Audit 293176

Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Assistance Listing Number: 21.027 Federal Award Identification Number and Year: Pub. L. No. 117-2 2021 Award Period: 5/10/2021 - 12/31/2026 Type of Finding: • Material Weakness in Internal Control over Compliance • Other Matters Criteria or specific requirement: According to§ 200.303 Internal controls of 2 CFR Part 200, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. According to the Coronavirus State and Local Fiscal Recovery Funds 2023 Program Compliance Supplement Part 4, recipients may use payments from SLFRF to replace lost public sector revenue to provide government services. Recipients may use this funding to provide government services to the extent of the reduction in revenue experienced due to the pandemic. The dollar amount of the revenue loss determines the limit for the amount of SLFRF funds that can be used to "provide government services" (which is one of four eligible uses of SLFRF funds). Condition: During our testing, we noted the City used SLFRF funds in excess of its estimated revenue loss. Management's Progress for Repeat Findings: This is a repeated and modified.finding. While the City has improved its efforts, there are still opportunities for improvement to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements as well as compliance with City policy. Questioned costs: None Context: During our testing, it was noted that the City used SLFRF funds of $69,478,937.39 to provide government services in the revenue replacement expenditure category. However, the City calculated total estimated revenue loss of $66,909,843 comprised of 2020 and 2021 revenue loss of $10,042,104 and $56,867,739, respectively. The City's use of SLFRF funds was in excess of its estimated revenue loss by approximately $2,569,094. The City posted an entry moving the expenditures of $2,569,094 to the General Fund. Cause: The City did not perform a comparison of actual expenditures to the total estimated revenue loss to ensure the limit for the amount of SLFRF funds that can be used to "provide government services" was not exceeded by the City. Effect: The auditor noted an instance of noncompliance. Recommendation: We recommend the City implement a quarterly reconciliation process of actual expenditures to program limitations on use of funds to ensure limits are not exceeded on expenditures. Management Response: The City agrees with the finding. The City will ensure that the federal report preparers reconcile all entries to program limitations prior to having the report submitted for final certification. This will be complete by June 30, 2024. Timeline and Responsible Position: June 2024 - City Controller and Grants Administrator

Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Emergency Rental Assistance Program Assistance Listing Number: 21.027 and 21.023 Federal Award Identification Number and Year: ALN 21.027 -Pub. L. No. 117-2 2021 ALN 21.023 -ERA0335 2021 ALN 21.023 - ERAOl 14 2021 Award Period: ALN 21.027 - 5/10/2021 - 12/31/2026 ALN 21.023 - 1/20/2021 - 9/30/2022 ALN 21.023 - 5/17/2021 - 9/30/2025 Type of Finding: • Material Weakness in Internal Control over Compliance • Other Matters Criteria or specific requirement: According to§ 200.302 Financial management of 2 CFR Part 200, the non-federal entity's financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program -specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Further, the financial management system of each non-federal entity must provide accurate, current, and complete disclosure of the financial results of each federal award or program in accordance with the reporting requirements. According to § 200.303 Internal controls of 2 CFR Part 200, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: During our testing, it was noted that the City did not have effective internal controls in place to ensure accurate reporting. Management's Progress for Repeat Findings: This is a repeated and modified finding. While the City has improved its efforts, there are still opportunities for improvement to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements as well as compliance with City policy. Questioned costs: None Context: During our testing, we noted the following exceptions related to reporting. ALN 21.027 • For the Project and Expenditure Report 5 and 6, it was noted that the City reported a total estimated revenue loss of $76,951,947.00 with 2022 accounting for $10,042,104.00 of the total. However, the City did not have any revenue loss for 2022. According to the City, its gross receipts tax grew 20.7% over the previous year in fiscal year 2022. • During the fiscal year 2023, the City incorrectly reported total cumulative expenditures of $29,700,000.00 for the Revenue Replacement First Responder Payroll project -Project Identifier Number 120. The amount reported should have been $27,130,906.00 resulting in a variance of $2,569,094.00. ALN 21.023 • For three of the four quarterly financial reports, the City was unable to reconcile the expenditure reports used as supporting documentation to the current quarter expenditures reported to the Treasury nor the schedule of expenditures of federal awards. Total variance of approximately $404,951 with ERAl Q3 2022 of $173,499, ERA2 Q4 2022 of $61,196, andERA2 Ql 2023 of$170,256. • For one of the five performance reports, the City was unable to provide documentation supporting the Total Dollar Amount of ERA funds Paid (Expended) and (Obligated) for Administrative Expenses of$312,822 related to key line item one -Administrative Costs Ratio. This is ERA Compliance Report for ERAl Q3 2022. • For one of the five performance reports, the City was unable to provide documentation supporting the number of unique households that received ERAl assistance over the award period of performance by income categories of 4,426 nor the number of unique recipient households whose income eligibility was determined based on their eligibility for other federal benefit programs of 9,489 related to key line item three -System for Prioritizing Assistance. This is ERA Compliance