methods of procurement to be followed: The non-Federal entity must have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the approved procurement methods used for the acquisition of property or services required under a Federal award or sub-award. Condition: The Organization did not have documentation of multiple quotes for certain capital purchases as stated under their procurement policy. Questioned costs: None Cause: In certain circumstances the Organization utilizes a supply chain vendor for equipment and supply acquisitions, however the documentation around multiple quotes was not received and maintained. Effect: The Organization may inadvertently select vendors without regard to fair competition and cost analysis. Recommendation: Management should adhere to or revise the Organization’s existing procurement policy and implement a system of processes and internal controls to ensure that the appropriate level of documentation is maintained based on the procurement methodology selected for a transaction of contract. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management identified that subsequent to the conclusion of the 2022 audit in May of 2023 procedures were implemented to the procurement process to assure adherence with the Organization’s policy on a go forward basis. The expenditures in question tested for 2023 were spent in the first quarter of 2023 prior to the procedure improvements and therefore caused the repeat finding.

Criteria: Under the Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) requires certain elements to be part of the District's procurement standards. The general procurement standards require the District to have and use documented procurement procedures that conform to the procurement standards identified in §§ 200.317 through 200.327 of the Uniform Guidance. The details of these requirements can be found in Title 2, Part 200, CFR Section 318(a). The procurement standard also requires written documentation including criteria for when sole source solicitation may be used. The District's written sole source policy does not state that sole source may be used in a public emergency; when a pass-through entity expressly authorizes; or after solicitation of more than one, competition is determined inadequate. The details of these requirements can be found in 2 CFR Section 320(c)(2). Please refer to URL https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part- 200#200.320. Condition/Context: The District has not formally updated their procurement policies to include the thresholds and policies required by the federal government uniform guidance Title 2, Part 200, 2 CFR Section 320 on competitive bidding. Additionally, procurement procedures, specifically required by the federal government for use in sole source solicitations, were not performed for expenses using federal awards. Effect: Major federal programs tested required procurement policies and specific competitive bidding procedures to comply with the use of awarded federal funds to the District. As of the date of this report, the District is not in compliance with those requirements. Cause: The District had not formally amended their procurement policies to conform to the federal procurement policies before spending federal funds. Additionally, the District uses a third-party grant manager (Electrical District #3, Pinal County Arizona) to perform competitive procurement on the District's behalf, in which all federal funds reimburse Electrical District #3 who had paid the vendor awarded the work through competitive means. The third-party grant manager was not awarded in conformity with sole source requirements. Recommendation: We recommend that management formally adopt amendments to their existing procurement policies to conform with U.S. Code of Federal Regulations, Title 2, Part 200, Uniform Administrative Guidance CFR Section 318(a). Additionally, we recommend management perform competitive procurement on all purchases made with federal funds and pay all vendors awarded directly from the District and not through a third-party conduit grant manager. Views of Responsible Officials and Planned Corrective Action: Management concurs with the finding, see corrective action plan.

Identification of the federal program: Federal Agency: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Pass-Through Entities: North Dakota Department of Health, South Dakota Department of Health and Minnesota Department of Health Assistance Listing: 93.155; COVID-19 Rural Health Research Centers Award Numbers: Various Award Year: FY 2021 – 2023 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Uniform Guidance 2 CFR Section 200.213 states, “Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities”.   In addition, Uniform Guidance 2 CFR Section 200.320 (c) states: “There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply: (1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold; (2) The item is available only from a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation; (4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or (5) After solicitation of a number of sources, competition is determined inadequate.” Further, Uniform Guidance 2 CFR Section 200.320(a)(2) states: Small purchases – “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Condition: We noted the following matters during our testing of Procurement and Suspension and Debarment compliance requirements: • A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. For a portion of the year, Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third-party vendor were accurate. • We noted instances where the vendor screening for suspension and debarment was not performed prior to setting up the vendor in the System and procuring the goods/services. Section III—Federal Award Findings and Questioned Costs (continued) • For certain procurement transactions tested, we noted Sanford did not adhere to the compliance requirements and did not follow its procurement policy by maintaining documentation related to cost/price analysis or sole-source procurement and completing the sole-source justification forms timely. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control until August 2023 to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, Sanford did not follow its procurement policy and perform the vendor screening for suspension and debarment prior to setting up the vendor in the system and transacting with the vendors. Furthermore, Sanford, prior to entering into the procurement transaction, did not complete the sole-source justification forms, or maintain documentation to support the sole-sourced procurements for those procurement transactions that exceeded the small purchase threshold. Effect or potential effect: Sanford’s screening for suspension and debarment through the third-party vendor results may not be accurate for the period January 1, 2023 through July 31, 2023. Further, by not performing the vendor screening for suspension and debarment prior to transacting with the vendor, Sanford could have potentially entered into a business transaction with suspended or debarred parties. Sanford did not comply with the federal procurement requirements and its procurement policy by not maintaining adequate documentation to support the cost/price analysis or sole sourced vendor selections in addition to not timely completing the sole source justification forms.   Section III—Federal Award Findings and Questioned Costs (continued) Questioned costs: $307,249 determined as the amount of the procurement expenditures included in the Schedule of Expenditures of Federal Awards for two procurement transactions that had inadequate documentation to justify sole source selection. Context: To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor’s status has not changed. We selected 25 new vendors to verify that the suspension and debarment screening was performed and performed timely. We noted for 3 of the 25 vendors, the suspension and debarment screening was not performed prior to setting up the vendor in the system and for 1 of these vendors, Sanford had entered into a transaction prior to performing the suspension and debarment screening. We selected 8 procurement transactions that exceeded the small purchase threshold. Of the 8 transactions, 4 transactions did not follow the federal procurement standards and Sanford’s procurement policy which requires sole source documentation be completed prior to procuring the items. Additionally, for 2 of these 4 transactions, Sanford did not have sufficient documentation maintained to support the cost/price analysis performed or justification to support the sole source selection of the vendors. Total federal expenditures subject to suspension and debarment is $2,870,421, and federal expenditures exceeding the micro purchase threshold is $2,298,733. Total federal expenditures under the program, as reported on the SEFA, is $2,870,421. Identification as a repeat finding, if applicable: This finding is a repeat of Finding 2022-001 in the prior year. Recommendation: Management should ensure that the suspension and debarment screening is performed prior to entering into the transaction with the vendor and also ensure that it follows the procurement policy to verify suspension and debarment of the vendor prior to setting up the vendor in the system. In addition, Management should ensure that any sole sourced purchases or when quotes are obtained, that those be documented prior to entering into the procurement transaction. Views of responsible officials: Sanford continues to document periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. Additionally, as part of the periodic validation, Sanford will include a validation to ensure a suspension and debarment search is completed prior to setting the vendor up in the system. Sanford will re-educate appropriate staff regarding the process to verify a suspension and debarment search is completed prior to setting up the vendor in the system. Sanford’s preventative and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or debarred. Sanford’s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being utilized for items that do not adhere to the procurement standards. Sanford will re-educate applicable parties and enhance its procedural documentation regarding procurement. Sanford will implement a monthly review process of federal funds utilized for procurement.

Identification of the federal program: Federal Agency: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Pass-Through Entities: North Dakota Department of Health, South Dakota Department of Health and Minnesota Department of Health Assistance Listing: 93.155; COVID-19 Rural Health Research Centers Award Numbers: Various Award Year: FY 2021 – 2023 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Uniform Guidance 2 CFR Section 200.213 states, “Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities”.   In addition, Uniform Guidance 2 CFR Section 200.320 (c) states: “There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply: (1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold; (2) The item is available only from a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation; (4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or (5) After solicitation of a number of sources, competition is determined inadequate.” Further, Uniform Guidance 2 CFR Section 200.320(a)(2) states: Small purchases – “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Condition: We noted the following matters during our testing of Procurement and Suspension and Debarment compliance requirements: • A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. For a portion of the year, Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third-party vendor were accurate. • We noted instances where the vendor screening for suspension and debarment was not performed prior to setting up the vendor in the System and procuring the goods/services. Section III—Federal Award Findings and Questioned Costs (continued) • For certain procurement transactions tested, we noted Sanford did not adhere to the compliance requirements and did not follow its procurement policy by maintaining documentation related to cost/price analysis or sole-source procurement and completing the sole-source justification forms timely. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control until August 2023 to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, Sanford did not follow its procurement policy and perform the vendor screening for suspension and debarment prior to setting up the vendor in the system and transacting with the vendors. Furthermore, Sanford, prior to entering into the procurement transaction, did not complete the sole-source justification forms, or maintain documentation to support the sole-sourced procurements for those procurement transactions that exceeded the small purchase threshold. Effect or potential effect: Sanford’s screening for suspension and debarment through the third-party vendor results may not be accurate for the period January 1, 2023 through July 31, 2023. Further, by not performing the vendor screening for suspension and debarment prior to transacting with the vendor, Sanford could have potentially entered into a business transaction with suspended or debarred parties. Sanford did not comply with the federal procurement requirements and its procurement policy by not maintaining adequate documentation to support the cost/price analysis or sole sourced vendor selections in addition to not timely completing the sole source justification forms.   Section III—Federal Award Findings and Questioned Costs (continued) Questioned costs: $307,249 determined as the amount of the procurement expenditures included in the Schedule of Expenditures of Federal Awards for two procurement transactions that had inadequate documentation to justify sole source selection. Context: To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor’s status has not changed. We selected 25 new vendors to verify that the suspension and debarment screening was performed and performed timely. We noted for 3 of the 25 vendors, the suspension and debarment screening was not performed prior to setting up the vendor in the system and for 1 of these vendors, Sanford had entered into a transaction prior to performing the suspension and debarment screening. We selected 8 procurement transactions that exceeded the small purchase threshold. Of the 8 transactions, 4 transactions did not follow the federal procurement standards and Sanford’s procurement policy which requires sole source documentation be completed prior to procuring the items. Additionally, for 2 of these 4 transactions, Sanford did not have sufficient documentation maintained to support the cost/price analysis performed or justification to support the sole source selection of the vendors. Total federal expenditures subject to suspension and debarment is $2,870,421, and federal expenditures exceeding the micro purchase threshold is $2,298,733. Total federal expenditures under the program, as reported on the SEFA, is $2,870,421. Identification as a repeat finding, if applicable: This finding is a repeat of Finding 2022-001 in the prior year. Recommendation: Management should ensure that the suspension and debarment screening is performed prior to entering into the transaction with the vendor and also ensure that it follows the procurement policy to verify suspension and debarment of the vendor prior to setting up the vendor in the system. In addition, Management should ensure that any sole sourced purchases or when quotes are obtained, that those be documented prior to entering into the procurement transaction. Views of responsible officials: Sanford continues to document periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. Additionally, as part of the periodic validation, Sanford will include a validation to ensure a suspension and debarment search is completed prior to setting the vendor up in the system. Sanford will re-educate appropriate staff regarding the process to verify a suspension and debarment search is completed prior to setting up the vendor in the system. Sanford’s preventative and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or debarred. Sanford’s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being utilized for items that do not adhere to the procurement standards. Sanford will re-educate applicable parties and enhance its procedural documentation regarding procurement. Sanford will implement a monthly review process of federal funds utilized for procurement.

