Baylor College of Medicine

Finding 2025-001 Cash Management

Identification of the federal program: U.S. Department of Health and Human Services National Institutes of Health Research and Development Cluster

Assistance Listing No. Federal Program Title 43.014 Congressionally Directed Programs 47.049 Mathematical and Physical Sciences 93.172 Human Genome Research 93.393 Cancer Cause and Prevention Research 93.396 Cancer Biology Research 93.837 Cardiovascular Diseases Research 93.847 Diabetes, Digestive, and Kidney Diseases Extramural Research 93.853 Extramural Research Programs in the Neurosciences and Neurological Disorders 93.865 Child Health and Human Development Extramural Research

Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 2 CFR 200.305(b)(3) requires that when the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper.

Condition: The College did not provide evidence of effectively designed internal controls to ensure subrecipients are paid by the College within 30 days of requests for reimbursements received by the College.

Cause: The College did not ensure that its established internal control processes were operating effectively to verify that invoices from subrecipients were paid within the required 30‑day period from the date the payment request was received.

Effect or potential effect: The College did not comply with the cash management requirements of Uniform Guidance to pay subrecipients within 30 days of their requests for reimbursements.

Questioned costs: None.

Context: EY selected and tested a sample of 44 payments to subrecipients with expenditures totaling $5,843,778 from a population of $56,294,523 during the year ended June 30, 2025. Of the 44 samples selected for testing, 12 payments to subrecipients totaling $3,490,135 were made outside the required 30‑day payment window.

Identification as a repeat finding, if applicable: Not a repeat finding.

Recommendation: The College should strengthen its disbursement controls by ensuring that invoices received from subrecipients are promptly identified, logged, and tracked against the 30‑day payment requirement.

Views of responsible officials: Management agrees with the finding and has developed a plan to ensure subrecipients are paid within 30 days of their requests for reimbursement.

Finding 2024‐002 Procurement Information on the federal/state program: Federal Programs: Research and Development Cluster (R&D) ALN: 93.855 Criteria or specific requirement (including statutory, regulatory or other citation): Federal Program 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 2 CFR 200.318 (i) General Procurement Standards states, “the non-Federal entity must maintain records sufficient to detail the history of procurement. These records will include, but are not necessarily limited to, the following: Rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price.” Condition: The College did not maintain records for procurements sufficient to detail the history of procurement, including the rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. Questioned costs: $65,815

Section III – Federal Award Findings and Questioned Costs (continued) Context: EY selected and tested 8 procurements over $50,000 with expenditures totaling, $1,779,434 from a population of $8,490,052 procurements over $50,000 during the year ended June 30, 2024. Of the 8 expenditures selected for testing 1 procurement totaling $65,815 did not have evidence of sole source justification. Effect or potential effect: The College did not comply with the general procurement standards and methods of procurement to be followed per the Uniform Guidance to maintain sufficient detail of the history of the procurement, including the rationale of the method of procurement. Cause: The College did not have effective internal controls and procedures in place to ensure the College maintained records for procurements sufficient to detail the history of procurement, including the rationale for the method of procurement and other required elements. Identification as a repeat finding, if applicable: This is not a repeat finding Recommendation: The College should retain written documentation for procurements, documenting the history of the procurement prior to the procurement of goods or services including, but not limited to, the rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. Views of responsible officials and planned corrective actions: Management agrees with the finding and has developed a plan to ensure that documentation is retained for sole source procurements.

Finding 2024‐003 Indirect Cost Information on the federal/state program: Federal Award agency; Research and Development Cluster COVID-19 Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) ALN: Various 21.027 Criteria or specific requirement (including statutory, regulatory or other citation): Internal Controls Federal Awards 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: The College did not retain documentation and evidence of review of the indirect cost amounts being charged to the R&D and CSLFRF programs. Management performed a monthly control that included reviewing a sample of indirect costs charged to grants on a sample basis. The College had a new ERP implementation that went into effect on January 1, 2024. Management did not perform the monthly control subsequent to the ERP implementation for the last 6 months of year. Questioned costs: None  Section III – Federal Award Findings and Questioned Costs (continued) Context: During our testing over indirect cost, we selected 2 months during FY24 to test managements control. We observed that during FY24, BCM had a mid year ERP implementation in January 2024. After the ERP implementation, management no longer performed the monthly control for the remainder of FY24. As such for 6 months during FY24, the control was not in place. Effect or potential effect: The incorrect indirect cost rate could be applied to a grant. Cause: Management’s internal control over the review and approval of indirect cost expenditures for compliance was not consistently documented. Identification as a repeat finding, if applicable: This is not a repeat finding Recommendation: The College should reassess its internal controls over the review and approval of indirect cost expenditures post ERP implementation and ensure documentation is retained to evidence review and approval to support the allowability of the expenditure. Views of responsible officials and planned corrective actions: Management agrees with the finding and has developed a plan to ensure indirect costs are reviewed.