Report for ERAl Final Report. • For two of the five performance reports, it was noted that the total households receiving assistance was greater than the sum of Area Median Income (AMI) banded eligible households with a 5 to 10% margin of error to avoid false positives for medium to large recipients by 513 and 5,355 for ERAl Q3 2022 and ERAl Final Report, respectively. This is key line item four -Participant Households at Certain Income Levels Eligibility. • For one of the five performance reports, we were unable to trace the reported data to records that accumulate and summarize data for key line items one through four as the Demographics and Award Activity Amounts Approved (Obligated) and Amounts Paid (Expended) During the Quarter are blank in the Treasury report provided to us. This is ERA Compliance Report for ERA2 Ql 2023. Cause: Specific to the Project and Expenditure Report 5 and 6, the 2022 estimated revenue loss of $10,042,104.00 is a duplicate of the 2020 estimated revenue loss of $10,042,104.00. The City failed to identify this error prior to submission of the reports to the Treasury. Specific to the Revenue Replacement First Responder Payroll project, the City did not perform a comparison of actual expenditures to the total estimated revenue loss to ensure the limit for the amount of SLFRF funds that can be used to "provide government services" was not exceeded by the City. During the audit, the City posted an entry moving the expenditures of $2,569,094 to the General Fund. Specific to the remaining, the City lacks effective internal controls over financial grant management to ensure submitted reports are accurate and agree to supporting documentation. Effect: The auditor noted instances of noncompliance. Recommendation: We recommend the City implement a secondary review process of reports and supporting documentation prior to certification and submission of reports to federal funding agencies. Management Response: The City agrees with the finding. The Treasury Portal automatically fills in the amounts for revenue loss for 2022 with amounts reported in 2020. The Treasury portal has many flaws that would cause errors in reporting. In addition, the portal has changed every quarter, which makes it challenging to report accurately. The City will implement controls to ensure that a second review is completed prior to certification of the report. Additionally, the Grant Administrator will work with department staff responsible for reporting and ensure that each report's supporting documentation is complete and ties to underlying subrecipient reports, the general ledger and grantor reports. All supporting documentation, along with a copy of the submitted report, will be stored in a central location to ensure that they are available for subsequent reviews and audits. This will be completed by June 30, 2024. Timeline and Responsible Position: June 2024 - City Controller and Grants Administrator

Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Emergency Rental Assistance Program Assistance Listing Number: 21.027 and 21.023 Federal Award Identification Number and Year: ALN 21.027 -Pub. L. No. 117-2 2021 ALN 21.023 -ERA0335 2021 ALN 21.023 - ERAOl 14 2021 Award Period: ALN 21.027 - 5/10/2021 - 12/31/2026 ALN 21.023 - 1/20/2021 - 9/30/2022 ALN 21.023 - 5/17/2021 - 9/30/2025 Type of Finding: • Material Weakness in Internal Control over Compliance • Other Matters Criteria or specific requirement: According to§ 200.302 Financial management of 2 CFR Part 200, the non-federal entity's financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program -specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Further, the financial management system of each non-federal entity must provide accurate, current, and complete disclosure of the financial results of each federal award or program in accordance with the reporting requirements. According to § 200.303 Internal controls of 2 CFR Part 200, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: During our testing, it was noted that the City did not have effective internal controls in place to ensure accurate reporting. Management's Progress for Repeat Findings: This is a repeated and modified finding. While the City has improved its efforts, there are still opportunities for improvement to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements as well as compliance with City policy. Questioned costs: None Context: During our testing, we noted the following exceptions related to reporting. ALN 21.027 • For the Project and Expenditure Report 5 and 6, it was noted that the City reported a total estimated revenue loss of $76,951,947.00 with 2022 accounting for $10,042,104.00 of the total. However, the City did not have any revenue loss for 2022. According to the City, its gross receipts tax grew 20.7% over the previous year in fiscal year 2022. • During the fiscal year 2023, the City incorrectly reported total cumulative expenditures of $29,700,000.00 for the Revenue Replacement First Responder Payroll project -Project Identifier Number 120. The amount reported should have been $27,130,906.00 resulting in a variance of $2,569,094.00. ALN 21.023 • For three of the four quarterly financial reports, the City was unable to reconcile the expenditure reports used as supporting documentation to the current quarter expenditures reported to the Treasury nor the schedule of expenditures of federal awards. Total variance of approximately $404,951 with ERAl Q3 2022 of $173,499, ERA2 Q4 2022 of $61,196, andERA2 Ql 2023 of$170,256. • For one of the five performance reports, the City was unable to provide documentation supporting the Total Dollar Amount of ERA funds Paid (Expended) and (Obligated) for Administrative Expenses of$312,822 related to key line item one -Administrative Costs Ratio. This is ERA Compliance Report for ERAl Q3 2022. • For one of the five performance reports, the City was unable to provide documentation supporting the number of unique households that received ERAl assistance over the award period of performance by income categories of 4,426 nor the number of unique