Identification of the federal program: Federal Agency: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Pass-Through Entities: North Dakota Department of Health, South Dakota Department of Health and Minnesota Department of Health Assistance Listing: 93.155; COVID-19 Rural Health Research Centers Award Numbers: Various Award Year: FY 2021 – 2023 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Uniform Guidance 2 CFR Section 200.213 states, “Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities”.   In addition, Uniform Guidance 2 CFR Section 200.320 (c) states: “There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply: (1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold; (2) The item is available only from a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation; (4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or (5) After solicitation of a number of sources, competition is determined inadequate.” Further, Uniform Guidance 2 CFR Section 200.320(a)(2) states: Small purchases – “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Condition: We noted the following matters during our testing of Procurement and Suspension and Debarment compliance requirements: • A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. For a portion of the year, Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third-party vendor were accurate. • We noted instances where the vendor screening for suspension and debarment was not performed prior to setting up the vendor in the System and procuring the goods/services. Section III—Federal Award Findings and Questioned Costs (continued) • For certain procurement transactions tested, we noted Sanford did not adhere to the compliance requirements and did not follow its procurement policy by maintaining documentation related to cost/price analysis or sole-source procurement and completing the sole-source justification forms timely. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control until August 2023 to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, Sanford did not follow its procurement policy and perform the vendor screening for suspension and debarment prior to setting up the vendor in the system and transacting with the vendors. Furthermore, Sanford, prior to entering into the procurement transaction, did not complete the sole-source justification forms, or maintain documentation to support the sole-sourced procurements for those procurement transactions that exceeded the small purchase threshold. Effect or potential effect: Sanford’s screening for suspension and debarment through the third-party vendor results may not be accurate for the period January 1, 2023 through July 31, 2023. Further, by not performing the vendor screening for suspension and debarment prior to transacting with the vendor, Sanford could have potentially entered into a business transaction with suspended or debarred parties. Sanford did not comply with the federal procurement requirements and its procurement policy by not maintaining adequate documentation to support the cost/price analysis or sole sourced vendor selections in addition to not timely completing the sole source justification forms.   Section III—Federal Award Findings and Questioned Costs (continued) Questioned costs: $307,249 determined as the amount of the procurement expenditures included in the Schedule of Expenditures of Federal Awards for two procurement transactions that had inadequate documentation to justify sole source selection. Context: To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor’s status has not changed. We selected 25 new vendors to verify that the suspension and debarment screening was performed and performed timely. We noted for 3 of the 25 vendors, the suspension and debarment screening was not performed prior to setting up the vendor in the system and for 1 of these vendors, Sanford had entered into a transaction prior to performing the suspension and debarment screening. We selected 8 procurement transactions that exceeded the small purchase threshold. Of the 8 transactions, 4 transactions did not follow the federal procurement standards and Sanford’s procurement policy which requires sole source documentation be completed prior to procuring the items. Additionally, for 2 of these 4 transactions, Sanford did not have sufficient documentation maintained to support the cost/price analysis performed or justification to support the sole source selection of the vendors. Total federal expenditures subject to suspension and debarment is $2,870,421, and federal expenditures exceeding the micro purchase threshold is $2,298,733. Total federal expenditures under the program, as reported on the SEFA, is $2,870,421. Identification as a repeat finding, if applicable: This finding is a repeat of Finding 2022-001 in the prior year. Recommendation: Management should ensure that the suspension and debarment screening is performed prior to entering into the transaction with the vendor and also ensure that it follows the procurement policy to verify suspension and debarment of the vendor prior to setting up the vendor in the system. In addition, Management should ensure that any sole sourced purchases or when quotes are obtained, that those be documented prior to entering into the procurement transaction. Views of responsible officials: Sanford continues to document periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. Additionally, as part of the periodic validation, Sanford will include a validation to ensure a suspension and debarment search is completed prior to setting the vendor up in the system. Sanford will re-educate appropriate staff regarding the process to verify a suspension and debarment search is completed prior to setting up the vendor in the system. Sanford’s preventative and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or debarred. Sanford’s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being utilized for items that do not adhere to the procurement standards. Sanford will re-educate applicable parties and enhance its procedural documentation regarding procurement. Sanford will implement a monthly review process of federal funds utilized for procurement.

Identification of the federal program: Federal Agency: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Pass-Through Entities: North Dakota Department of Health, South Dakota Department of Health and Minnesota Department of Health Assistance Listing: 93.155; COVID-19 Rural Health Research Centers Award Numbers: Various Award Year: FY 2021 – 2023 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Uniform Guidance 2 CFR Section 200.213 states, “Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities”.   In addition, Uniform Guidance 2 CFR Section 200.320 (c) states: “There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply: (1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold; (2) The item is available only from a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation; (4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or (5) After solicitation of a number of sources, competition is determined inadequate.” Further, Uniform Guidance 2 CFR Section 200.320(a)(2) states: Small purchases – “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Condition: We noted the following matters during our testing of Procurement and Suspension and Debarment compliance requirements: • A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. For a portion of the year, Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third-party vendor were accurate. • We noted instances where the vendor screening for suspension and debarment was not performed prior to setting up the vendor in the System and procuring the goods/services. Section III—Federal Award Findings and Questioned Costs (continued) • For certain procurement transactions tested, we noted Sanford did not adhere to the compliance requirements and did not follow its procurement policy by maintaining documentation related to cost/price analysis or sole-source procurement and completing the sole-source justification forms timely. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control until August 2023 to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, Sanford did not follow its procurement policy and perform the vendor screening for suspension and debarment prior to setting up the vendor in the system and transacting with the vendors. Furthermore, Sanford, prior to entering into the procurement transaction, did not complete the sole-source justification forms, or maintain documentation to support the sole-sourced procurements for those procurement transactions that exceeded the small purchase threshold. Effect or potential effect: Sanford’s screening for suspension and debarment through the third-party vendor results may not be accurate for the period January 1, 2023 through July 31, 2023. Further, by not performing the vendor screening for suspension and debarment prior to transacting with the vendor, Sanford could have potentially entered into a business transaction with suspended or debarred parties. Sanford did not comply with the federal procurement requirements and its procurement policy by not maintaining adequate documentation to support the cost/price analysis or sole sourced vendor selections in addition to not timely completing the sole source justification forms.   Section III—Federal Award Findings and Questioned Costs (continued) Questioned costs: $307,249 determined as the amount of the procurement expenditures included in the Schedule of Expenditures of Federal Awards for two procurement transactions that had inadequate documentation to justify sole source selection. Context: To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor’s status has not changed. We selected 25 new vendors to verify that the suspension and debarment screening was performed and performed timely. We noted for 3 of the 25 vendors, the suspension and debarment screening was not performed prior to setting up the vendor in the system and for 1 of these vendors, Sanford had entered into a transaction prior to performing the suspension and debarment screening. We selected 8 procurement transactions that exceeded the small purchase threshold. Of the 8 transactions, 4 transactions did not follow the federal procurement standards and Sanford’s procurement policy which requires sole source documentation be completed prior to procuring the items. Additionally, for 2 of these 4 transactions, Sanford did not have sufficient documentation maintained to support the cost/price analysis performed or justification to support the sole source selection of the vendors. Total federal expenditures subject to suspension and debarment is $2,870,421, and federal expenditures exceeding the micro purchase threshold is $2,298,733. Total federal expenditures under the program, as reported on the SEFA, is $2,870,421. Identification as a repeat finding, if applicable: This finding is a repeat of Finding 2022-001 in the prior year. Recommendation: Management should ensure that the suspension and debarment screening is performed prior to entering into the transaction with the vendor and also ensure that it follows the procurement policy to verify suspension and debarment of the vendor prior to setting up the vendor in the system. In addition, Management should ensure that any sole sourced purchases or when quotes are obtained, that those be documented prior to entering into the procurement transaction. Views of responsible officials: Sanford continues to document periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. Additionally, as part of the periodic validation, Sanford will include a validation to ensure a suspension and debarment search is completed prior to setting the vendor up in the system. Sanford will re-educate appropriate staff regarding the process to verify a suspension and debarment search is completed prior to setting up the vendor in the system. Sanford’s preventative and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or debarred. Sanford’s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being utilized for items that do not adhere to the procurement standards. Sanford will re-educate applicable parties and enhance its procedural documentation regarding procurement. Sanford will implement a monthly review process of federal funds utilized for procurement.

