HRSA’s “Audit Reporting Requirement Attestations” arrived in inboxes on Friday, March 22, 2024, and require a response by Friday, April 5, 2024. The government is under pressure to show that the money distributed under the CARES Act and the American Rescue Plan was used responsibly. These notices are frustrating and frightening, and a two-week turnaround may seem a bit callous, but the situation could certainly be worse—the government could have simply demanded a return of the funds. If an organization expended more than $750,000 in a single fiscal year and does not comply with the new deadlines, it is in violation of the terms and conditions and the government may request that the money be returned.

From the government’s perspective, providers and entities receiving these notices may be delinquent and in breach of the terms and conditions of the various government relief programs authorized by the CARES Act and the American Rescue Plan. Organizations that expended $750,000 or more in a fiscal year from the Provider Relief Fund (PRF) and/or certain other federal funds were required to submit Single Audits first in 2021, but the Government gave an extension until 2022. 

What Is a Single Audit?

A Single Audit is an audit of your organization’s financial statements and compliance with federal award requirements for the distributions that your organization has received. A Single Audit is different than an annual financial audit; you will receive a separate audit opinion to submit. A Single Audit must be performed by an independent Certified Public Accountant. The audit evaluates the controls an entity has in accounting for federal grant money. Your auditor will look at compliance with the terms and conditions of the government grant, which may include PRF reports that were submitted with the supporting documentation or the controls around billing for uninsured patient COVID-19 testing.

Three Scenarios

Ultimately, organizations fall into one of three scenarios:

1. You expended less than $750,000 in funds from government sources (including PRF, FEMA, and others, but excluding PPP loans) in each fiscal year (not in aggregate). Presumably, you filled out PRF reports showing that. You should be certain that you are correct, and you should alert HRSA that it sent the “Audit Reporting Requirement Attestation” in error.
2. You expended $750,000 or more in funds from government sources in each fiscal year and you conducted a Single Audit. You should submit it per the instructions in the “Audit Reporting Requirement Attestation” Notice. 
3. You expended $750,000 in funds from government sources in each fiscal year, you do not have the report, but you have engaged an independent Certified Public Accountant to conduct the Single Audit. You may submit to HRSA your engagement letter pending completion of the Single Audit report, and then submit the Single Audit report, once you have it, pursuant to the instructions in the notice.

If you fall under Scenario 3, but do not yet have an engagement letter, you should act with utmost speed to get one. It is absolutely imperative that you submit an engagement letter to HRSA. At this point, you have one week to engage an auditor, which is very, very little time.