recipient households whose income eligibility was determined based on their eligibility for other federal benefit programs of 9,489 related to key line item three -System for Prioritizing Assistance. This is ERA Compliance Report for ERAl Final Report. • For two of the five performance reports, it was noted that the total households receiving assistance was greater than the sum of Area Median Income (AMI) banded eligible households with a 5 to 10% margin of error to avoid false positives for medium to large recipients by 513 and 5,355 for ERAl Q3 2022 and ERAl Final Report, respectively. This is key line item four -Participant Households at Certain Income Levels Eligibility. • For one of the five performance reports, we were unable to trace the reported data to records that accumulate and summarize data for key line items one through four as the Demographics and Award Activity Amounts Approved (Obligated) and Amounts Paid (Expended) During the Quarter are blank in the Treasury report provided to us. This is ERA Compliance Report for ERA2 Ql 2023. Cause: Specific to the Project and Expenditure Report 5 and 6, the 2022 estimated revenue loss of $10,042,104.00 is a duplicate of the 2020 estimated revenue loss of $10,042,104.00. The City failed to identify this error prior to submission of the reports to the Treasury. Specific to the Revenue Replacement First Responder Payroll project, the City did not perform a comparison of actual expenditures to the total estimated revenue loss to ensure the limit for the amount of SLFRF funds that can be used to "provide government services" was not exceeded by the City. During the audit, the City posted an entry moving the expenditures of $2,569,094 to the General Fund. Specific to the remaining, the City lacks effective internal controls over financial grant management to ensure submitted reports are accurate and agree to supporting documentation. Effect: The auditor noted instances of noncompliance. Recommendation: We recommend the City implement a secondary review process of reports and supporting documentation prior to certification and submission of reports to federal funding agencies. Management Response: The City agrees with the finding. The Treasury Portal automatically fills in the amounts for revenue loss for 2022 with amounts reported in 2020. The Treasury portal has many flaws that would cause errors in reporting. In addition, the portal has changed every quarter, which makes it challenging to report accurately. The City will implement controls to ensure that a second review is completed prior to certification of the report. Additionally, the Grant Administrator will work with department staff responsible for reporting and ensure that each report's supporting documentation is complete and ties to underlying subrecipient reports, the general ledger and grantor reports. All supporting documentation, along with a copy of the submitted report, will be stored in a central location to ensure that they are available for subsequent reviews and audits. This will be completed by June 30, 2024. Timeline and Responsible Position: June 2024 - City Controller and Grants Administrator

Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Assistance Listing Number: 21.027 Federal Award Identification Number and Year: Pub. L. No. 117-2 2021 Award Period: 5/10/2021 - 12/31/2026 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: According to the 2023 Compliance Supplement Part 3, when a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. This verification may be accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration (GSA) and available at SAM.gov I Home (click on Search Record, then click on Advanced Search-Exclusions) (Note: The o:tvlB guidance at 2 CFR Part 180 and agency implementing regulations still refer to the SAM Exclusions as the Excluded Parties List System (EPLS)), (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity (2 CFR section 180.300). According to the City's Federal Procurement Guidance, www.sam.gov print screen of vendor (debarment check). Condition: During our testing, we noted that the City did not follow federal suspension and debarment regulation nor its federal suspension and debarment procedures. Management's Progress for Repeat Findings: This is a repeated and modified.finding. While the City has improved its efforts, there are still opportunities for improvement to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements as well as compliance with City policy. Questioned costs: Unknown Context: During our testing, we noted the following exceptions related to suspension and debarment. • For one of the three procurement transactions, the City conducted an exclusion check at SAM.gov. However, there is no date and initial evidencing that the exclusion check was done nor reviewed and approved prior to the City entering into the covered transaction. • For one of the three procurement transactions, the executed contract/agreement was not provided to us. As such, we are unable to determine if the City collected the certification from the entity prior to the City entering into the covered transaction. • For two of the three procurement transactions and five of the five subawards, the City collected a certification from the entity rather than conduct an exclusion check on SAM.gov. Although collecting a certification from the entity is one of the three ways a non-federal entity may accomplish the verification, this is not in accordance with the City's suspension and debarment procedures which is a search at SAM.gov with a print out of the search results and date/initial to certify that the City has confirmed status. Cause: The City failed to follow suspension and debarment procedures. Effect: The auditor noted instances of noncompliance. Recommendation: We recommend the City update its procedures to allow for any of the three ways in which a non-federal entity may accomplish the verification that the entity it is entering into a covered transaction with is not suspended or debarred or otherwise excluded from participating in the transaction. Also, we recommend the City