Identification of the federal program: Federal Agency: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Pass-Through Entities: North Dakota Department of Health, South Dakota Department of Health and Minnesota Department of Health Assistance Listing: 93.155; COVID-19 Rural Health Research Centers Award Numbers: Various Award Year: FY 2021 – 2023 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Uniform Guidance 2 CFR Section 200.213 states, “Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities”.   In addition, Uniform Guidance 2 CFR Section 200.320 (c) states: “There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply: (1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold; (2) The item is available only from a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation; (4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or (5) After solicitation of a number of sources, competition is determined inadequate.” Further, Uniform Guidance 2 CFR Section 200.320(a)(2) states: Small purchases – “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Condition: We noted the following matters during our testing of Procurement and Suspension and Debarment compliance requirements: • A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. For a portion of the year, Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third-party vendor were accurate. • We noted instances where the vendor screening for suspension and debarment was not performed prior to setting up the vendor in the System and procuring the goods/services. Section III—Federal Award Findings and Questioned Costs (continued) • For certain procurement transactions tested, we noted Sanford did not adhere to the compliance requirements and did not follow its procurement policy by maintaining documentation related to cost/price analysis or sole-source procurement and completing the sole-source justification forms timely. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control until August 2023 to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, Sanford did not follow its procurement policy and perform the vendor screening for suspension and debarment prior to setting up the vendor in the system and transacting with the vendors. Furthermore, Sanford, prior to entering into the procurement transaction, did not complete the sole-source justification forms, or maintain documentation to support the sole-sourced procurements for those procurement transactions that exceeded the small purchase threshold. Effect or potential effect: Sanford’s screening for suspension and debarment through the third-party vendor results may not be accurate for the period January 1, 2023 through July 31, 2023. Further, by not performing the vendor screening for suspension and debarment prior to transacting with the vendor, Sanford could have potentially entered into a business transaction with suspended or debarred parties. Sanford did not comply with the federal procurement requirements and its procurement policy by not maintaining adequate documentation to support the cost/price analysis or sole sourced vendor selections in addition to not timely completing the sole source justification forms.   Section III—Federal Award Findings and Questioned Costs (continued) Questioned costs: $307,249 determined as the amount of the procurement expenditures included in the Schedule of Expenditures of Federal Awards for two procurement transactions that had inadequate documentation to justify sole source selection. Context: To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor’s status has not changed. We selected 25 new vendors to verify that the suspension and debarment screening was performed and performed timely. We noted for 3 of the 25 vendors, the suspension and debarment screening was not performed prior to setting up the vendor in the system and for 1 of these vendors, Sanford had entered into a transaction prior to performing the suspension and debarment screening. We selected 8 procurement transactions that exceeded the small purchase threshold. Of the 8 transactions, 4 transactions did not follow the federal procurement standards and Sanford’s procurement policy which requires sole source documentation be completed prior to procuring the items. Additionally, for 2 of these 4 transactions, Sanford did not have sufficient documentation maintained to support the cost/price analysis performed or justification to support the sole source selection of the vendors. Total federal expenditures subject to suspension and debarment is $2,870,421, and federal expenditures exceeding the micro purchase threshold is $2,298,733. Total federal expenditures under the program, as reported on the SEFA, is $2,870,421. Identification as a repeat finding, if applicable: This finding is a repeat of Finding 2022-001 in the prior year. Recommendation: Management should ensure that the suspension and debarment screening is performed prior to entering into the transaction with the vendor and also ensure that it follows the procurement policy to verify suspension and debarment of the vendor prior to setting up the vendor in the system. In addition, Management should ensure that any sole sourced purchases or when quotes are obtained, that those be documented prior to entering into the procurement transaction. Views of responsible officials: Sanford continues to document periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. Additionally, as part of the periodic validation, Sanford will include a validation to ensure a suspension and debarment search is completed prior to setting the vendor up in the system. Sanford will re-educate appropriate staff regarding the process to verify a suspension and debarment search is completed prior to setting up the vendor in the system. Sanford’s preventative and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or debarred. Sanford’s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being utilized for items that do not adhere to the procurement standards. Sanford will re-educate applicable parties and enhance its procedural documentation regarding procurement. Sanford will implement a monthly review process of federal funds utilized for procurement.

Identification of the federal program: Federal Agency: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Pass-Through Entities: North Dakota Department of Health, South Dakota Department of Health and Minnesota Department of Health Assistance Listing: 93.155; COVID-19 Rural Health Research Centers Award Numbers: Various Award Year: FY 2021 – 2023 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Uniform Guidance 2 CFR Section 200.213 states, “Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities”.   In addition, Uniform Guidance 2 CFR Section 200.320 (c) states: “There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply: (1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold; (2) The item is available only from a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation; (4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or (5) After solicitation of a number of sources, competition is determined inadequate.” Further, Uniform Guidance 2 CFR Section 200.320(a)(2) states: Small purchases – “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Condition: We noted the following matters during our testing of Procurement and Suspension and Debarment compliance requirements: • A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. For a portion of the year, Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third-party vendor were accurate. • We noted instances where the vendor screening for suspension and debarment was not performed prior to setting up the vendor in the System and procuring the goods/services. Section III—Federal Award Findings and Questioned Costs (continued) • For certain procurement transactions tested, we noted Sanford did not adhere to the compliance requirements and did not follow its procurement policy by maintaining documentation related to cost/price analysis or sole-source procurement and completing the sole-source justification forms timely. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control until August 2023 to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, Sanford did not follow its procurement policy and perform the vendor screening for suspension and debarment prior to setting up the vendor in the system and transacting with the vendors. Furthermore, Sanford, prior to entering into the procurement transaction, did not complete the sole-source justification forms, or maintain documentation to support the sole-sourced procurements for those procurement transactions that exceeded the small purchase threshold. Effect or potential effect: Sanford’s screening for suspension and debarment through the third-party vendor results may not be accurate for the period January 1, 2023 through July 31, 2023. Further, by not performing the vendor screening for suspension and debarment prior to transacting with the vendor, Sanford could have potentially entered into a business transaction with suspended or debarred parties. Sanford did not comply with the federal procurement requirements and its procurement policy by not maintaining adequate documentation to support the cost/price analysis or sole sourced vendor selections in addition to not timely completing the sole source justification forms.   Section III—Federal Award Findings and Questioned Costs (continued) Questioned costs: $307,249 determined as the amount of the procurement expenditures included in the Schedule of Expenditures of Federal Awards for two procurement transactions that had inadequate documentation to justify sole source selection. Context: To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor’s status has not changed. We selected 25 new vendors to verify that the suspension and debarment screening was performed and performed timely. We noted for 3 of the 25 vendors, the suspension and debarment screening was not performed prior to setting up the vendor in the system and for 1 of these vendors, Sanford had entered into a transaction prior to performing the suspension and debarment screening. We selected 8 procurement transactions that exceeded the small purchase threshold. Of the 8 transactions, 4 transactions did not follow the federal procurement standards and Sanford’s procurement policy which requires sole source documentation be completed prior to procuring the items. Additionally, for 2 of these 4 transactions, Sanford did not have sufficient documentation maintained to support the cost/price analysis performed or justification to support the sole source selection of the vendors. Total federal expenditures subject to suspension and debarment is $2,870,421, and federal expenditures exceeding the micro purchase threshold is $2,298,733. Total federal expenditures under the program, as reported on the SEFA, is $2,870,421. Identification as a repeat finding, if applicable: This finding is a repeat of Finding 2022-001 in the prior year. Recommendation: Management should ensure that the suspension and debarment screening is performed prior to entering into the transaction with the vendor and also ensure that it follows the procurement policy to verify suspension and debarment of the vendor prior to setting up the vendor in the system. In addition, Management should ensure that any sole sourced purchases or when quotes are obtained, that those be documented prior to entering into the procurement transaction. Views of responsible officials: Sanford continues to document periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. Additionally, as part of the periodic validation, Sanford will include a validation to ensure a suspension and debarment search is completed prior to setting the vendor up in the system. Sanford will re-educate appropriate staff regarding the process to verify a suspension and debarment search is completed prior to setting up the vendor in the system. Sanford’s preventative and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or debarred. Sanford’s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being utilized for items that do not adhere to the procurement standards. Sanford will re-educate applicable parties and enhance its procedural documentation regarding procurement. Sanford will implement a monthly review process of federal funds utilized for procurement.

Identification of the federal program: Federal Agency: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Pass-Through Entities: North Dakota Department of Health, South Dakota Department of Health and Minnesota Department of Health Assistance Listing: 93.155; COVID-19 Rural Health Research Centers Award Numbers: Various Award Year: FY 2021 – 2023 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Uniform Guidance 2 CFR Section 200.213 states, “Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities”.   In addition, Uniform Guidance 2 CFR Section 200.320 (c) states: “There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply: (1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold; (2) The item is available only from a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation; (4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or (5) After solicitation of a number of sources, competition is determined inadequate.” Further, Uniform Guidance 2 CFR Section 200.320(a)(2) states: Small purchases – “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Condition: We noted the following matters during our testing of Procurement and Suspension and Debarment compliance requirements: • A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. For a portion of the year, Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third-party vendor were accurate. • We noted instances where the vendor screening for suspension and debarment was not performed prior to setting up the vendor in the System and procuring the goods/services. Section III—Federal Award Findings and Questioned Costs (continued) • For certain procurement transactions tested, we noted Sanford did not adhere to the compliance requirements and did not follow its procurement policy by maintaining documentation related to cost/price analysis or sole-source procurement and completing the sole-source justification forms timely. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control until August 2023 to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, Sanford did not follow its procurement policy and perform the vendor screening for suspension and debarment prior to setting up the vendor in the system and transacting with the vendors. Furthermore, Sanford, prior to entering into the procurement transaction, did not complete the sole-source justification forms, or maintain documentation to support the sole-sourced procurements for those procurement transactions that exceeded the small purchase threshold. Effect or potential effect: Sanford’s screening for suspension and debarment through the third-party vendor results may not be accurate for the period January 1, 2023 through July 31, 2023. Further, by not performing the vendor screening for suspension and debarment prior to transacting with the vendor, Sanford could have potentially entered into a business transaction with suspended or debarred parties. Sanford did not comply with the federal procurement requirements and its procurement policy by not maintaining adequate documentation to support the cost/price analysis or sole sourced vendor selections in addition to not timely completing the sole source justification forms.   Section III—Federal Award Findings and Questioned Costs (continued) Questioned costs: $307,249 determined as the amount of the procurement expenditures included in the Schedule of Expenditures of Federal Awards for two procurement transactions that had inadequate documentation to justify sole source selection. Context: To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor’s status has not changed. We selected 25 new vendors to verify that the suspension and debarment screening was performed and performed timely. We noted for 3 of the 25 vendors, the suspension and debarment screening was not performed prior to setting up the vendor in the system and for 1 of these vendors, Sanford had entered into a transaction prior to performing the suspension and debarment screening. We selected 8 procurement transactions that exceeded the small purchase threshold. Of the 8 transactions, 4 transactions did not follow the federal procurement standards and Sanford’s procurement policy which requires sole source documentation be completed prior to procuring the items. Additionally, for 2 of these 4 transactions, Sanford did not have sufficient documentation maintained to support the cost/price analysis performed or justification to support the sole source selection of the vendors. Total federal expenditures subject to suspension and debarment is $2,870,421, and federal expenditures exceeding the micro purchase threshold is $2,298,733. Total federal expenditures under the program, as reported on the SEFA, is $2,870,421. Identification as a repeat finding, if applicable: This finding is a repeat of Finding 2022-001 in the prior year. Recommendation: Management should ensure that the suspension and debarment screening is performed prior to entering into the transaction with the vendor and also ensure that it follows the procurement policy to verify suspension and debarment of the vendor prior to setting up the vendor in the system. In addition, Management should ensure that any sole sourced purchases or when quotes are obtained, that those be documented prior to entering into the procurement transaction. Views of responsible officials: Sanford continues to document periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. Additionally, as part of the periodic validation, Sanford will include a validation to ensure a suspension and debarment search is completed prior to setting the vendor up in the system. Sanford will re-educate appropriate staff regarding the process to verify a suspension and debarment search is completed prior to setting up the vendor in the system. Sanford’s preventative and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or debarred. Sanford’s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being utilized for items that do not adhere to the procurement standards. Sanford will re-educate applicable parties and enhance its procedural documentation regarding procurement. Sanford will implement a monthly review process of federal funds utilized for procurement.

