Finding Text
Finding 2023-001
Identification of the Federal Program:
Federal Grantor: United States Department of Health and Human Services and Department of
Defense
Assistance Listing No.: Various; Research and Development Cluster
Period of Performance: January 1, 2023 – December 31, 2023
Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation):
2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control:
“The Non-Federal entity must establish and maintain effective internal control over the Federal
award that provides reasonable assurance that the non-Federal entity is managing the Federal
award in compliance with Federal statutes, regulations, and the terms and conditions of the
Federal award. These internal controls should be in compliance with guidance in “Standards
for Internal Control in the Federal Government” issued by the Comptroller General of the
United States or the “Internal Control Integrated Framework”, issued by the Committee of
Sponsoring Organizations of the Treadway Commission (COSO).
Condition:
We noted the following matters during our testing of suspension and debarment control processes:
(a) AdventHealth utilizes a third-party service provider to perform on-going monitoring and
screening of its vendors and suppliers for suspension and debarment. AdventHealth relied
on the results of the suspension and debarment checks performed by the third-party service
provider without having a validation control to ensure the results provided by the third_x0002_party service provider were accurate. The third-party service provider does not have a SOC
1 (System and Organization Controls) Report.
(b) AdventHealth does not receive a listing, from the third-party service provider, of all
vendors and suppliers screened on a monthly basis. While AdventHealth does receive a
listing of vendors and suppliers with a “match” or “potential match”, since the full listing
of all vendors and suppliers screened was not available, it could not be determined whether
all vendors and suppliers were appropriately screened by the third-party service provider.
On an annual basis, AdventHealth did receive the full listing of all vendors and suppliers
that were screened for suspension and debarment by the third-party service provider.
However, a reconciliation between the vendor and supplier list provided by AdventHealth
and the list that is received from the third-party service provider was not performed.
Cause:
AdventHealth did not add an additional validation control to ensure that the suspension and
debarment checks performed by the third-party service provider aligned with the governmental
suspension and debarment database when the search resulted in no match.
In addition, AdventHealth did not have policies and procedures in place to require that
documentation is retained to support the reconciliations performed between the vendor and
supplier list sent to the third-party service provider and the results provided by the third-party
service provider.
Effect or Potential Effect:
AdventHealth’s screening for suspension and debarment through the third-party service provider
may not be accurate.
By not performing a reconciliation between the vendor and supplier list in AdventHealth’s
database and the results provided by the third-party service provider, there exists a risk that certain
vendors and suppliers were not screened by the third-party service provider.
Questioned costs: None
Context:
AdventHealth, as part of its internal control process, internally performs screening for all “new”
vendors and suppliers prior to adding them in the database. We tested 40 new vendors that were
added to the database in fiscal year 2023 and found no issues. As such, there exists a process to
ensure that only valid and appropriately screened vendors and suppliers are contracted with. Since
the issue relates to the on-going monitoring performed by the third-party service provider, for
which appropriate controls were not put in place, this resulted in a deficiency in internal control
process.
The federal portion of expenditures subject to suspension and debarment was approximately
$354,000, which represents approximately 5.5% of the total Research and Development Cluster
federal expenditures.
The total amount reported on the SEFA for R&D cluster is $6,392,558.
Identification as a repeat finding, if applicable: Not a repeat finding
Recommendation:
Management should add controls to validate the accuracy of the suspension and debarment search
results performed by the third-party service provider when the search results in no match.
In addition, management should implement a process over the reconciliation of the vendor and
supplier list to the third-party service provider list to ensure completeness of the suspension and
debarment checks performed.
Views of Responsible Officials:
Management agrees with the finding. Management plans to add controls to validate the accuracy
of the suspension and debarment search results performed by the third-party service provider when
the search results in no match. In addition, management plans to implement a process over the
reconciliation of the vendor and supplier list to the third-party service provider list to ensure
completeness of the suspension and debarment checks performed.