Finding 12117 (2022-003)

Finding 2022-003 Identification of the federal program: Federal Grantor: U.S. Department of Health and Human Services (HHS) Health Resources and Services Administration (HRSA) Assistance Listing: 93.498 COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Award Year: 2021?2022 Criteria or specific requirement (including statutory, regulatory, or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: Management did not retain supporting documentation over its review and approval of the lost revenue calculation and expenses reported in the HHS portal. Cause: Management represented it performed a review and approval of the lost revenue calculation, COVID-19 expenses, and HHS portal submission of lost revenue; however, adequate supporting documentation to evidence that the internal controls were sufficiently designed and operating effectively was not maintained. Effect or potential effect: A lack of internal controls over the review of the lost revenue calculation, COVID-19 expenses, and the data submitted in the HHS portal could result in a misstatement of the amounts reported in the HHS portal. Questioned costs: $0 Context: VUMC had two submissions to HRSA during FY22, which included expenses and lost revenue. Total federal expenditures for Assistance Listing No. 93.498 totaled $58,653,058 for the year ended June 30, 2022. Identification as a repeat finding, if applicable: 2021-003 Recommendation: Management should implement internal controls over the review and approval of the data used to calculate lost revenue and expenses and the report of lost revenue in the HHS portal. Views of responsible officials: All expenditures included by VUMC Management (Management) in its submissions in the Department of Health and Human Services (HHS) portal were verified against HHS guidance to ensure allowability. Management understands that additional audit evidence must be retained at a detailed enough level to allow the auditor to meet their reperformance standard. Management believes that our control risk is mitigated by the fact that our lost revenues far exceed any provider relief funding received. However, should management need to report any future eligible expenses in the HHS portal, we will retain additional audit evidence to enable auditor reperformance of the controls regarding allowability of expenditures. Management also established appropriate review and approval controls surrounding the performance and review of the lost revenue analytic and the subsequent reporting of lost revenue in the HHS portal. Management retained documentation to support execution of this control; however, management understands that additional audit evidence supporting the reviews was not available to the auditor to evidence execution of this control. Management will retain additional audit evidence to allow the auditor to reperform execution of this control for future HHS portal submissions.