Identification of the federal program: Federal Agency: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Pass-Through Entities: North Dakota Department of Health, South Dakota Department of Health and Minnesota Department of Health Assistance Listing: 93.155; COVID-19 Rural Health Research Centers Award Numbers: Various Award Year: FY 2021 – 2023 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Uniform Guidance 2 CFR Section 200.213 states, “Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities”.   In addition, Uniform Guidance 2 CFR Section 200.320 (c) states: “There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply: (1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold; (2) The item is available only from a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation; (4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or (5) After solicitation of a number of sources, competition is determined inadequate.” Further, Uniform Guidance 2 CFR Section 200.320(a)(2) states: Small purchases – “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Condition: We noted the following matters during our testing of Procurement and Suspension and Debarment compliance requirements: • A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. For a portion of the year, Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third-party vendor were accurate. • We noted instances where the vendor screening for suspension and debarment was not performed prior to setting up the vendor in the System and procuring the goods/services. Section III—Federal Award Findings and Questioned Costs (continued) • For certain procurement transactions tested, we noted Sanford did not adhere to the compliance requirements and did not follow its procurement policy by maintaining documentation related to cost/price analysis or sole-source procurement and completing the sole-source justification forms timely. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control until August 2023 to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, Sanford did not follow its procurement policy and perform the vendor screening for suspension and debarment prior to setting up the vendor in the system and transacting with the vendors. Furthermore, Sanford, prior to entering into the procurement transaction, did not complete the sole-source justification forms, or maintain documentation to support the sole-sourced procurements for those procurement transactions that exceeded the small purchase threshold. Effect or potential effect: Sanford’s screening for suspension and debarment through the third-party vendor results may not be accurate for the period January 1, 2023 through July 31, 2023. Further, by not performing the vendor screening for suspension and debarment prior to transacting with the vendor, Sanford could have potentially entered into a business transaction with suspended or debarred parties. Sanford did not comply with the federal procurement requirements and its procurement policy by not maintaining adequate documentation to support the cost/price analysis or sole sourced vendor selections in addition to not timely completing the sole source justification forms.   Section III—Federal Award Findings and Questioned Costs (continued) Questioned costs: $307,249 determined as the amount of the procurement expenditures included in the Schedule of Expenditures of Federal Awards for two procurement transactions that had inadequate documentation to justify sole source selection. Context: To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor’s status has not changed. We selected 25 new vendors to verify that the suspension and debarment screening was performed and performed timely. We noted for 3 of the 25 vendors, the suspension and debarment screening was not performed prior to setting up the vendor in the system and for 1 of these vendors, Sanford had entered into a transaction prior to performing the suspension and debarment screening. We selected 8 procurement transactions that exceeded the small purchase threshold. Of the 8 transactions, 4 transactions did not follow the federal procurement standards and Sanford’s procurement policy which requires sole source documentation be completed prior to procuring the items. Additionally, for 2 of these 4 transactions, Sanford did not have sufficient documentation maintained to support the cost/price analysis performed or justification to support the sole source selection of the vendors. Total federal expenditures subject to suspension and debarment is $2,870,421, and federal expenditures exceeding the micro purchase threshold is $2,298,733. Total federal expenditures under the program, as reported on the SEFA, is $2,870,421. Identification as a repeat finding, if applicable: This finding is a repeat of Finding 2022-001 in the prior year. Recommendation: Management should ensure that the suspension and debarment screening is performed prior to entering into the transaction with the vendor and also ensure that it follows the procurement policy to verify suspension and debarment of the vendor prior to setting up the vendor in the system. In addition, Management should ensure that any sole sourced purchases or when quotes are obtained, that those be documented prior to entering into the procurement transaction. Views of responsible officials: Sanford continues to document periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. Additionally, as part of the periodic validation, Sanford will include a validation to ensure a suspension and debarment search is completed prior to setting the vendor up in the system. Sanford will re-educate appropriate staff regarding the process to verify a suspension and debarment search is completed prior to setting up the vendor in the system. Sanford’s preventative and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or debarred. Sanford’s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being utilized for items that do not adhere to the procurement standards. Sanford will re-educate applicable parties and enhance its procedural documentation regarding procurement. Sanford will implement a monthly review process of federal funds utilized for procurement.

Identification of the federal program: Federal Agency: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Pass-Through Entities: North Dakota Department of Health, South Dakota Department of Health and Minnesota Department of Health Assistance Listing: 93.155; COVID-19 Rural Health Research Centers Award Numbers: Various Award Year: FY 2021 – 2023 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Uniform Guidance 2 CFR Section 200.213 states, “Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities”.   In addition, Uniform Guidance 2 CFR Section 200.320 (c) states: “There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply: (1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold; (2) The item is available only from a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation; (4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or (5) After solicitation of a number of sources, competition is determined inadequate.” Further, Uniform Guidance 2 CFR Section 200.320(a)(2) states: Small purchases – “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Condition: We noted the following matters during our testing of Procurement and Suspension and Debarment compliance requirements: • A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. For a portion of the year, Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third-party vendor were accurate. • We noted instances where the vendor screening for suspension and debarment was not performed prior to setting up the vendor in the System and procuring the goods/services. Section III—Federal Award Findings and Questioned Costs (continued) • For certain procurement transactions tested, we noted Sanford did not adhere to the compliance requirements and did not follow its procurement policy by maintaining documentation related to cost/price analysis or sole-source procurement and completing the sole-source justification forms timely. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control until August 2023 to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, Sanford did not follow its procurement policy and perform the vendor screening for suspension and debarment prior to setting up the vendor in the system and transacting with the vendors. Furthermore, Sanford, prior to entering into the procurement transaction, did not complete the sole-source justification forms, or maintain documentation to support the sole-sourced procurements for those procurement transactions that exceeded the small purchase threshold. Effect or potential effect: Sanford’s screening for suspension and debarment through the third-party vendor results may not be accurate for the period January 1, 2023 through July 31, 2023. Further, by not performing the vendor screening for suspension and debarment prior to transacting with the vendor, Sanford could have potentially entered into a business transaction with suspended or debarred parties. Sanford did not comply with the federal procurement requirements and its procurement policy by not maintaining adequate documentation to support the cost/price analysis or sole sourced vendor selections in addition to not timely completing the sole source justification forms.   Section III—Federal Award Findings and Questioned Costs (continued) Questioned costs: $307,249 determined as the amount of the procurement expenditures included in the Schedule of Expenditures of Federal Awards for two procurement transactions that had inadequate documentation to justify sole source selection. Context: To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor’s status has not changed. We selected 25 new vendors to verify that the suspension and debarment screening was performed and performed timely. We noted for 3 of the 25 vendors, the suspension and debarment screening was not performed prior to setting up the vendor in the system and for 1 of these vendors, Sanford had entered into a transaction prior to performing the suspension and debarment screening. We selected 8 procurement transactions that exceeded the small purchase threshold. Of the 8 transactions, 4 transactions did not follow the federal procurement standards and Sanford’s procurement policy which requires sole source documentation be completed prior to procuring the items. Additionally, for 2 of these 4 transactions, Sanford did not have sufficient documentation maintained to support the cost/price analysis performed or justification to support the sole source selection of the vendors. Total federal expenditures subject to suspension and debarment is $2,870,421, and federal expenditures exceeding the micro purchase threshold is $2,298,733. Total federal expenditures under the program, as reported on the SEFA, is $2,870,421. Identification as a repeat finding, if applicable: This finding is a repeat of Finding 2022-001 in the prior year. Recommendation: Management should ensure that the suspension and debarment screening is performed prior to entering into the transaction with the vendor and also ensure that it follows the procurement policy to verify suspension and debarment of the vendor prior to setting up the vendor in the system. In addition, Management should ensure that any sole sourced purchases or when quotes are obtained, that those be documented prior to entering into the procurement transaction. Views of responsible officials: Sanford continues to document periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. Additionally, as part of the periodic validation, Sanford will include a validation to ensure a suspension and debarment search is completed prior to setting the vendor up in the system. Sanford will re-educate appropriate staff regarding the process to verify a suspension and debarment search is completed prior to setting up the vendor in the system. Sanford’s preventative and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or debarred. Sanford’s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being utilized for items that do not adhere to the procurement standards. Sanford will re-educate applicable parties and enhance its procedural documentation regarding procurement. Sanford will implement a monthly review process of federal funds utilized for procurement.

