RESPONSES FOR HSB-HOLDING FY25 PROGRAM-SPECIFIC AUDIT 2025-001: Data Collection Form Submission Criteria: Non-federal entities that expend $1,000,000 or more in federal funds are required to submit Form SF-SAC and the program-specific audit reporting package online utilizing the Internet Data Entry System (IDES). The package must be uploaded by the earlier of nine months after the close of the fiscal year or 30 days after the audit report is received by the entity consistent with 2 CFR 200.512. Condition: The organization failed to timely submit the audited schedule of expenditures of federal awards to the Federal Audit Clearinghouse (FAC) database by the required due date related to the program-specific audit for fiscal year 2025. Cause: The organization's system of internal controls did not identify the need for a program specific audit which resulted in delay of the performance and finalization of the engagement. Effect: The organization's reporting package was not timely submitted to the FAC. Recommendation: We recommend management design and implement a system of internal controls whereby internal controls over compliance related to federal awards are understood, monitored, and implemented consistently throughout the fiscal year. Views of Responsible Officials and Planned Corrective Actions: St. Jude's Ranch for Children (the parent entity of HSB Holding Company) will conduct a comprehensive review of the flow of federal funds across affiliated entities to clearly identify which entities are direct recipients or subrecipients of awards to ensure proper identification of entities requiring a Single Audit. This includes documenting the source, amount, and purpose of federal funds received. Moving forward, this will be conducted upon execution of federal awards. SJRC will implement an internal review step in the year-end close process to evaluate whether a Single Audit is required based on federal expenditures. This will include a review of federal funding by entity and program. 2025-002: System of Internal Controls Over Compliance:Procurement, Suspension,and Debarment; U.S. Department of Treasury, Assis tance Listing #21.027, Coronavirus State and Local Fiscal Recovery Funds, Passed Through St. Jude's Ranch for Children, Boulder City Campus Criteria: In accordance with 2 CFR 200.62(a)(3), the auditee must maintain a system of internal control over compliance to provide reasonable assurance that expenditures under federal award programs adhere to procurement standards as outlined in 2 CFR Part 200, Subpart D. Condition: The organization did not adhere to the procurementstandards as required under 2 CFR Part 200, Subpart D, and/or the written purchasing and procurement policy. Context: On July 15, 2022, the organization entered into a construction contract to construct a capital asset. Subsequently, on June 24, 2024, the organization was awarded funding through the Coronavirus State and Local Fiscal Recovery Fund to construct said capital asset. As the capital project construction contract was executed prior to the federal award being received, the organization did not adhere to the procurement standards as required under 2 CFR Part 200, Subpart D, and/or the written purchasing and procurementpolicy. These construction contracts finalized in October 2024 which is prior to the identification of the finding for internal control over procurement, suspension, and debarment on the Single Audit for the year ended June 30, 2024 and therefore remained an internal control deficiency for the year ended June 30, 2025. Effect: Lack of adherence to procurement standards as outlined in 2 CFR Part 200, Subpart D, could result in contractual liabilities incurred by the organization that are related to suspended, debarred, or otherwise unauthorized contractors. Cause: Upon receipt of the federal award intended to fund the capital project, the organization did not appropriately consider the potential remedial action(s) needed as related to adherence to 2 CFR Part 200, Subpart D. Recommendation: We recommend management design and implement a system of internal controls over compliance whereby procurement standards are adhered to for all expenditures requested for reimbursement under federal award programs. Views of Responsible Officials and Planned Corrective Actions: The CFO, Accounting Manager and/or outsourced accountant will review all contracts involving federal funds prior to execution to verify adherence to 2 CFR Part 200, Subpart D. Given the unique nature of the contract in question being executed prior to the awarding of federal funds but subsequently using the federal funds to cover expenditures related to the contract, St. Jude's Ranch for Children (the parent entity of HSB Holding Company) does not anticipate a similar scenario in the future. However, SJRC will meet with legal counsel to review existing boilerplate contracts and incorporate a 2 CFR Part 200, Subpart D compliance clause for use in any contracts with the potential to be funded by federal awards. Training will be provided to SJRC finance and program staff, led by legal counsel, covering: (i) contract negotiation basics; (ii) federal clauses that are non-negotiable (e.g., 2 CFR 200 provisions); and (iii) when legal review is required. PRIOR YEAR (FY24) STATUS AND UPDATED RESPONSES 2024-001 Data Collection Form Submission Unresolved - see 2025-001. 2024-002 System of Internal Controls Over Compliance: Activities Allowed and Unallowed, Allowable Costs/Cost Principles, and Period of Performance; U.S. Department of Treasury, Assistance Listing #21.027, Coronavirus State and Local Fiscal Recovery Funds, Passed Through St. Jude's Ranch for Children, Boulder City Campus Resolved. 2024-003: System of Internal Controls Over Compliance: Procurement, Suspension, and Debarment; U.S. Department of Treasury, Assistance Listing #21.027, Coronavirus State and Local Fiscal Recovery Funds, Passed Through St. Jude's Ranch for Children, Boulder City Campus Unresolved - see 2025-002. Responsible Official: David Caldwell Chief Financial Officer dcaldwell@stjudesranch.org