Audit 12381

2023-001 Internal Control over Compliance and Compliance with Subrecipient Monitoring Information on the Major Federal Programs: Federal Agency: National Endowment for the Humanities (NEH) Program Name: COVID-19: Promotion of the Humanities Public Programs Assistance Listing Number: 45.164 Award Number: ZOR-283411-21 and ZPP-283412-22 Award Year: 10/01/2021 – 9/30/2023 and 10/01/2021 – 6/30/2023 Federal Agency: U.S. Department of the Treasury Program Name: Coronavirus State and Local Fiscal Recovery Funds Fund Assistance Listing Number: 21.027 Award Number: 21-483011 Award Year: 07/01/2021 – 12/31/2023 Criteria - In accordance with §200.331(b) and §200.331(d), Requirements for Pass-Through Entities, the Trust (including consolidated entities National Trust for Historic Preservation in the United States (the National Trust) and National Main Street Center, Inc. (NMSC)), the recipients of these federal funds, must evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Trust must also monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statues, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) reviewing financial and performance reports required by the pass-through entity; (2) following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means; and (3) issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the pass-through entity. Condition – During our testing of subrecipient monitoring, we identified the following:  For ALN 46.164, for two (2) out of 19 sample items tested, there was no evidence that the National Trust verified the subrecipients’ audit requirements including corrective action plans and follow up with the subrecipients as to steps implemented to address audit findings noted.  For ALN 21.027, for two (2) out of eight (8) sample items tested, NMSC was unable to provide documented evidence for the evaluation of each subrecipient’s risk assessment. Additionally, no timely evidence that NMSC verified the subrecipients’ audit requirements including corrective action plans and follow up with the subrecipients as to steps implemented to address findings noted. Cause – The Trust did not follow its documented policies and procedures in place to ensure compliance with the requirements regarding subrecipient monitoring. Effect or Potential Effect - Failure to comply with the subrecipient monitoring requirements of the Uniform Guidance could result in unallowable expenses being charged to the grants by the subrecipients. Questioned Costs ‐ None. Context ‐ This is a condition identified based upon our review of the Trust’s compliance with specified requirements. The sample was selected based on a non-statistical basis. The prevalence of these findings is detailed in the condition section above. Repeat finding – Yes, with respect to lack of performance of a risk assessment. The lack of followup as to audit findings in the audit reports provided by the subrecipients is not a repeat finding. Recommendation – We recommend that the Trust strictly enforce its existing policies and procedures to ensure the subrecipient process, from identification of that subrecipient through verification of subrecipients’ audit requirements, occurs to ensure compliance. To address the many compliance requirements when dealing with subrecipients, most organizations have developed preaward assessment toolkits, audit requirement monitoring toolkits and other types of subrecipient management aids to assist in ensuring the steps are performed as required. Views of Responsible Officials – With respect to the lack of performance of a risk assessment, this matter first came to management’s attention during the single audit of the fiscal year ended June 30, 2022. That single audit was completed on February 2, 2023. By the time policies and procedures for subrecipient monitoring were put in place, the subrecipients noted in the finding above had been fully reimbursed and their projects were closed. Management made good faith efforts to obtain responses from the subrecipients without success. With respect to the lack of follow-up with findings in subrecipients’ audit reports, procedures will be updated and enforced to follow up with subrecipients who have audit findings as soon as management becomes aware of them.