implement a quality control process to ensure documentation supports that the City's verification was accomplished prior to entering into the covered transaction. Management Response: The City agrees with the finding. Over the past several years, the City has developed a significant number of guidance documents and trainings in the area of federal procurement. All of the guidance documents for Central Purchasing are housed in the Purchasing SharePoint site. The guidance and training have in the past been directed at the members of the Purchasing Liaison User Group, but given the continued findings, the City intends to reach out to a much broader group to ensure compliance, including Directors, Deputy Directors, and program representatives. In addition, during Fiscal Year 2023 the City implemented a new system, Contracts Life :Management (CUA), which includes an intake form in the federal funding section. The intake form includes the question "Is the supplier suspended or debarred?" The user is required to upload the result of the SAMS check search, regardless of the status of the contractor. When the answer is yes, the contract process is not allowed to proceed. The system is set up for social services and professional services only at this time, with a slow rollout of the rest of the types of City contracts over the next year or so. This system did not go-live with the existing professional services contracts until the end of the Fiscal Year and management believes that, with sufficient time and build out of the system, this system will help to reduce the exceptions noted above. In addition, as discussed above, management will review and revise internal policies and procedures as appropriate and ensure changes are communicated to departments. This will be completed by June 30, 2024. Timeline and Responsible Position: June 2024 - Chief Procurement Officer and Grants Administrator

Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Assistance Listing Number: 21.027 Federal Award Identification Number and Year: Pub. L. No. 117-2 2021 Award Period: 5/10/2021 - 12/31/2026 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: According to § 200.320 Methods of procurement to be followed of 2 CFR Part 200, when the value of the procurement for property or services under a federal financial assistance award exceeds the simplified acquisition threshold, or a lower threshold established by a non-federal entity, formal procurement methods are required. According to the City's Federal Procurement Guidance, formal procurement methods are required when goods and services are over $100,000. Condition: During our testing, we noted the City did not follow federal procurement regulation nor its federal procurement policy. Management's Progress for Repeat Findings: This is a repeated and modified finding. While the City has improved its efforts, there are still opportUJ1itiesfor improvement to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements as well as compliance with City policy. Questioned costs: Unknown Context: During our testing, we noted the following exceptions related to procurement. • For one of the five procurement transactions, the executed contract/agreement was not provided to us. • For two of the five procurement transactions, no cost analysis was provided to us. • For one of the five procurement transactions, no public notice was provided to us. Cause: The City failed to follow federal procurement regulation nor its federal procurement policy. Effect: The auditor noted instances of noncompliance. Recommendation: We recommend the City design controls to ensure compliance with federal procurement regulation and its federal procurement policy. Management Response: The City agrees with the finding. Over the past several years, the City has developed a significant number of guidance documents and trainings in the area of federal procurement. All of the guidance documents for Central Purchasing are housed in the Purchasing SharePoint site. The guidance and training have in the past been directed at the members of the Purchasing Liaison User Group, but given the continued findings, the City intends to reach out to a much broader group to ensure compliance, including Directors, Deputy Directors, and program representatives. This will be complete by June 30, 2024. Timeline and Responsible Position: June 2024 - Chief Procurement Officer

Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Emergency Rental Assistance Program Assistance Listing Number: 21.027 and 21.023 Federal Award Identification Numberand Year: ALN 21.027 -Pub. L. No. 117-2 2021 ALN 21.023 -ERA0335 2021 Award Period: ALN 21.027 - 5/10/2021 - 12/31/2026 ALN 21.023 - 1/20/2021 - 9/30/2022 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: According to§ 200.303 Internal controls of 2 CFR Part 200, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. According to § 200.331 Subrecipient and contractor determinations of 2 CFR Part 200, a pass-through entity must make case-by­ case determinations whether each agreement it makes for the disbursement of federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. According to § 200.332 Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must: • Evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. • Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. • Verify that every subrecipient is audited as required by Subpart F ohhis part when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in§ 200.501. • Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. According to the City's subrecipient monitoring policies and procedures, monitoring of subrecipients shall be conducted as often as may be required at the discretion of the Community Development Division or at least once per program year. An annual Risk Assessment will be completed to determine a ranking for the activity. The Risk Assessment ranking score will determine whether a monitoring review will occur. According to the City's Sub-recipient Agreement, the Sub-recipient will provide to the Department of Family and Community Services cumulative quarterly program