Identification of the federal program: Federal Agency: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Pass-Through Entities: North Dakota Department of Health, South Dakota Department of Health and Minnesota Department of Health Assistance Listing: 93.155; COVID-19 Rural Health Research Centers Award Numbers: Various Award Year: FY 2021 – 2023 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Uniform Guidance 2 CFR Section 200.213 states, “Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities”.   In addition, Uniform Guidance 2 CFR Section 200.320 (c) states: “There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply: (1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold; (2) The item is available only from a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation; (4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or (5) After solicitation of a number of sources, competition is determined inadequate.” Further, Uniform Guidance 2 CFR Section 200.320(a)(2) states: Small purchases – “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Condition: We noted the following matters during our testing of Procurement and Suspension and Debarment compliance requirements: • A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. For a portion of the year, Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third-party vendor were accurate. • We noted instances where the vendor screening for suspension and debarment was not performed prior to setting up the vendor in the System and procuring the goods/services. Section III—Federal Award Findings and Questioned Costs (continued) • For certain procurement transactions tested, we noted Sanford did not adhere to the compliance requirements and did not follow its procurement policy by maintaining documentation related to cost/price analysis or sole-source procurement and completing the sole-source justification forms timely. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control until August 2023 to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, Sanford did not follow its procurement policy and perform the vendor screening for suspension and debarment prior to setting up the vendor in the system and transacting with the vendors. Furthermore, Sanford, prior to entering into the procurement transaction, did not complete the sole-source justification forms, or maintain documentation to support the sole-sourced procurements for those procurement transactions that exceeded the small purchase threshold. Effect or potential effect: Sanford’s screening for suspension and debarment through the third-party vendor results may not be accurate for the period January 1, 2023 through July 31, 2023. Further, by not performing the vendor screening for suspension and debarment prior to transacting with the vendor, Sanford could have potentially entered into a business transaction with suspended or debarred parties. Sanford did not comply with the federal procurement requirements and its procurement policy by not maintaining adequate documentation to support the cost/price analysis or sole sourced vendor selections in addition to not timely completing the sole source justification forms.   Section III—Federal Award Findings and Questioned Costs (continued) Questioned costs: $307,249 determined as the amount of the procurement expenditures included in the Schedule of Expenditures of Federal Awards for two procurement transactions that had inadequate documentation to justify sole source selection. Context: To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor’s status has not changed. We selected 25 new vendors to verify that the suspension and debarment screening was performed and performed timely. We noted for 3 of the 25 vendors, the suspension and debarment screening was not performed prior to setting up the vendor in the system and for 1 of these vendors, Sanford had entered into a transaction prior to performing the suspension and debarment screening. We selected 8 procurement transactions that exceeded the small purchase threshold. Of the 8 transactions, 4 transactions did not follow the federal procurement standards and Sanford’s procurement policy which requires sole source documentation be completed prior to procuring the items. Additionally, for 2 of these 4 transactions, Sanford did not have sufficient documentation maintained to support the cost/price analysis performed or justification to support the sole source selection of the vendors. Total federal expenditures subject to suspension and debarment is $2,870,421, and federal expenditures exceeding the micro purchase threshold is $2,298,733. Total federal expenditures under the program, as reported on the SEFA, is $2,870,421. Identification as a repeat finding, if applicable: This finding is a repeat of Finding 2022-001 in the prior year. Recommendation: Management should ensure that the suspension and debarment screening is performed prior to entering into the transaction with the vendor and also ensure that it follows the procurement policy to verify suspension and debarment of the vendor prior to setting up the vendor in the system. In addition, Management should ensure that any sole sourced purchases or when quotes are obtained, that those be documented prior to entering into the procurement transaction. Views of responsible officials: Sanford continues to document periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. Additionally, as part of the periodic validation, Sanford will include a validation to ensure a suspension and debarment search is completed prior to setting the vendor up in the system. Sanford will re-educate appropriate staff regarding the process to verify a suspension and debarment search is completed prior to setting up the vendor in the system. Sanford’s preventative and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or debarred. Sanford’s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being utilized for items that do not adhere to the procurement standards. Sanford will re-educate applicable parties and enhance its procedural documentation regarding procurement. Sanford will implement a monthly review process of federal funds utilized for procurement.

Identification of the federal program: Federal Agency: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Pass-Through Entities: North Dakota Department of Health, South Dakota Department of Health and Minnesota Department of Health Assistance Listing: 93.155; COVID-19 Rural Health Research Centers Award Numbers: Various Award Year: FY 2021 – 2023 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Uniform Guidance 2 CFR Section 200.213 states, “Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities”.   In addition, Uniform Guidance 2 CFR Section 200.320 (c) states: “There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply: (1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold; (2) The item is available only from a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation; (4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or (5) After solicitation of a number of sources, competition is determined inadequate.” Further, Uniform Guidance 2 CFR Section 200.320(a)(2) states: Small purchases – “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Condition: We noted the following matters during our testing of Procurement and Suspension and Debarment compliance requirements: • A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. For a portion of the year, Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third-party vendor were accurate. • We noted instances where the vendor screening for suspension and debarment was not performed prior to setting up the vendor in the System and procuring the goods/services. Section III—Federal Award Findings and Questioned Costs (continued) • For certain procurement transactions tested, we noted Sanford did not adhere to the compliance requirements and did not follow its procurement policy by maintaining documentation related to cost/price analysis or sole-source procurement and completing the sole-source justification forms timely. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control until August 2023 to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, Sanford did not follow its procurement policy and perform the vendor screening for suspension and debarment prior to setting up the vendor in the system and transacting with the vendors. Furthermore, Sanford, prior to entering into the procurement transaction, did not complete the sole-source justification forms, or maintain documentation to support the sole-sourced procurements for those procurement transactions that exceeded the small purchase threshold. Effect or potential effect: Sanford’s screening for suspension and debarment through the third-party vendor results may not be accurate for the period January 1, 2023 through July 31, 2023. Further, by not performing the vendor screening for suspension and debarment prior to transacting with the vendor, Sanford could have potentially entered into a business transaction with suspended or debarred parties. Sanford did not comply with the federal procurement requirements and its procurement policy by not maintaining adequate documentation to support the cost/price analysis or sole sourced vendor selections in addition to not timely completing the sole source justification forms.   Section III—Federal Award Findings and Questioned Costs (continued) Questioned costs: $307,249 determined as the amount of the procurement expenditures included in the Schedule of Expenditures of Federal Awards for two procurement transactions that had inadequate documentation to justify sole source selection. Context: To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor’s status has not changed. We selected 25 new vendors to verify that the suspension and debarment screening was performed and performed timely. We noted for 3 of the 25 vendors, the suspension and debarment screening was not performed prior to setting up the vendor in the system and for 1 of these vendors, Sanford had entered into a transaction prior to performing the suspension and debarment screening. We selected 8 procurement transactions that exceeded the small purchase threshold. Of the 8 transactions, 4 transactions did not follow the federal procurement standards and Sanford’s procurement policy which requires sole source documentation be completed prior to procuring the items. Additionally, for 2 of these 4 transactions, Sanford did not have sufficient documentation maintained to support the cost/price analysis performed or justification to support the sole source selection of the vendors. Total federal expenditures subject to suspension and debarment is $2,870,421, and federal expenditures exceeding the micro purchase threshold is $2,298,733. Total federal expenditures under the program, as reported on the SEFA, is $2,870,421. Identification as a repeat finding, if applicable: This finding is a repeat of Finding 2022-001 in the prior year. Recommendation: Management should ensure that the suspension and debarment screening is performed prior to entering into the transaction with the vendor and also ensure that it follows the procurement policy to verify suspension and debarment of the vendor prior to setting up the vendor in the system. In addition, Management should ensure that any sole sourced purchases or when quotes are obtained, that those be documented prior to entering into the procurement transaction. Views of responsible officials: Sanford continues to document periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. Additionally, as part of the periodic validation, Sanford will include a validation to ensure a suspension and debarment search is completed prior to setting the vendor up in the system. Sanford will re-educate appropriate staff regarding the process to verify a suspension and debarment search is completed prior to setting up the vendor in the system. Sanford’s preventative and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or debarred. Sanford’s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being utilized for items that do not adhere to the procurement standards. Sanford will re-educate applicable parties and enhance its procedural documentation regarding procurement. Sanford will implement a monthly review process of federal funds utilized for procurement.

