As an organization providing senior living services during the COVID-19 pandemic, you likely received Provider Relief Fund (PRF) distributions from the U.S. Department of Health & Human Services (HHS) as part of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act). Senior living organizations are already experiencing increased scrutiny due to the required HHS reporting and potential HHS audits of the reporting packages submitted. However, as PRF distributions are subject to Single Audit requirements as well, senior living organizations also may be required to undergo a Single Audit related to PRF distributions, which will require additional analysis by an independent auditor.
Historically, the senior living industry has not received significant federal funds that require unique reporting and compliance audits. In addition, the senior living industry is complex with a wide variety of entities, including nonprofit, for-profit, and governmental organizations that range from small standalone skilled nursing facilities to large chain organizations and continuing care retirement communities. As such, it is important that senior living providers understand the impacts of PRF to their organizations, determine if a Single Audit or other compliance audit is required, and implement a plan to prepare for potential upcoming compliance requirements.
Is My Organization Required to Undergo a Single Audit?
A Single Audit is an organizationwide financial statement and federal awards’ audit of a nonprofit or governmental entity that expends $750,000 or more in federal funds in one year and is governed by the Uniform Guidance requirements issued by the Office of Management and Budget (OMB). OMB issues a compliance supplement each year that includes information on relevant federal programs to assist auditors in performing the required Single Audits.
In applying this guidance specifically to PRF distributions, there is a focus on the required reporting periods determined by HHS in determining amounts expended in excess of $750,000. For example, the first provider year-end that is eligible for a potential Single Audit for PRF distributions is June 30, 2021, as that is the deadline to use the funds received in Period 1 (from April 10, 2020, through June 30, 2020). Therefore, if a provider reports a combination of qualified expenses attributable to COVID-19 and calculated lost revenues exceeding $750,000 in its Period 1 reporting, a Single Audit will be required for the fiscal year ending June 30, 2021. As another example, for providers with fiscal year-ends of December 31, 2021, Period 1 and Period 2 reporting will be aggregated and a Single Audit will be required if the sum of qualified expenses attributable to COVID-19 and calculated lost revenues reported in both Period 1 and Period 2 exceed $750,000.
For-profit entities typically don’t receive federal funding and, therefore, are not included in the Uniform Guidance regulations. However, HHS is requiring that for-profit entities also comply with the compliance audit requirements either through a Single Audit or a financial-related audit of the award received in accordance with generally accepted government auditing standards (GAGAS). The American Institute of CPAs (AICPA) Governmental Audit Quality Center issued a practice aid on this topic for PRF in late February 2022 after discussions with HHS. Many for-profit entities may choose to use the financial audit of the award in accordance with GAGAS rather than a Single Audit as the requirement for a financial statement audit is not included with this option.
What Does a Single Audit Involve?
A Single Audit includes an audit of the financial statements, as well as a compliance audit related to the rules and regulations of the federal awards received, completed by an independent auditor. The purpose of this audit is to provide assurance to federal agencies that an entity has internal controls in place and is in compliance with the program requirements. The audit of the federal awards, which is designated as high risk for PRF distributions, will involve additional detailed testing of the qualifying expenses and the lost revenue calculations to justify the use of the funds received. In addition, the Single Audit will include testing of the design and effectiveness of internal controls over compliance with federal awards.
Once the Single Audit is complete, the final report and summary of findings and questioned costs are required to be submitted to an online portal for public access within nine months after the fiscal year-end or within 30 days after the issuance of the compliance report, whichever comes first. OMB has granted a six-month extension for Single Audits including PRF disbursements for entities up to and including June 30, 2021, year-ends, but has not provided for extensions beyond that time frame to date.
What Can I Do to Prepare for a Single Audit or Other Compliance Audit?
To prepare for a Single Audit or another form of compliance audit, organizations should review the detailed documentation available to support internal control procedures, understanding and interpretation of the PRF guidance, and detailed tracking of relevant expenses and lost revenues used to substantiate PRF disbursements. Below are questions to consider when accumulating this information.
- Who was responsible for reading, understanding, monitoring, and implementing processes and procedures to comply with the terms and conditions, reporting requirements, and other guidance issued by HHS and other federal agencies related to PRF and other disbursements and what were the processes and controls inherent in these activities?
- Have you summarized all PRF disbursements received by date and source with bank activity or statements saved as support? This will help you to prepare the Schedule of Expenditures of Federal Awards (SEFA) or Schedule of HHS Awards (under the GAGAS financial audit model) you will need to provide to your auditor. The SEFA should include all sources of federal funding received during the fiscal year and the Schedule of HHS Awards should include all awards from HHS. Organizations will want to review general ledger activity to verify all federal funding has been considered and appropriately included.
- Have you documented the following processes and controls?
- How do management and governance generate, review, and approve internal financial statements and budgets? What processes are in place to safeguard financial information? What processes are in place to establish and hold staff accountable to acceptable business practices, ethical values, and integrity? What are the organization’s record retention policies?
- How are invoices approved and paid? How are bank accounts reconciled and reviewed? How are payroll hours and amounts reviewed and approved? Does the organization have a policy supporting how hazard/premium pay is determined and approved for payment, if necessary? How have staff been trained to identify COVID-19-related invoices/time separately from standard invoices/duties? If your organization received a Paycheck Protection Program (PPP) loan, how have payroll costs allocated to the PPP loan forgiveness been separated from payroll costs used to support PRF disbursements, if any? What additional procedures have been implemented to track the use of PRF disbursements, including consideration to verify that no double-dipping has occurred, i.e., expenses covered by PRF also were not paid for, or obligated to be paid for, by other funding sources?
- How did management select the most appropriate calculation to determine lost revenues? A memo to support your interpretations that you can easily provide to your auditor will help them to evaluate if your process used is reasonable.
- How did management determine if a Single Audit or other compliance audit is or is not required related to PRF disbursements?
Even if your senior living organization is not required to undergo a Single Audit, the aforementioned documentation will be helpful in navigating the reporting required by HHS, as well as providing support for any HHS audits of reporting.
What If I Have More Questions?
If you want more information regarding Single Audit or other compliance audit considerations for your organization, contact your advisor or submit the Contact Us form below. In addition, HHS has issued a plethora of guidance on the Health Resources & Services Administration website.