Finding 2024‐004 Reporting Information on the federal/state program: Federal Programs: COVID-19 Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) ALN: 21.027 State Awarding agency: Texas Higher Education Coordinating Board State Program: Texas Child Mental Health Care Consortium (TCMHCC) Criteria or specific requirement (including statutory, regulatory or other citation): Federal Program 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Pursuant to 47 C.F.R 302.9 and in accordance with the grant agreement, the award recipient was to submit monthly technical progress reports within 15 days of the end of the month. Per the CSLFRF and TCHMCC agreements with UT Austin: A monthly progress report is due to UT System by the 15th of the month for the previous month.

Section III – Federal Award Findings and Questioned Costs (continued) Condition: The College did not submit monthly reports for the CSLFRF or TCMHCC grants by the 15th of the each month. Questioned costs: None Context: Federal and State: The College submitted monthly reports for the 4 health initiatives created under the TCMHCC grant. CPAN 6 out of 12 reports were not submitted by the 15th deadline. CPWE 7 out of 12 reports were not submitted by the 15th deadline. CAP 7 out of 12 reports were not submitted by the 15th deadline. Effect or potential effect: The College did not comply with the timing of the CSLFRF and TCMHC reporting requirements. Cause: The College did not have effective internal controls in place to ensure the monthly reports were submitted by the required dates, resulting in noncompliance. Identification as a repeat finding, if applicable: This is not a repeat finding Recommendation: The College should develop and implement effective internal controls to ensure the required reports are submitted by the required due dates. Views of responsible officials and planned corrective actions: Management agrees with the finding and has developed a plan to ensure all reports are filed timely.

Finding 2024‐005 Information on the federal/state program: Federal Programs: Student Financial Assistance Cluster ALN: 84.268 Criteria or specific requirement (including statutory, regulatory or other citation): Federal Program 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Cash Management Program Requirements for Direct Lonas- Monthly Reconciliations Schools participating in the Direct Loan program are required to perform monthly Direct Loan Reconciliations (34 CFR 685.300(b)(5)). Electronic Announcements DL-22-07 and General -22-86 explain that a school must reconcile the funds it received from G5 with actual disbursement records the school submitted to Common Origination and Disbursement (COD). Each month COD sends the school a School Account Statement, which is Department of Education (ED’s) official record of the school’s cash and disbursement records and identifies the difference between net draws from G5 and the actual disbursement information reported to COD by the school. The School is required to account for any differences by reconciling ED’s records (School Account Statement) with the school’s financial and business records. Condition: The College did not submit the required monthly reconciliation for the direct loan program timely.

Section III – Federal Award Findings and Questioned Costs (continued) Questioned costs: None Context: As part of our testing, EY selected 4 months to test the monthly reconciliation between the funds received from G5 to the actual disbursement submitted to the COD. During our testing we determined that the College did not perform the monthly reconciliation timely for 3 of the 4 months selected for testing. Effect or potential effect: The College did not comply with the cash management reporting requirements, which could result in unreconciled differences between the funds the College received to what was actually disbursed to students. Cause: As part of our testing, EY selected 4 months to test the monthly reconciliation between the funds received from G5 to the actual disbursement submitted to the COD. During our testing we determined that the College did not perform the monthly reconciliation timely for 3 of the 4 months selected for testing. There was turnover by management and management was working with the IT department to ensure information was accurately obtained from the system to perform the reconciliation. After the data could be appropriately downloaded, management reconciled all transactions to date. Ultimately, management missed the monthly reconciliation deadline for 4 months during FY24. However the College did perform a year to date reconciliation in order to ensure all months during FY24 were reconciled from G5 to COD. Identification as a repeat finding, if applicable: This is not a repeat finding Recommendation: The College should perform and submit the required monthly reconciliation between the G5 and the COD timely. Views of responsible officials and planned corrective actions: Management agrees with the finding and has developed a plan to ensure that the reconciliation is performed on a monthly basis.