performance reports covering the Services provided under this Agreement. Reports are due no later than fifteen (15) days after the end of the reporting quarter, and shall be in accordance with City of Albuquerque reporting instructions. Condition: During our testing, it was noted that the City did not follow federal subrecipient monitoring and management regulation nor its subrecipient monitoring policies and procedures. Management's Progress for Repeat Findings: This is a repeated and modified.finding. While the City has improved its efforts, there are still opportunities for improvement to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements as well as compliance with City policy. Questioned costs: None Context: During our testing, we noted the following exceptions related to subrecipient monitoring. ALN 21.027 • For one of the five subrecipients, the City did not utilize the risk assessment tool specific to ARPA which does have a different risk assessment ranking score determining the monitoring of the subrecipient. The City did, however, perform a monitoring visit for the subrecipient. • For one of the five subrecipients, the City was unable to locate the subrecipient/contract determination worksheet. • For one of the five subrecipients, the City was unable to locate the quarterly program performance reports submitted by the subrecipient. ALN 21.023 • For one of the five subrecipients, the most recent annual audit report for the year ended June 30, 2022 was not reviewed by the City nor included in the risk assessment. Cause: The City does not have sufficient internal controls to ensure appropriate risk assessment and subrecipient monitoring. Effect: The auditor noted instances of noncompliance. Recommendation: The City has developed standard City-wide subrecipient management and monitoring policies and procedures effective June 2023. We recommend the City design controls to ensure departments are abiding by the subrecipient management and monitoring policies and procedures including Individual departments that develop their own department­ specific and/or grant-specific subrecipient management policies and procedures. Management Response: The City agrees with the finding. The City's Grant Administrator will provide training to each City department which currently oversees subrecipients, ensuring that all department staff understand general and ARPA-specific subrecipient requirements. Additionally, the Grant Administrator will review City departments' subrecipient management checklists to ensure all required documentation is obtained from subrecipients and reviewed as required. This will be complete by June 30, 2024. Timeline and Responsible Position: June 2024 - Grants Administrator

Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Emergency Rental Assistance Program Assistance Listing Number: 21.027 and 21.023 Federal Award Identification Numberand Year: ALN 21.027 -Pub. L. No. 117-2 2021 ALN 21.023 -ERA0335 2021 Award Period: ALN 21.027 - 5/10/2021 - 12/31/2026 ALN 21.023 - 1/20/2021 - 9/30/2022 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: According to§ 200.303 Internal controls of 2 CFR Part 200, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. According to § 200.331 Subrecipient and contractor determinations of 2 CFR Part 200, a pass-through entity must make case-by­ case determinations whether each agreement it makes for the disbursement of federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. According to § 200.332 Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must: • Evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. • Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. • Verify that every subrecipient is audited as required by Subpart F ohhis part when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in§ 200.501. • Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. According to the City's subrecipient monitoring policies and procedures, monitoring of subrecipients shall be conducted as often as may be required at the discretion of the Community Development Division or at least once per program year. An annual Risk Assessment will be completed to determine a ranking for the activity. The Risk Assessment ranking score will determine whether a monitoring review will occur. According to the City's Sub-recipient Agreement, the Sub-recipient will provide to the Department of Family and Community Services cumulative quarterly program performance reports covering the Services provided under this Agreement. Reports are due no later than fifteen (15) days after the end of the reporting quarter, and shall be in accordance with City of Albuquerque reporting instructions. Condition: During our testing, it was noted that the City did not follow federal subrecipient monitoring and management regulation nor its subrecipient monitoring policies and procedures. Management's Progress for Repeat Findings: This is a repeated and modified.finding. While the City has improved its efforts, there are still opportunities for improvement to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements as well as compliance with City policy. Questioned costs: None Context: During our testing, we noted the following exceptions related to subrecipient monitoring. ALN 21.027 • For one of the five subrecipients, the City did not utilize the risk assessment tool specific to ARPA which does have a different risk assessment ranking score determining the monitoring of the subrecipient. The City did, however, perform a monitoring visit for the subrecipient. • For one of the five subrecipients, the City was unable to locate the subrecipient/contract determination worksheet. • For one of the five subrecipients, the City was unable to locate the quarterly program performance reports submitted by the subrecipient. ALN 21.023 • For one of the five subrecipients, the most recent annual audit report for the year ended June 30, 2022 was not reviewed by the City nor included in the risk assessment. Cause: The City does not have sufficient internal controls to ensure appropriate risk assessment and subrecipient