Finding 6205 (2021-003)

Finding Reference: 2021-003 Federal Program Information Federal Agency: U.S. Department of Health and Human Services (HHS), Health Resources and Services Administration (HRSA) Award: Assistance Listing Number 93.498 COVID-19 - Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Award Period: January 1, 2020 – June 30, 2021 Description: Internal control deficiency over review of report submission Type of Finding: Material Weakness in Internal Control Over Compliance Criteria or specific requirement (including statutory, regulatory or other citation) In accordance with Title 2 U.S. Code of Federal Regulations, Part 200.303, Internal controls, “Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). A. Activities Allowed or Unallowed L. Reporting The terms and conditions of the award require the recipient to submit reports to the secretary of HHS for each reporting period to ensure compliance with conditions that are imposed on the payment, and such report shall be in such form, with such content, as specified by the secretary of HHS in program instructions directed to all recipients. Condition The System did not retain audit evidence of its internal controls over its review and approval of the supporting documentation underlying the data submitted in the HHS portal for the Provider Relief Fund (PRF). Cause Management designed a process to verify that the information submitted in the reports were in compliance with the program’s terms and conditions, prior to submission to HRSA; however, they did not retain supporting documentation to evidence that the internal review controls were appropriately designed and functioning throughout the process. Effect or potential effect A deficiency in internal control over the review of the data submitted in the HHS portal could result in a misstatement of the amounts reported in the HHS portal. Questioned costs None Identification of a repeat finding This is not a repeat finding. Context Management did not retain evidence supporting their internal control over their review and approval process of the information in their report prior to submission to the HRSA portal. Recommendation We recommend that management develop appropriate documentation to support the internal controls that would ensure the data was reviewed and complied with the program’s terms and conditions prior to submission on the HRSA portal to ensure appropriate reimbursement. View of responsible officials There is no disagreement with the audit finding