Identification of the federal program: Federal Agency: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Pass-Through Entities: North Dakota Department of Health, South Dakota Department of Health and Minnesota Department of Health Assistance Listing: 93.155; COVID-19 Rural Health Research Centers Award Numbers: Various Award Year: FY 2021 – 2023 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Uniform Guidance 2 CFR Section 200.213 states, “Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities”.   In addition, Uniform Guidance 2 CFR Section 200.320 (c) states: “There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply: (1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold; (2) The item is available only from a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation; (4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or (5) After solicitation of a number of sources, competition is determined inadequate.” Further, Uniform Guidance 2 CFR Section 200.320(a)(2) states: Small purchases – “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Condition: We noted the following matters during our testing of Procurement and Suspension and Debarment compliance requirements: • A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. For a portion of the year, Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third-party vendor were accurate. • We noted instances where the vendor screening for suspension and debarment was not performed prior to setting up the vendor in the System and procuring the goods/services. Section III—Federal Award Findings and Questioned Costs (continued) • For certain procurement transactions tested, we noted Sanford did not adhere to the compliance requirements and did not follow its procurement policy by maintaining documentation related to cost/price analysis or sole-source procurement and completing the sole-source justification forms timely. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control until August 2023 to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, Sanford did not follow its procurement policy and perform the vendor screening for suspension and debarment prior to setting up the vendor in the system and transacting with the vendors. Furthermore, Sanford, prior to entering into the procurement transaction, did not complete the sole-source justification forms, or maintain documentation to support the sole-sourced procurements for those procurement transactions that exceeded the small purchase threshold. Effect or potential effect: Sanford’s screening for suspension and debarment through the third-party vendor results may not be accurate for the period January 1, 2023 through July 31, 2023. Further, by not performing the vendor screening for suspension and debarment prior to transacting with the vendor, Sanford could have potentially entered into a business transaction with suspended or debarred parties. Sanford did not comply with the federal procurement requirements and its procurement policy by not maintaining adequate documentation to support the cost/price analysis or sole sourced vendor selections in addition to not timely completing the sole source justification forms.   Section III—Federal Award Findings and Questioned Costs (continued) Questioned costs: $307,249 determined as the amount of the procurement expenditures included in the Schedule of Expenditures of Federal Awards for two procurement transactions that had inadequate documentation to justify sole source selection. Context: To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor’s status has not changed. We selected 25 new vendors to verify that the suspension and debarment screening was performed and performed timely. We noted for 3 of the 25 vendors, the suspension and debarment screening was not performed prior to setting up the vendor in the system and for 1 of these vendors, Sanford had entered into a transaction prior to performing the suspension and debarment screening. We selected 8 procurement transactions that exceeded the small purchase threshold. Of the 8 transactions, 4 transactions did not follow the federal procurement standards and Sanford’s procurement policy which requires sole source documentation be completed prior to procuring the items. Additionally, for 2 of these 4 transactions, Sanford did not have sufficient documentation maintained to support the cost/price analysis performed or justification to support the sole source selection of the vendors. Total federal expenditures subject to suspension and debarment is $2,870,421, and federal expenditures exceeding the micro purchase threshold is $2,298,733. Total federal expenditures under the program, as reported on the SEFA, is $2,870,421. Identification as a repeat finding, if applicable: This finding is a repeat of Finding 2022-001 in the prior year. Recommendation: Management should ensure that the suspension and debarment screening is performed prior to entering into the transaction with the vendor and also ensure that it follows the procurement policy to verify suspension and debarment of the vendor prior to setting up the vendor in the system. In addition, Management should ensure that any sole sourced purchases or when quotes are obtained, that those be documented prior to entering into the procurement transaction. Views of responsible officials: Sanford continues to document periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. Additionally, as part of the periodic validation, Sanford will include a validation to ensure a suspension and debarment search is completed prior to setting the vendor up in the system. Sanford will re-educate appropriate staff regarding the process to verify a suspension and debarment search is completed prior to setting up the vendor in the system. Sanford’s preventative and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or debarred. Sanford’s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being utilized for items that do not adhere to the procurement standards. Sanford will re-educate applicable parties and enhance its procedural documentation regarding procurement. Sanford will implement a monthly review process of federal funds utilized for procurement.

Identification of the federal program: Federal Agency: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Pass-Through Entities: North Dakota Department of Health, South Dakota Department of Health and Minnesota Department of Health Assistance Listing: 93.155; COVID-19 Rural Health Research Centers Award Numbers: Various Award Year: FY 2021 – 2023 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Uniform Guidance 2 CFR Section 200.213 states, “Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities”.   In addition, Uniform Guidance 2 CFR Section 200.320 (c) states: “There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply: (1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold; (2) The item is available only from a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation; (4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or (5) After solicitation of a number of sources, competition is determined inadequate.” Further, Uniform Guidance 2 CFR Section 200.320(a)(2) states: Small purchases – “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Condition: We noted the following matters during our testing of Procurement and Suspension and Debarment compliance requirements: • A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. For a portion of the year, Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third-party vendor were accurate. • We noted instances where the vendor screening for suspension and debarment was not performed prior to setting up the vendor in the System and procuring the goods/services. Section III—Federal Award Findings and Questioned Costs (continued) • For certain procurement transactions tested, we noted Sanford did not adhere to the compliance requirements and did not follow its procurement policy by maintaining documentation related to cost/price analysis or sole-source procurement and completing the sole-source justification forms timely. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control until August 2023 to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, Sanford did not follow its procurement policy and perform the vendor screening for suspension and debarment prior to setting up the vendor in the system and transacting with the vendors. Furthermore, Sanford, prior to entering into the procurement transaction, did not complete the sole-source justification forms, or maintain documentation to support the sole-sourced procurements for those procurement transactions that exceeded the small purchase threshold. Effect or potential effect: Sanford’s screening for suspension and debarment through the third-party vendor results may not be accurate for the period January 1, 2023 through July 31, 2023. Further, by not performing the vendor screening for suspension and debarment prior to transacting with the vendor, Sanford could have potentially entered into a business transaction with suspended or debarred parties. Sanford did not comply with the federal procurement requirements and its procurement policy by not maintaining adequate documentation to support the cost/price analysis or sole sourced vendor selections in addition to not timely completing the sole source justification forms.   Section III—Federal Award Findings and Questioned Costs (continued) Questioned costs: $307,249 determined as the amount of the procurement expenditures included in the Schedule of Expenditures of Federal Awards for two procurement transactions that had inadequate documentation to justify sole source selection. Context: To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor’s status has not changed. We selected 25 new vendors to verify that the suspension and debarment screening was performed and performed timely. We noted for 3 of the 25 vendors, the suspension and debarment screening was not performed prior to setting up the vendor in the system and for 1 of these vendors, Sanford had entered into a transaction prior to performing the suspension and debarment screening. We selected 8 procurement transactions that exceeded the small purchase threshold. Of the 8 transactions, 4 transactions did not follow the federal procurement standards and Sanford’s procurement policy which requires sole source documentation be completed prior to procuring the items. Additionally, for 2 of these 4 transactions, Sanford did not have sufficient documentation maintained to support the cost/price analysis performed or justification to support the sole source selection of the vendors. Total federal expenditures subject to suspension and debarment is $2,870,421, and federal expenditures exceeding the micro purchase threshold is $2,298,733. Total federal expenditures under the program, as reported on the SEFA, is $2,870,421. Identification as a repeat finding, if applicable: This finding is a repeat of Finding 2022-001 in the prior year. Recommendation: Management should ensure that the suspension and debarment screening is performed prior to entering into the transaction with the vendor and also ensure that it follows the procurement policy to verify suspension and debarment of the vendor prior to setting up the vendor in the system. In addition, Management should ensure that any sole sourced purchases or when quotes are obtained, that those be documented prior to entering into the procurement transaction. Views of responsible officials: Sanford continues to document periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. Additionally, as part of the periodic validation, Sanford will include a validation to ensure a suspension and debarment search is completed prior to setting the vendor up in the system. Sanford will re-educate appropriate staff regarding the process to verify a suspension and debarment search is completed prior to setting up the vendor in the system. Sanford’s preventative and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or debarred. Sanford’s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being utilized for items that do not adhere to the procurement standards. Sanford will re-educate applicable parties and enhance its procedural documentation regarding procurement. Sanford will implement a monthly review process of federal funds utilized for procurement.

Identification of the federal program: Federal Agency: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Pass-Through Entities: North Dakota Department of Health, South Dakota Department of Health and Minnesota Department of Health Assistance Listing: 93.155; COVID-19 Rural Health Research Centers Award Numbers: Various Award Year: FY 2021 – 2023 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Uniform Guidance 2 CFR Section 200.213 states, “Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities”.   In addition, Uniform Guidance 2 CFR Section 200.320 (c) states: “There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply: (1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold; (2) The item is available only from a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation; (4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or (5) After solicitation of a number of sources, competition is determined inadequate.” Further, Uniform Guidance 2 CFR Section 200.320(a)(2) states: Small purchases – “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Condition: We noted the following matters during our testing of Procurement and Suspension and Debarment compliance requirements: • A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. For a portion of the year, Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third-party vendor were accurate. • We noted instances where the vendor screening for suspension and debarment was not performed prior to setting up the vendor in the System and procuring the goods/services. Section III—Federal Award Findings and Questioned Costs (continued) • For certain procurement transactions tested, we noted Sanford did not adhere to the compliance requirements and did not follow its procurement policy by maintaining documentation related to cost/price analysis or sole-source procurement and completing the sole-source justification forms timely. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control until August 2023 to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, Sanford did not follow its procurement policy and perform the vendor screening for suspension and debarment prior to setting up the vendor in the system and transacting with the vendors. Furthermore, Sanford, prior to entering into the procurement transaction, did not complete the sole-source justification forms, or maintain documentation to support the sole-sourced procurements for those procurement transactions that exceeded the small purchase threshold. Effect or potential effect: Sanford’s screening for suspension and debarment through the third-party vendor results may not be accurate for the period January 1, 2023 through July 31, 2023. Further, by not performing the vendor screening for suspension and debarment prior to transacting with the vendor, Sanford could have potentially entered into a business transaction with suspended or debarred parties. Sanford did not comply with the federal procurement requirements and its procurement policy by not maintaining adequate documentation to support the cost/price analysis or sole sourced vendor selections in addition to not timely completing the sole source justification forms.   Section III—Federal Award Findings and Questioned Costs (continued) Questioned costs: $307,249 determined as the amount of the procurement expenditures included in the Schedule of Expenditures of Federal Awards for two procurement transactions that had inadequate documentation to justify sole source selection. Context: To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor’s status has not changed. We selected 25 new vendors to verify that the suspension and debarment screening was performed and performed timely. We noted for 3 of the 25 vendors, the suspension and debarment screening was not performed prior to setting up the vendor in the system and for 1 of these vendors, Sanford had entered into a transaction prior to performing the suspension and debarment screening. We selected 8 procurement transactions that exceeded the small purchase threshold. Of the 8 transactions, 4 transactions did not follow the federal procurement standards and Sanford’s procurement policy which requires sole source documentation be completed prior to procuring the items. Additionally, for 2 of these 4 transactions, Sanford did not have sufficient documentation maintained to support the cost/price analysis performed or justification to support the sole source selection of the vendors. Total federal expenditures subject to suspension and debarment is $2,870,421, and federal expenditures exceeding the micro purchase threshold is $2,298,733. Total federal expenditures under the program, as reported on the SEFA, is $2,870,421. Identification as a repeat finding, if applicable: This finding is a repeat of Finding 2022-001 in the prior year. Recommendation: Management should ensure that the suspension and debarment screening is performed prior to entering into the transaction with the vendor and also ensure that it follows the procurement policy to verify suspension and debarment of the vendor prior to setting up the vendor in the system. In addition, Management should ensure that any sole sourced purchases or when quotes are obtained, that those be documented prior to entering into the procurement transaction. Views of responsible officials: Sanford continues to document periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. Additionally, as part of the periodic validation, Sanford will include a validation to ensure a suspension and debarment search is completed prior to setting the vendor up in the system. Sanford will re-educate appropriate staff regarding the process to verify a suspension and debarment search is completed prior to setting up the vendor in the system. Sanford’s preventative and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or debarred. Sanford’s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being utilized for items that do not adhere to the procurement standards. Sanford will re-educate applicable parties and enhance its procedural documentation regarding procurement. Sanford will implement a monthly review process of federal funds utilized for procurement.