2023-001 Internal Control over Compliance and Compliance with Subrecipient Monitoring Information on the Major Federal Programs: Federal Agency: National Endowment for the Humanities (NEH) Program Name: COVID-19: Promotion of the Humanities Public Programs Assistance Listing Number: 45.164 Award Number: ZOR-283411-21 and ZPP-283412-22 Award Year: 10/01/2021 – 9/30/2023 and 10/01/2021 – 6/30/2023 Federal Agency: U.S. Department of the Treasury Program Name: Coronavirus State and Local Fiscal Recovery Funds Fund Assistance Listing Number: 21.027 Award Number: 21-483011 Award Year: 07/01/2021 – 12/31/2023 Criteria - In accordance with §200.331(b) and §200.331(d), Requirements for Pass-Through Entities, the Trust (including consolidated entities National Trust for Historic Preservation in the United States (the National Trust) and National Main Street Center, Inc. (NMSC)), the recipients of these federal funds, must evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Trust must also monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statues, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) reviewing financial and performance reports required by the pass-through entity; (2) following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means; and (3) issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the pass-through entity. Condition – During our testing of subrecipient monitoring, we identified the following:  For ALN 46.164, for two (2) out of 19 sample items tested, there was no evidence that the National Trust verified the subrecipients’ audit requirements including corrective action plans and follow up with the subrecipients as to steps implemented to address audit findings noted.  For ALN 21.027, for two (2) out of eight (8) sample items tested, NMSC was unable to provide documented evidence for the evaluation of each subrecipient’s risk assessment. Additionally, no timely evidence that NMSC verified the subrecipients’ audit requirements including corrective action plans and follow up with the subrecipients as to steps implemented to address findings noted. Cause – The Trust did not follow its documented policies and procedures in place to ensure compliance with the requirements regarding subrecipient monitoring. Effect or Potential Effect - Failure to comply with the subrecipient monitoring requirements of the Uniform Guidance could result in unallowable expenses being charged to the grants by the subrecipients. Questioned Costs ‐ None. Context ‐ This is a condition identified based upon our review of the Trust’s compliance with specified requirements. The sample was selected based on a non-statistical basis. The prevalence of these findings is detailed in the condition section above. Repeat finding – Yes, with respect to lack of performance of a risk assessment. The lack of followup as to audit findings in the audit reports provided by the subrecipients is not a repeat finding. Recommendation – We recommend that the Trust strictly enforce its existing policies and procedures to ensure the subrecipient process, from identification of that subrecipient through verification of subrecipients’ audit requirements, occurs to ensure compliance. To address the many compliance requirements when dealing with subrecipients, most organizations have developed preaward assessment toolkits, audit requirement monitoring toolkits and other types of subrecipient management aids to assist in ensuring the steps are performed as required. Views of Responsible Officials – With respect to the lack of performance of a risk assessment, this matter first came to management’s attention during the single audit of the fiscal year ended June 30, 2022. That single audit was completed on February 2, 2023. By the time policies and procedures for subrecipient monitoring were put in place, the subrecipients noted in the finding above had been fully reimbursed and their projects were closed. Management made good faith efforts to obtain responses from the subrecipients without success. With respect to the lack of follow-up with findings in subrecipients’ audit reports, procedures will be updated and enforced to follow up with subrecipients who have audit findings as soon as management becomes aware of them.

2023-001 Internal Control over Compliance and Compliance with Subrecipient Monitoring Information on the Major Federal Programs: Federal Agency: National Endowment for the Humanities (NEH) Program Name: COVID-19: Promotion of the Humanities Public Programs Assistance Listing Number: 45.164 Award Number: ZOR-283411-21 and ZPP-283412-22 Award Year: 10/01/2021 – 9/30/2023 and 10/01/2021 – 6/30/2023 Federal Agency: U.S. Department of the Treasury Program Name: Coronavirus State and Local Fiscal Recovery Funds Fund Assistance Listing Number: 21.027 Award Number: 21-483011 Award Year: 07/01/2021 – 12/31/2023 Criteria - In accordance with §200.331(b) and §200.331(d), Requirements for Pass-Through Entities, the Trust (including consolidated entities National Trust for Historic Preservation in the United States (the National Trust) and National Main Street Center, Inc. (NMSC)), the recipients of these federal funds, must evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Trust must also monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statues, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) reviewing financial and performance reports required by the pass-through entity; (2) following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means; and (3) issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the pass-through entity. Condition – During our testing of subrecipient monitoring, we identified the following:  For ALN 46.164, for two (2) out of 19 sample items tested, there was no evidence that the National Trust verified the subrecipients’ audit requirements including corrective action plans and follow up with the subrecipients as to steps implemented to address audit findings noted.  For ALN 21.027, for two (2) out of eight (8) sample items tested, NMSC was unable to provide documented evidence for the evaluation of each subrecipient’s risk assessment. Additionally, no timely evidence that NMSC verified the subrecipients’ audit requirements including corrective action plans and follow up with the subrecipients as to steps implemented to address findings noted. Cause – The Trust did not follow its documented policies and procedures in place to ensure compliance with the requirements regarding subrecipient monitoring. Effect or Potential Effect - Failure to comply with the subrecipient monitoring requirements of the Uniform Guidance could result in unallowable expenses being charged to the grants by the subrecipients. Questioned Costs ‐ None. Context ‐ This is a condition identified based upon our review of the Trust’s compliance with specified requirements. The sample was selected based on a non-statistical basis. The prevalence of these findings is detailed in the condition section above. Repeat finding – Yes, with respect to lack of performance of a risk assessment. The lack of followup as to audit findings in the audit reports provided by the subrecipients is not a repeat finding. Recommendation – We recommend that the Trust strictly enforce its existing policies and procedures to ensure the subrecipient process, from identification of that subrecipient through verification of subrecipients’ audit requirements, occurs to ensure compliance. To address the many compliance requirements when dealing with subrecipients, most organizations have developed preaward assessment toolkits, audit requirement monitoring toolkits and other types of subrecipient management aids to assist in ensuring the steps are performed as required. Views of Responsible Officials – With respect to the lack of performance of a risk assessment, this matter first came to management’s attention during the single audit of the fiscal year ended June 30, 2022. That single audit was completed on February 2, 2023. By the time policies and procedures for subrecipient monitoring were put in place, the subrecipients noted in the finding above had been fully reimbursed and their projects were closed. Management made good faith efforts to obtain responses from the subrecipients without success. With respect to the lack of follow-up with findings in subrecipients’ audit reports, procedures will be updated and enforced to follow up with subrecipients who have audit findings as soon as management becomes aware of them.