monitoring. Effect: The auditor noted instances of noncompliance. Recommendation: The City has developed standard City-wide subrecipient management and monitoring policies and procedures effective June 2023. We recommend the City design controls to ensure departments are abiding by the subrecipient management and monitoring policies and procedures including Individual departments that develop their own department­ specific and/or grant-specific subrecipient management policies and procedures. Management Response: The City agrees with the finding. The City's Grant Administrator will provide training to each City department which currently oversees subrecipients, ensuring that all department staff understand general and ARPA-specific subrecipient requirements. Additionally, the Grant Administrator will review City departments' subrecipient management checklists to ensure all required documentation is obtained from subrecipients and reviewed as required. This will be complete by June 30, 2024. Timeline and Responsible Position: June 2024 - Grants Administrator

Federal Agency: U.S. Department of Transportation Federal Program Name: Highway Planning and Construction Assistance Listing Number: 20.205 Federal Award Identification Number and Year: A301032 - 2021 35A301050M23E - 2015 693JJ22030000Z230NMA301050 - 2015 693JJ22130000M23ENMA300759 - 2021 693JJ22130000M230NMA300847 - 2021 693JJ22130000M23ENMA300847 - 2021 Pass-Through Agency: New Mexico Department of Transportation (NMDOT) Pass-Through Number(s): A301032, A301050, A300759, and A300847 Award Period: A301032 - 9/22/2021 - 9/30/2023 A301050 - 6/17/2015 - 6/26/2024 A300759 - 9/17/2021 - 3/27/2025 A300847 - 9/22/2021 - 12/30/2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: According to§ 200.303 Internal controls of 2 CFR Part 200, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. According to the 2023 Compliance Supplement Part 4, 20.001 Wage Rate Requirements Cross-Cutting Section, nonfederal entities shall include in their construction contracts subject to the Wage Rate Requirements (which still may be referenced as the Davis-Bacon Act) a provision that the contractor or subcontractor comply with those requirements and the DOL regulations. This includes a requirement for the contractor or subcontractor to submit to the nonfederal entity weekly, for each week in which any contract work is performed, a copy of the payroll and a statement of compliance (certified payrolls). According to the New Mexico Department of Transportation TLPA Handbook for Federal Projects, the contractor and each subcontractor shall furnish certified payrolls to the T/LPA for each consecutive week starting from the second week it performs work on the project. Certified payrolls shall be submitted by uploading required payroll information into LCPtracker. The T/LPA shall verify the data contained on each certified payroll and, should errors or discrepancies be found, the T/LPA shall reject the payroll in LCPtracker and notify the contractor or subcontractor of the error. The contractor or subcontractor will be required to correct the error and submit a revised payroll. The T/LPA may utilize Form A-1102, NMDOT Contractors and Subcontractors Payroll Checklist on a weekly basis. Condition: During our testing, we noted that the City did not follow wage rate requirements nor state requirements. Management's Progress for Repeat Findings: This is a repeated and modified.finding. While the City has improved its efforts, there are still opportunities for improvement to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements as well as compliance with City policy. Questioned costs: None Context: During our testing, we noted the following exceptions related to wage rate requirements. • For one of the five contracts, the City does not have a monitoring process in place to ensure that the consultant hired to perform the duties related to certified payrolls is done correctly and in compliance with federal requirements. • For two of the five contracts, there are certified payrolls after the completion date on the change order provided to us. However, the City was unable to provide clarification or supporting documentation to confirm if the completion date on the change order provided to us is the final completion date. As such, we are unable to verify that the contractor or subcontractor submitted the required certified payrolls. • For one of the five contracts, the contract book was not provided to us. • For three of the five contracts, the City did not provide all of the signed and dated NMDOT contractors and subcontractors payroll checklists to us. Cause: The City was unaware of it being ultimately the responsible party for the project even in situations in which the City hires consultants. Specific to the remaining, the City lacks effective internal controls over wage rate requirements to ensure documentation is in place supporting compliance with federal requirements. Effect: The auditor noted instances of noncompliance. Recommendation: We recommend the City design controls to ensure compliance with federal and state wage rate requirements. Management Response: The City agrees with the finding. The Grant Administrator will work with City departments with construction contracts subject to wage rate requirements to ensure policies and procedures are documented and that a monitoring process is implemented to ensure adherence to established policies and grantor requirements. This will be complete by June 30, 2024. Timeline and Responsible Position: June 2024 - Grants Administrator

Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Assistance Listing Number: 21.027 Federal Award Identification Number and Year: Pub. L. No. 117-2 2021 Award Period: 5/10/2021 - 12/31/2026 Type of Finding: • Material Weakness in Internal Control over Compliance • Other Matters Criteria or specific requirement: According to§ 200.303 Internal controls of 2 CFR Part 200, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. According to the Coronavirus State and Local Fiscal Recovery Funds 2023 Program Compliance Supplement Part 4, recipients may use payments from SLFRF to replace lost public sector revenue to provide government services. Recipients may use this funding to provide government services to the extent of the reduction in revenue experienced due to the pandemic. The dollar amount of the revenue loss determines the limit for the amount of SLFRF funds that can be used to "provide government services" (which is one of four eligible uses of SLFRF funds). Condition: During our testing, we noted the City used SLFRF funds in excess of its estimated revenue loss. Management's Progress for Repeat Findings: This is a repeated and modified.finding. While the City has improved its efforts, there are still opportunities for improvement to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements as well as compliance with City policy. Questioned costs: None Context: During our testing, it was noted that the City used SLFRF funds of $69,478,937.39 to provide government services in the revenue replacement expenditure category. However, the City calculated total estimated revenue loss of $66,909,843 comprised of 2020 and 2021 revenue loss of $10,042,104 and $56,867,739, respectively. The City's use of SLFRF funds was in excess of its estimated revenue loss by approximately $2,569,094. The City posted an entry moving the expenditures of $2,569,094 to the General Fund. Cause: The City did not perform a comparison of actual expenditures to the total estimated revenue loss to ensure the limit for the amount of SLFRF funds that can be used to "provide government services" was not exceeded by the City. Effect: The auditor noted an instance of noncompliance. Recommendation: We recommend the City implement a quarterly reconciliation process of actual expenditures to program limitations on use of funds to ensure limits are not exceeded on expenditures. Management Response: The City agrees with the finding. The City will ensure that the federal report preparers reconcile all entries to program limitations prior to having the report submitted for final certification. This will be complete by June 30, 2024. Timeline and Responsible Position: June 2024 - City Controller and Grants Administrator

Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Emergency Rental Assistance Program Assistance Listing Number: 21.027 and 21.023 Federal Award Identification Number and Year: ALN 21.027 -Pub. L. No. 117-2 2021 ALN 21.023 -ERA0335 2021 ALN 21.023 - ERAOl 14 2021 Award Period: ALN 21.027 - 5/10/2021 - 12/31/2026 ALN 21.023 - 1/20/2021 - 9/30/2022 ALN 21.023 - 5/17/2021 - 9/30/2025 Type of Finding: • Material Weakness in Internal Control over Compliance • Other Matters Criteria or specific requirement: According to§ 200.302 Financial management of 2 CFR Part 200, the non-federal entity's financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program -specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Further, the financial management system of each non-federal entity must provide accurate, current, and complete disclosure of the financial results of each federal award or program in accordance with the reporting requirements. According to § 200.303 Internal controls of 2 CFR Part 200, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: During our testing, it was noted that the City did not have effective internal controls in place to ensure accurate reporting. Management's Progress for Repeat Findings: This is a repeated and modified finding. While the City has improved its efforts, there are still opportunities for improvement to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements as well as compliance with City policy. Questioned costs: None Context: During our testing, we noted the following exceptions related to reporting. ALN 21.027 • For the Project and Expenditure Report 5 and 6, it was noted that the City reported a total estimated revenue loss of $76,951,947.00 with 2022 accounting for $10,042,104.00 of the total. However, the City did not have any revenue loss for 2022. According to the City, its gross receipts tax grew 20.7% over the previous year in fiscal year 2022. • During the fiscal year 2023, the City incorrectly reported total cumulative expenditures of $29,700,000.00 for the Revenue Replacement First Responder Payroll project -Project Identifier Number 120. The amount reported should have been $27,130,906.00 resulting in a variance of $2,569,094.00. ALN 21.023 • For three of the four quarterly financial reports, the City was unable to reconcile the expenditure reports used as supporting documentation to the current quarter expenditures reported to the Treasury nor the schedule of expenditures of federal awards. Total variance of approximately $404,951 with ERAl Q3 2022 of $173,499, ERA2 Q4 2022 of $61,196, andERA2 Ql 2023 of$170,256. • For one of the five performance reports, the City was unable to provide documentation supporting the Total Dollar Amount of ERA funds Paid (Expended) and (Obligated) for Administrative Expenses of$312,822 related to key line item one -Administrative Costs Ratio. This is ERA Compliance Report for ERAl Q3 2022. • For one of the five performance reports, the City was unable to provide documentation supporting the number of unique households that received ERAl assistance over the award period of performance by income categories of 4,426 nor the number of unique recipient households whose income eligibility was determined based on their eligibility for other federal benefit programs of 9,489 related to key line item three -System for Prioritizing Assistance. This is ERA Compliance Report for ERAl Final Report. • For two of the five performance reports, it was noted that the total households receiving assistance was greater than the sum of Area Median Income (AMI) banded eligible households with a 5 to 10% margin of error to avoid false positives for medium to large recipients by 513 and 5,355 for ERAl Q3 2022 and ERAl Final Report, respectively. This is key line item four -Participant Households at Certain Income Levels Eligibility. • For one of the five performance reports, we were unable to trace the reported data to