Finding 2022-002 ? A. Activities Allowed or Unallowed, B. Allowable Costs/Cost Principles, L. Reporting Identification of the federal program: Federal Agency: U.S. Department of Health and Human Services (HHS), Health Resources and Services Administration (HRSA) Assistance Listing: 93.948 COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Award Period: January 1, 2020 through December 31, 2021 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? The terms and conditions of the award require the following: ? The recipient certified that the payment will only be used to prevent, prepare for, and respond to coronavirus, and that the payment shall reimburse the recipient only for health care related expenses or lost revenues that are attributable to coronavirus. ? The recipient certifies that it will not use the payment to reimburse expenses or losses that have been reimbursed from other sources or that other sources are obligated to reimburse. ? The recipient shall submit reports as the secretary of Health and Human Services (HHS) determines are needed to ensure compliance with conditions that are imposed on the payment, and such reports shall be in such form, with such content, as specified by the secretary of HHS in future program instructions directed to all recipients. The Provider Relief Programs: Provider Relief Fund and ARP Rural Payments Frequently Asked Questions states the following: ? Duplication of expenses and lost revenues is not permitted. ? Expenses and lost revenues may not be duplicated: payments may not be applied to the same expenses and lost revenues that were reported on in prior reporting periods. Condition: UC Health?s internal controls over the review and approval of use of the funds (i.e., to prevent, prepare for, and respond to COVID-19) and related Portal reporting were not suitably designed, and thus were not operating effectively. During our testing over reporting, we observed management did not have effective internal controls in place to ensure expenses and lost revenues reported in the Portal were not duplicated. This resulted in the overstatements of expenses and lost revenues reported in the Portal. Cause: UC Health did not retain supporting documentation over its internal review and approval processes to evidence compliance with the Provider Relief Fund (PRF) T&Cs. Management did not design or have internal controls in place to ensure the expenses and lost revenues attributable to COVID-19 reported in the Portal were not duplicated across their multiple Portal submissions. Multiple submissions were required due to multiple program reporting periods, as well as the targeted distributions received across the company ? as each entity receiving a PRF targeted distribution is required to submit independent Portal submissions (while a consolidated submission is permissible for PRF general distributions). Effect or potential effect: A lack of formalized documentation prepared and retained to evidence the performance of internal controls could result in non-compliance with PRF T&Cs. A portion of expenses and lost revenue attributable to COVID-19 were duplicated and, therefore, reported incorrectly in the Portal. Questioned costs: $23,179,592 of duplicated expenses included in Period 2 UC Healthcare System Portal filing, as these expenses were also reported in Period 1 and / or other Period 2 Portal filings submitted by various UC Health entities. Context: We inquired of management, who noted internal controls over the allowability principles were not effectively designed, and thus were not operating effectively. As part of our testing procedures each of UC Health?s three Period 2 Portal filings were reviewed, with reported COVID-19 expenses and lost revenues reconciled to underlying files. We observed during the reconciliation process that the University of Cincinnati Medical Center (UCMC) expense balance included $18,716,595 of expenses incurred between January 1, 2020 and June 30, 2021 that had also been submitted as part of UC Healthcare System?s general distribution Period 1 Portal filing. Further, the UC Healthcare System Period 2 expense total was an aggregation of expenses incurred across various UC Health entities, including UCMC. As a result, $4,462,997 of UCMC expenses incurred between July 1, 2021 and December 31, 2021 were duplicated across the UCMC and UC Healthcare System Period 2 Portal filings. We also observed that the lost revenue reported in the Period 2 UC Healthcare System Portal filing was consistent with the lost revenue balance reported by that same entity in Period 1. However, this balance included the lost revenue of the UCMC, which did not have a Period 1 filing but did include report lost revenue in its Period 2 filing. As such, the UCMC lost revenue balance ($59,704,396) is included in both the UCMC and UC Healthcare System submissions is considered duplicative. Total federal expenditures for Assistance Listing 93.498 totaled $47,584,291 for the year ended June 30, 2022. All related Period 2 Portal submissions were reviewed as part our testing, with no Period 3 Portal submissions required to be filed as no funds were received in the related period. Identification as a repeat finding, if applicable: The nature and cause of this finding are consistent with the 2021-002 finding included in the June 30, 2021 Single Audit Report. Recommendation: Management should design and implement internal controls to document its review and compliance with the Provider Relief Fund?s T&C?s, as well as formalize retention policies pertaining to this documentation. This will prevent duplication of expenses and lost revenues in future Portal reporting periods. Views of responsible officials: Management agrees with this finding and will update policies and work procedures to ensure compliance with the Provider Relief Fund. In addition, management will also implement additional internal controls over Portal submissions to prevent the duplication of expenses and lost revenue in future reporting periods. Management believes more than sufficient lost revenues have been incurred (excluding any duplications) to support retention of all Provider Relief Funds reported to date.