2023-001 Internal Control over Compliance and Compliance with Subrecipient Monitoring Information on the Major Federal Programs: Federal Agency: National Endowment for the Humanities (NEH) Program Name: COVID-19: Promotion of the Humanities Public Programs Assistance Listing Number: 45.164 Award Number: ZOR-283411-21 and ZPP-283412-22 Award Year: 10/01/2021 – 9/30/2023 and 10/01/2021 – 6/30/2023 Federal Agency: U.S. Department of the Treasury Program Name: Coronavirus State and Local Fiscal Recovery Funds Fund Assistance Listing Number: 21.027 Award Number: 21-483011 Award Year: 07/01/2021 – 12/31/2023 Criteria - In accordance with §200.331(b) and §200.331(d), Requirements for Pass-Through Entities, the Trust (including consolidated entities National Trust for Historic Preservation in the United States (the National Trust) and National Main Street Center, Inc. (NMSC)), the recipients of these federal funds, must evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Trust must also monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statues, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) reviewing financial and performance reports required by the pass-through entity; (2) following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means; and (3) issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the pass-through entity. Condition – During our testing of subrecipient monitoring, we identified the following:  For ALN 46.164, for two (2) out of 19 sample items tested, there was no evidence that the National Trust verified the subrecipients’ audit requirements including corrective action plans and follow up with the subrecipients as to steps implemented to address audit findings noted.  For ALN 21.027, for two (2) out of eight (8) sample items tested, NMSC was unable to provide documented evidence for the evaluation of each subrecipient’s risk assessment. Additionally, no timely evidence that NMSC verified the subrecipients’ audit requirements including corrective action plans and follow up with the subrecipients as to steps implemented to address findings noted. Cause – The Trust did not follow its documented policies and procedures in place to ensure compliance with the requirements regarding subrecipient monitoring. Effect or Potential Effect - Failure to comply with the subrecipient monitoring requirements of the Uniform Guidance could result in unallowable expenses being charged to the grants by the subrecipients. Questioned Costs ‐ None. Context ‐ This is a condition identified based upon our review of the Trust’s compliance with specified requirements. The sample was selected based on a non-statistical basis. The prevalence of these findings is detailed in the condition section above. Repeat finding – Yes, with respect to lack of performance of a risk assessment. The lack of followup as to audit findings in the audit reports provided by the subrecipients is not a repeat finding. Recommendation – We recommend that the Trust strictly enforce its existing policies and procedures to ensure the subrecipient process, from identification of that subrecipient through verification of subrecipients’ audit requirements, occurs to ensure compliance. To address the many compliance requirements when dealing with subrecipients, most organizations have developed preaward assessment toolkits, audit requirement monitoring toolkits and other types of subrecipient management aids to assist in ensuring the steps are performed as required. Views of Responsible Officials – With respect to the lack of performance of a risk assessment, this matter first came to management’s attention during the single audit of the fiscal year ended June 30, 2022. That single audit was completed on February 2, 2023. By the time policies and procedures for subrecipient monitoring were put in place, the subrecipients noted in the finding above had been fully reimbursed and their projects were closed. Management made good faith efforts to obtain responses from the subrecipients without success. With respect to the lack of follow-up with findings in subrecipients’ audit reports, procedures will be updated and enforced to follow up with subrecipients who have audit findings as soon as management becomes aware of them.