Identification of the federal program: Federal Agency: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Pass-Through Entities: North Dakota Department of Health, South Dakota Department of Health and Minnesota Department of Health Assistance Listing: 93.155; COVID-19 Rural Health Research Centers Award Numbers: Various Award Year: FY 2021 – 2023 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Uniform Guidance 2 CFR Section 200.213 states, “Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities”.   In addition, Uniform Guidance 2 CFR Section 200.320 (c) states: “There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply: (1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold; (2) The item is available only from a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation; (4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or (5) After solicitation of a number of sources, competition is determined inadequate.” Further, Uniform Guidance 2 CFR Section 200.320(a)(2) states: Small purchases – “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Condition: We noted the following matters during our testing of Procurement and Suspension and Debarment compliance requirements: • A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. For a portion of the year, Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third-party vendor were accurate. • We noted instances where the vendor screening for suspension and debarment was not performed prior to setting up the vendor in the System and procuring the goods/services. Section III—Federal Award Findings and Questioned Costs (continued) • For certain procurement transactions tested, we noted Sanford did not adhere to the compliance requirements and did not follow its procurement policy by maintaining documentation related to cost/price analysis or sole-source procurement and completing the sole-source justification forms timely. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control until August 2023 to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, Sanford did not follow its procurement policy and perform the vendor screening for suspension and debarment prior to setting up the vendor in the system and transacting with the vendors. Furthermore, Sanford, prior to entering into the procurement transaction, did not complete the sole-source justification forms, or maintain documentation to support the sole-sourced procurements for those procurement transactions that exceeded the small purchase threshold. Effect or potential effect: Sanford’s screening for suspension and debarment through the third-party vendor results may not be accurate for the period January 1, 2023 through July 31, 2023. Further, by not performing the vendor screening for suspension and debarment prior to transacting with the vendor, Sanford could have potentially entered into a business transaction with suspended or debarred parties. Sanford did not comply with the federal procurement requirements and its procurement policy by not maintaining adequate documentation to support the cost/price analysis or sole sourced vendor selections in addition to not timely completing the sole source justification forms.   Section III—Federal Award Findings and Questioned Costs (continued) Questioned costs: $307,249 determined as the amount of the procurement expenditures included in the Schedule of Expenditures of Federal Awards for two procurement transactions that had inadequate documentation to justify sole source selection. Context: To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor’s status has not changed. We selected 25 new vendors to verify that the suspension and debarment screening was performed and performed timely. We noted for 3 of the 25 vendors, the suspension and debarment screening was not performed prior to setting up the vendor in the system and for 1 of these vendors, Sanford had entered into a transaction prior to performing the suspension and debarment screening. We selected 8 procurement transactions that exceeded the small purchase threshold. Of the 8 transactions, 4 transactions did not follow the federal procurement standards and Sanford’s procurement policy which requires sole source documentation be completed prior to procuring the items. Additionally, for 2 of these 4 transactions, Sanford did not have sufficient documentation maintained to support the cost/price analysis performed or justification to support the sole source selection of the vendors. Total federal expenditures subject to suspension and debarment is $2,870,421, and federal expenditures exceeding the micro purchase threshold is $2,298,733. Total federal expenditures under the program, as reported on the SEFA, is $2,870,421. Identification as a repeat finding, if applicable: This finding is a repeat of Finding 2022-001 in the prior year. Recommendation: Management should ensure that the suspension and debarment screening is performed prior to entering into the transaction with the vendor and also ensure that it follows the procurement policy to verify suspension and debarment of the vendor prior to setting up the vendor in the system. In addition, Management should ensure that any sole sourced purchases or when quotes are obtained, that those be documented prior to entering into the procurement transaction. Views of responsible officials: Sanford continues to document periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. Additionally, as part of the periodic validation, Sanford will include a validation to ensure a suspension and debarment search is completed prior to setting the vendor up in the system. Sanford will re-educate appropriate staff regarding the process to verify a suspension and debarment search is completed prior to setting up the vendor in the system. Sanford’s preventative and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or debarred. Sanford’s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being utilized for items that do not adhere to the procurement standards. Sanford will re-educate applicable parties and enhance its procedural documentation regarding procurement. Sanford will implement a monthly review process of federal funds utilized for procurement.

Identification of the federal program: Federal Agency: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Pass-Through Entities: North Dakota Department of Health, South Dakota Department of Health and Minnesota Department of Health Assistance Listing: 93.155; COVID-19 Rural Health Research Centers Award Numbers: Various Award Year: FY 2021 – 2023 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Uniform Guidance 2 CFR Section 200.213 states, “Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities”.   In addition, Uniform Guidance 2 CFR Section 200.320 (c) states: “There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply: (1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold; (2) The item is available only from a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation; (4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or (5) After solicitation of a number of sources, competition is determined inadequate.” Further, Uniform Guidance 2 CFR Section 200.320(a)(2) states: Small purchases – “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Condition: We noted the following matters during our testing of Procurement and Suspension and Debarment compliance requirements: • A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. For a portion of the year, Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third-party vendor were accurate. • We noted instances where the vendor screening for suspension and debarment was not performed prior to setting up the vendor in the System and procuring the goods/services. Section III—Federal Award Findings and Questioned Costs (continued) • For certain procurement transactions tested, we noted Sanford did not adhere to the compliance requirements and did not follow its procurement policy by maintaining documentation related to cost/price analysis or sole-source procurement and completing the sole-source justification forms timely. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control until August 2023 to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match. In addition, Sanford did not follow its procurement policy and perform the vendor screening for suspension and debarment prior to setting up the vendor in the system and transacting with the vendors. Furthermore, Sanford, prior to entering into the procurement transaction, did not complete the sole-source justification forms, or maintain documentation to support the sole-sourced procurements for those procurement transactions that exceeded the small purchase threshold. Effect or potential effect: Sanford’s screening for suspension and debarment through the third-party vendor results may not be accurate for the period January 1, 2023 through July 31, 2023. Further, by not performing the vendor screening for suspension and debarment prior to transacting with the vendor, Sanford could have potentially entered into a business transaction with suspended or debarred parties. Sanford did not comply with the federal procurement requirements and its procurement policy by not maintaining adequate documentation to support the cost/price analysis or sole sourced vendor selections in addition to not timely completing the sole source justification forms.   Section III—Federal Award Findings and Questioned Costs (continued) Questioned costs: $307,249 determined as the amount of the procurement expenditures included in the Schedule of Expenditures of Federal Awards for two procurement transactions that had inadequate documentation to justify sole source selection. Context: To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor’s status has not changed. We selected 25 new vendors to verify that the suspension and debarment screening was performed and performed timely. We noted for 3 of the 25 vendors, the suspension and debarment screening was not performed prior to setting up the vendor in the system and for 1 of these vendors, Sanford had entered into a transaction prior to performing the suspension and debarment screening. We selected 8 procurement transactions that exceeded the small purchase threshold. Of the 8 transactions, 4 transactions did not follow the federal procurement standards and Sanford’s procurement policy which requires sole source documentation be completed prior to procuring the items. Additionally, for 2 of these 4 transactions, Sanford did not have sufficient documentation maintained to support the cost/price analysis performed or justification to support the sole source selection of the vendors. Total federal expenditures subject to suspension and debarment is $2,870,421, and federal expenditures exceeding the micro purchase threshold is $2,298,733. Total federal expenditures under the program, as reported on the SEFA, is $2,870,421. Identification as a repeat finding, if applicable: This finding is a repeat of Finding 2022-001 in the prior year. Recommendation: Management should ensure that the suspension and debarment screening is performed prior to entering into the transaction with the vendor and also ensure that it follows the procurement policy to verify suspension and debarment of the vendor prior to setting up the vendor in the system. In addition, Management should ensure that any sole sourced purchases or when quotes are obtained, that those be documented prior to entering into the procurement transaction. Views of responsible officials: Sanford continues to document periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. Additionally, as part of the periodic validation, Sanford will include a validation to ensure a suspension and debarment search is completed prior to setting the vendor up in the system. Sanford will re-educate appropriate staff regarding the process to verify a suspension and debarment search is completed prior to setting up the vendor in the system. Sanford’s preventative and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or debarred. Sanford’s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being utilized for items that do not adhere to the procurement standards. Sanford will re-educate applicable parties and enhance its procedural documentation regarding procurement. Sanford will implement a monthly review process of federal funds utilized for procurement.

