Banner Health

Internal control deficiency and noncompliance over procurement.

Identification of the federal program:

Assistance Listing Number 21.027: • COVID-19 – Coronavirus State and Local Fiscal Recovery Funds • U.S. Department of the Treasury • Federal award identification number – Not available • Federal award year – June 30, 2023 to December 31, 2026 • Pass-through entity – State of Wyoming • Pass-through award identification number – ARPA-HHS-1132

Criteria or specific requirement (including statutory, regulatory or other citation):

Title 2, Subtitle A, Chapter II, Part 200, Subpart D, Section 200.303 Internal controls. The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

Title 2, Subtitle A, Chapter II, Part 200, Subpart D, 200.318 General procurement standards (i) the non-Federal entity must maintain records sufficient to detail the history of procurement. These records will include, but are not necessarily limited to, the following: Rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price.

Title 2, Subtitle A, Chapter II, Part 200, Subpart D, 200.319 Competition (a) All procurement transactions for the acquisition of property or services required under a Federal award must be conducted in a manner providing full and open competition consistent with the standards of this section and 200.320.

Title 2, Subtitle A, Chapter II, Part 200, Subpart D, 200.320 Methods of procurement to be followed. (b) Formal procurement methods. When the value of the procurement for property or services under a Federal financial assistance award exceeds the simplified acquisition threshold, or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising. (2) Proposals. A procurement method in which either a fixed price or cost-reimbursement type contract is awarded. They are awarded in accordance with the following requirements: (i) Requests for proposals must be publicized and identify all evaluation factors and their relative importance. Proposals must be solicited from an adequate number of qualified offerors. Any response to publicized requests for proposals must be considered to the maximum extent practical; (ii) The non-Federal entity must have a written method for conducting technical evaluations of the proposals received and making selections; and (iii) Contracts must be awarded to the responsible offeror whose proposals is most advantageous to the non-Federal entity, with price and other factors considered.

Condition:

During our testing over procurement, we observed management did not have internal controls in place over formal procurements to ensure proposals were obtained through public advertising. Therefore, the formal procurement was not conducted in a manner providing full and open competition. Management did not maintain records sufficient to detail the history of procurement, including the rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price.

Cause:

Management did not have internal controls in place over the compliance requirements as stated in the criteria or specific requirement section above.

Effect or potential effect:

Procurements were not supported by internal controls to ensure proposals were obtained through public advertising to conduct them in a manner providing full and open competition and could potentially be awarded to offerors that are not the most advantageous to the non-Federal entity, with price and other factors considered.

Questioned costs:

$212,622 – Assistance Listing Number 21.027 – COVID-19 – Coronavirus State and Local Fiscal Recovery Funds – Federal award identification number – Not available – Pass-through award identification number – ARPA-HHS-1132

Questioned costs were computed as the entire population of procurement transactions subject to formal procurement compliance requirements.

Questioned costs means a cost that is questioned by the auditor because of an audit finding: (1) which resulted from a violation or possible violation of a statute, regulation, or the terms and conditions of a Federal award, including for funds used to match Federal funds or (2) where the costs, at the time of the audit, are not supported by adequate documentation.

Context:

During our testing over procurements, we obtained a listing of expenditures that included $212,622 of procurement transactions subject to formal procurement compliance requirements. We observed management did not have internal controls in place to ensure the compliance requirements as stated in the criteria or specific requirement section above were performed. The costs charged to the program were for allowable activities; however, the procurement was not conducted in accordance with federal procurement requirements.

Identification as a repeat finding, if applicable:

No.

Recommendation:

Management should develop and implement internal controls over formal procurements to ensure proposals are obtained through public advertising to conduct them in a manner providing full and open competition. Management should maintain records for procurements to document the history of procurement, including the rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price.

Views of responsible officials:

Banner has a policy for the procurement of federally funded goods and services that fully complies with the Uniform Guidance standards, prescribed by the Office of Management and Budget, for managing federal awards. This policy was not followed when evaluating and selecting the general contractor for a Wyoming Medical Center construction project that was being partially funded (~25%) with federal funds. Specifically, proposals were not obtained through public advertising. The costs charged to the program were for allowable activities; however, the procurement was not conducted in accordance with federal procurement requirements.

To ensure all protocols and controls are followed in compliance with Uniform Guidance standards, Banner will implement a process to notify all appropriate parties when federal funds are received or granted and provide education to key constituents on Uniform Guidance standards. Additionally, formal documentation supporting the rationale for selecting general contractors will be enhanced. Since this project is ongoing into 2026, this will be a duplicate finding on the 2026 Uniform Guidance audit.

Internal control deficiency over activities allowed or unallowed and allowable costs/cost principles related to review of contract labor expenditures.

Identification of the federal program:

Assistance Listing Number 97.036: • COVID-19 – Disaster Grants – Public Assistance (Presidentially Declared Disasters) • U.S. Department of Homeland Security • Federal award identification number: o Project number 690197 – Emergency Contract Labor Costs o Project number 696280 – Emergency Contract Labor Costs o Project Number 696319 – Emergency Contract Labor Costs o Project Number 696366 – Emergency Contract Labor Invoice Costs o Project Number 696392 – Emergency Contract Labor Invoice Costs o Project Number 696409 – Emergency Contract Labor Invoice Costs o Project Number 696847 – Emergency Contract Labor Invoice Costs o Project Number 698491 – Contract Labor Services • Federal award year – January 20, 2020 to May 11, 2023 • Pass-through entity – Arizona Department of Homeland Security

Criteria or specific requirement (including statutory, regulatory or other citation):

Title 2, Subtitle A, Chapter II, Part 200, Subpart D, Section 200.303 Internal controls. The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

Condition:

During our testing over contract labor expenditures, we observed management did not have effective internal controls in place to ensure certain contract labor expenditures were reviewed. There were 16 out of 40 selections where the contract labor expenditures were not reviewed.