Criteria or specific requirement: The Code of Federal Regulations, 2 CFR 200.320, requires that nonfederal entities must have and use documented procurement procedures. Such procurement procedures must reflect the standards identified in 2 CFR 200.320. These standards require various elements, such as cover conflict of interests, avoiding acquisition of unnecessary or duplicative items, maintaining records sufficient to detail the history of procurement, and conducting procurement in a manner providing full and open competition and adhering to the required methods of procurement for the acquisition of property and services. The required methods of procurement: • Micro purchases: These purchases may be awarded without soliciting competitive price or rate quotations if the non-Federal entity considers the price to be reasonable based on research, experience, purchase history or other information and documents it files accordingly. • Small purchases: For purchases of which the dollar amount is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. • Procurement by sealed bids: A procurement method in which bids are publicly solicited and a firm fixed-price contract (lump sum or unit price) is awarded to the responsible bidder whose bid, conforming with all the material terms and conditions of the invitation for bids, is the lowest in price. • Procurement by competitive proposals: A procurement method in which either a fixed price or cost-reimbursement type contract is awarded. Proposals are generally used when conditions are not appropriate for the use of sealed bids. • Noncompetitive procurement: This procurement method is when a proposal form only one source is used. This form of procurement can only be used when an item is only available from a single source, for a public emergency, the awarding agency expressly authorizes the proposal, or, after solicitation of a number of sources, competition is determined inadequate. Condition: The Company's written procurement policy did not address the federally required elements of written procurement policies listed above. Context: Based on our review of the Company's procurement policy, we noted that the policy did not include documented procurement procedures for the required elements above. Cause: Management was unaware of the requirements that such elements should be included in their written procurement policy. Effect: The Company is not in compliance with procurement policy requirements as outlined by 2 CFR 200.320. Recommendation: We recommend the Company update its written procurement policy so that it incorporates all required procurement elements as outlined by 2 CFR 200.320. Views of responsible officials: There is no disagreement with the audit finding.

Procurement, Suspension and Debarment Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Pass-Through Entity: The University of Texas Health (93.853, NS119834) Assistance Listing Nos.: 12.420, 93.310, 93.353, 93.393, and 93.853 Award Numbers: W81XWH-15-1-0292 (12.420), OD23121 (93.310), CA246568 (93.353), CA259201 (93.393), NS119834 (93.853), NS122096 (93.853) Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.320(a)(2)(i) of the Uniform Guidance states the following regarding small purchases: “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed: “When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with § 200.319 or paragraph (c) of this section.” Section 200.214 of the Uniform Guidance states “Non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.” The Clinic procurement justification form for procurements more than $25,000 requires completion of the rationale for the procurement and a search of the federal government’s exclusion list to be performed and documented at the time of the procurement. On a monthly basis, Supply Chain Management performs a review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures. Condition: Internal Control For five (56%) of nine procurement transactions tested for operating effectiveness of internal controls, the procurement justification form used by the Clinic to document the history of the procurement and compliance with Uniform Guidance CFR 200.303, was not completed until after the purchase order was created and/or invoice received from the vendor. In addition, for these same five procurement transactions, the Clinic did not timely document its suspension and debarment check at the time of procurement as required by its procurement justification form. In addition, for four (44%) of nine procurement transactions tested for operating effectiveness of internal controls (two of which relate to the five cited above), the procurement justification form used by the Clinic to document the procurement transaction’s compliance with policies, procedures and the Uniform Guidance was outdated. Furthermore, the monthly review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures was not operating effectively. Compliance For one (9%) of 11 procurement transactions tested for compliance, the procurement was an add-on purchase related to a larger procurement of the same product under a prior purchase order. The prior procurement was above the simplified acquisition threshold and the Clinic’s competitive bid threshold. The Clinic did not complete a procurement justification form for the add-on purchase (which was a small purchase), and the original procurement did not have adequate support to evidence that it had been competitively bid. As such, adequate documentation did not exist for the procurement in accordance with Uniform Guidance Section 230.320(a)(2)(i) and(b). In addition, for five procurement transactions, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Cause: While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures and Uniform Guidance CFR 200.320, the review of the procurement justification form is not robust enough to identify errors and there is not a process in place to ensure the form is completed prior to the purchase. Effect or potential effect: The Clinic’s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to small purchases and noncompetitive procurements. Questioned costs: $53,482, determined as the amount of the procurement expenditures included in the schedule of expenditures of federal awards for the year ended December 31, 2023, for the one procurement transaction that had inadequate support for compliance with CFR 200.320 at the time of procurement, as follows: • Assistance Listing No. 93.310, OD023121 – $53,482 Context: Internal Control We sampled nine federal procurements over $25,000 to test operating effectiveness of internal controls, totaling $962,393, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For seven of the 11 federal procurements tested totaling $770,093, procurement controls were not operating effectively. • For five of 11 procurement transactions tested totaling $529,273, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately two to eight months later. Compliance We sampled 11 federal procurements over $25,000 to test compliance, totaling $1,736,844, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For one of 11 federal procurements tested totaling $53,482, documentation retained was not adequate to support that the procurement transaction was executed in accordance with the Uniform Guidance Sections 200.320(a)(2)(i) and (b). • For five of 11 procurement transactions tested totaling $529,273, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Procurement-related expenditures are approximately 9% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is not a repeat of the finding of the prior year. Recommendation: The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures, and internal controls to comply with the Uniform Guidance procurement standards and that the procurement justification form is reviewed prior to entering into the purchase transaction. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with the Clinic documented policies, procedures, and internal controls. Views of responsible officials: Management will reinforce education and training to the research community and procurement teams regarding the procurement requirements, Justification of Source Selection Checklist/Form, and timely completion of the required documentation. The Clinic utilizes a third party, Visual Compliance, to execute daily supplier sanction and debarment checks for all Mayo Clinic vendors. All third party suspension and debarment match alerts are reviewed and adjudicated as needed. Going forward, the Clinic will supplement this daily review by periodically validating a sample of vendors who are not flagged with an alert by Visual Compliance.

Procurement, Suspension and Debarment Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services and U.S. Department of Defense Federal Cluster: Research and Development (R&D) Pass-Through Entity: The University of Texas Health (93.853, NS119834) Assistance Listing Nos.: 12.420, 93.310, 93.353, 93.393, and 93.853 Award Numbers: W81XWH-15-1-0292 (12.420), OD23121 (93.310), CA246568 (93.353), CA259201 (93.393), NS119834 (93.853), NS122096 (93.853) Award Periods: Various Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Section 200.320(a)(2)(i) of the Uniform Guidance states the following regarding small purchases: “The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity.” Section 200.320(b) of the Uniform Guidance states the following regarding formal procurement methods to be followed: “When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with § 200.319 or paragraph (c) of this section.” Section 200.214 of the Uniform Guidance states “Non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.” The Clinic procurement justification form for procurements more than $25,000 requires completion of the rationale for the procurement and a search of the federal government’s exclusion list to be performed and documented at the time of the procurement. On a monthly basis, Supply Chain Management performs a review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures. Condition: Internal Control For five (56%) of nine procurement transactions tested for operating effectiveness of internal controls, the procurement justification form used by the Clinic to document the history of the procurement and compliance with Uniform Guidance CFR 200.303, was not completed until after the purchase order was created and/or invoice received from the vendor. In addition, for these same five procurement transactions, the Clinic did not timely document its suspension and debarment check at the time of procurement as required by its procurement justification form. In addition, for four (44%) of nine procurement transactions tested for operating effectiveness of internal controls (two of which relate to the five cited above), the procurement justification form used by the Clinic to document the procurement transaction’s compliance with policies, procedures and the Uniform Guidance was outdated. Furthermore, the monthly review of completed procurement justification forms related to procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures was not operating effectively. Compliance For one (9%) of 11 procurement transactions tested for compliance, the procurement was an add-on purchase related to a larger procurement of the same product under a prior purchase order. The prior procurement was above the simplified acquisition threshold and the Clinic’s competitive bid threshold. The Clinic did not complete a procurement justification form for the add-on purchase (which was a small purchase), and the original procurement did not have adequate support to evidence that it had been competitively bid. As such, adequate documentation did not exist for the procurement in accordance with Uniform Guidance Section 230.320(a)(2)(i) and(b). In addition, for five procurement transactions, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Cause: While management has internal controls in place to review procurements > $25,000 to ensure they are documented in accordance with the Clinic’s procurement, suspension and debarment policies and procedures and Uniform Guidance CFR 200.320, the review of the procurement justification form is not robust enough to identify errors and there is not a process in place to ensure the form is completed prior to the purchase. Effect or potential effect: The Clinic’s internal controls over procurement were not properly followed during the fiscal year. In addition, the Clinic did not follow the Uniform Guidance requirements related to small purchases and noncompetitive procurements. Questioned costs: $53,482, determined as the amount of the procurement expenditures included in the schedule of expenditures of federal awards for the year ended December 31, 2023, for the one procurement transaction that had inadequate support for compliance with CFR 200.320 at the time of procurement, as follows: • Assistance Listing No. 93.310, OD023121 – $53,482 Context: Internal Control We sampled nine federal procurements over $25,000 to test operating effectiveness of internal controls, totaling $962,393, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For seven of the 11 federal procurements tested totaling $770,093, procurement controls were not operating effectively. • For five of 11 procurement transactions tested totaling $529,273, the independent suspension and debarment check to be performed at the time of procurement was not performed until approximately two to eight months later. Compliance We sampled 11 federal procurements over $25,000 to test compliance, totaling $1,736,844, from a population of 74 federal procurements over $25,000, totaling $5,400,242 and noted the following: • For one of 11 federal procurements tested totaling $53,482, documentation retained was not adequate to support that the procurement transaction was executed in accordance with the Uniform Guidance Sections 200.320(a)(2)(i) and (b). • For five of 11 procurement transactions tested totaling $529,273, the Clinic did not follow its suspension and debarment procedures as required by its procurement justification form. Procurement-related expenditures are approximately 9% of total Federal expenditures for the R&D Cluster of $445,961,340 for the year ended December 31, 2023. Identification as a repeat finding, if applicable: The finding is not a repeat of the finding of the prior year. Recommendation: The Clinic should ensure that all R&D awards that require procurement of goods and services follow established policies, procedures, and internal controls to comply with the Uniform Guidance procurement standards and that the procurement justification form is reviewed prior to entering into the purchase transaction. The Clinic should ensure that independent checks for suspension and debarment should be timely completed at the time of procurement in accordance with the Clinic documented policies, procedures, and internal controls. Views of responsible officials: Management will reinforce education and training to the research community and procurement teams regarding the procurement requirements, Justification of Source Selection Checklist/Form, and timely completion of the required documentation. The Clinic utilizes a third party, Visual Compliance, to execute daily supplier sanction and debarment checks for all Mayo Clinic vendors. All third party suspension and debarment match alerts are reviewed and adjudicated as needed. Going forward, the Clinic will supplement this daily review by periodically validating a sample of vendors who are not flagged with an alert by Visual Compliance.