Cause:

Management did not have effective internal controls in place over the compliance requirements as stated in the criteria or specific requirement section above.

Effect or potential effect:

Contract labor expenditures were not supported by effective internal controls. Without sufficient internal controls, compliance matters could occur in the future.

Questioned costs:

None.

Context:

During our internal control testing over activities allowed or unallowed and allowable costs/cost principles, we obtained a listing of 1,523,838 contract labor expenditures and selected a sample of 40 to test for the review of the expenditure. The total value of the 40 contract labor expenditures selected was $13,266 out of the total contract labor expenditures of $505,370,491.

There were 16 ($7,591) out of 40 ($13,266) selections where the contract labor expenditures were not reviewed. The 16 selections were for allowable activities under this program and therefore, no noncompliance was noted in our testing. The sampling was a statistically valid sample.

Identification as a repeat finding, if applicable:

No.

Recommendation:

Management should develop and implement effective internal controls to ensure contract labor expenditures are reviewed.

Views of responsible officials:

Banner requires control labor resources to utilize the same time keeping system used by Banner employees to track worked time. Banner creates ‘reverse invoices’ using the time tracked in Banner’s timekeeping system by contract labor resources and presents those hours/dollars to contract labor agencies for approval prior to remitting payment to those agencies. These invoices are reviewed by Banner’s staffing services team for reasonableness prior to being presented to the agencies for approval. There is an expectation that managers review and formally approve the timecards of contract labor resources in the timekeeping system, however, the reverse invoicing process moves forward even in the absence of a documented formal approval. Banner will implement a periodic monitoring process that provides a report of ‘forced sign offs’ (timecards without documented manager approval) to senior leadership in an effort to increase compliance with the timecard approval policy.

Internal control deficiency and noncompliance over reporting of lost revenues attributable to coronavirus reported in the provider relief fund report.

Identification of the federal program:

Assistance Listing Number 93.498: • COVID-19 – Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution • U.S. Department of Health and Human Services • Federal award identification number – Not Applicable • Federal award year – January 1, 2020 to December 31, 2023

Criteria or specific requirement (including statutory, regulatory or other citation):

Title 2, Subtitle A, Chapter II, Part 200, Subpart D, Section 200.303 Internal controls. The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

The terms and conditions of the award requires the following: • The recipient certifies that the payment will only be used to prevent, prepare for, and respond to coronavirus, and that the payment shall reimburse the recipient only for health care related expenses or lost revenues that are attributable to coronavirus. • The recipient certifies that it will not use the payment to reimburse expenses or losses that have been reimbursed from other sources or that other sources are obligated to reimburse. • The recipient shall adhere to the reporting requirements on provider relief fund payments for payments received exceeding $10,000 in the aggregate during the payment received period. The recipient must register in the provider relief fund reporting portal and submit reports as specified by HHS. • The recipient certifies that all information it provides as part of any application for the payment, as well as all information and reports relating to the payment that it provides in the future at the request of HHS or the HHS inspector general, are true, accurate and complete, to the best of its knowledge.

The Provider Relief Programs: Provider Relief Fund and ARP Rural Payments Frequently Asked Questions states the following: • Duplication of expenses and lost revenues is not permitted. • Expenses and lost revenues may not be duplicated: payments may not be applied to the same expenses and lost revenues that were reported on in prior reporting period.

Condition:

During our testing over reporting, we observed management did not have effective internal controls in place to ensure lost revenues reported in the provider relief fund report were not duplicated. This resulted in an overstatement of lost revenues reported in the provider relief fund report.

Cause:

Management did not have effective internal controls in place over the compliance requirements as stated in the criteria or specific requirements section above.

Effect or potential effect:

The lost revenues attributable to coronavirus were reported incorrectly in the provider relief fund report.

Questioned costs:

$404,529 – Assistance Listing Number 93.498, Award Identification Number – Not Applicable

Questioned costs were computed by taking the total lost revenues available to be used in the current reporting period of $29,770,743 reported in the provider relief fund report compared to the actual total lost revenues available to be used in the current reporting period of $29,366,214.

Context:

During our testing over the calculation of lost revenues attributable to coronavirus, we observed management used $404,529 in lost revenues related to a subsidiary of Banner to substantiate the payments received; however, the Banner parent lost revenues were not reduced by $404,529 in lost revenues that were already used by the subsidiary of Banner.

Management’s control regarding the review of the provider relief fund report did not identify this overstatement.

Identification as a repeat finding, if applicable:

No.

Recommendation:

Management should develop and implement effective internal controls to ensure the total lost revenues reported in the provider relief fund report are reflective of the entity’s consolidated lost revenues and are not duplicated. In addition, management should review the identified questioned costs to identify if any improper payments were made to the entity.

Views of responsible officials:

There will be no additional provider relief fund reports submitted given this was the final report submitted to substantiate the payments received. However, if this program begins again, management will implement a control to ensure lost revenues are not duplicated. The entity will work with the grantor regarding the questioned costs identified.