records that accumulate and summarize data for key line items one through four as the Demographics and Award Activity Amounts Approved (Obligated) and Amounts Paid (Expended) During the Quarter are blank in the Treasury report provided to us. This is ERA Compliance Report for ERA2 Ql 2023. Cause: Specific to the Project and Expenditure Report 5 and 6, the 2022 estimated revenue loss of $10,042,104.00 is a duplicate of the 2020 estimated revenue loss of $10,042,104.00. The City failed to identify this error prior to submission of the reports to the Treasury. Specific to the Revenue Replacement First Responder Payroll project, the City did not perform a comparison of actual expenditures to the total estimated revenue loss to ensure the limit for the amount of SLFRF funds that can be used to "provide government services" was not exceeded by the City. During the audit, the City posted an entry moving the expenditures of $2,569,094 to the General Fund. Specific to the remaining, the City lacks effective internal controls over financial grant management to ensure submitted reports are accurate and agree to supporting documentation. Effect: The auditor noted instances of noncompliance. Recommendation: We recommend the City implement a secondary review process of reports and supporting documentation prior to certification and submission of reports to federal funding agencies. Management Response: The City agrees with the finding. The Treasury Portal automatically fills in the amounts for revenue loss for 2022 with amounts reported in 2020. The Treasury portal has many flaws that would cause errors in reporting. In addition, the portal has changed every quarter, which makes it challenging to report accurately. The City will implement controls to ensure that a second review is completed prior to certification of the report. Additionally, the Grant Administrator will work with department staff responsible for reporting and ensure that each report's supporting documentation is complete and ties to underlying subrecipient reports, the general ledger and grantor reports. All supporting documentation, along with a copy of the submitted report, will be stored in a central location to ensure that they are available for subsequent reviews and audits. This will be completed by June 30, 2024. Timeline and Responsible Position: June 2024 - City Controller and Grants Administrator

Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Emergency Rental Assistance Program Assistance Listing Number: 21.027 and 21.023 Federal Award Identification Number and Year: ALN 21.027 -Pub. L. No. 117-2 2021 ALN 21.023 -ERA0335 2021 ALN 21.023 - ERAOl 14 2021 Award Period: ALN 21.027 - 5/10/2021 - 12/31/2026 ALN 21.023 - 1/20/2021 - 9/30/2022 ALN 21.023 - 5/17/2021 - 9/30/2025 Type of Finding: • Material Weakness in Internal Control over Compliance • Other Matters Criteria or specific requirement: According to§ 200.302 Financial management of 2 CFR Part 200, the non-federal entity's financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program -specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Further, the financial management system of each non-federal entity must provide accurate, current, and complete disclosure of the financial results of each federal award or program in accordance with the reporting requirements. According to § 200.303 Internal controls of 2 CFR Part 200, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: During our testing, it was noted that the City did not have effective internal controls in place to ensure accurate reporting. Management's Progress for Repeat Findings: This is a repeated and modified finding. While the City has improved its efforts, there are still opportunities for improvement to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements as well as compliance with City policy. Questioned costs: None Context: During our testing, we noted the following exceptions related to reporting. ALN 21.027 • For the Project and Expenditure Report 5 and 6, it was noted that the City reported a total estimated revenue loss of $76,951,947.00 with 2022 accounting for $10,042,104.00 of the total. However, the City did not have any revenue loss for 2022. According to the City, its gross receipts tax grew 20.7% over the previous year in fiscal year 2022. • During the fiscal year 2023, the City incorrectly reported total cumulative expenditures of $29,700,000.00 for the Revenue Replacement First Responder Payroll project -Project Identifier Number 120. The amount reported should have been $27,130,906.00 resulting in a variance of $2,569,094.00. ALN 21.023 • For three of the four quarterly financial reports, the City was unable to reconcile the expenditure reports used as supporting documentation to the current quarter expenditures reported to the Treasury nor the schedule of expenditures of federal awards. Total variance of approximately $404,951 with ERAl Q3 2022 of $173,499, ERA2 Q4 2022 of $61,196, andERA2 Ql 2023 of$170,256. • For one of the five performance reports, the City was unable to provide documentation supporting the Total Dollar Amount of ERA funds Paid (Expended) and (Obligated) for Administrative Expenses of$312,822 related to key line item one -Administrative Costs Ratio. This is ERA Compliance Report for ERAl Q3 2022. • For one of the five performance reports, the City was unable to provide documentation supporting the number of unique households that received ERAl assistance over the award period of performance by income categories of 4,426 nor the number of unique recipient households whose income eligibility was determined based on their eligibility for other federal benefit programs of 9,489 related to key line item three -System for Prioritizing Assistance. This is ERA Compliance Report for ERAl Final Report. • For two of the five performance reports, it was noted that the total households receiving assistance was greater than the sum of Area Median Income (AMI) banded eligible households with a 5 to 10% margin of error to avoid false positives for medium to large recipients by 513 and 5,355 for ERAl Q3 2022 and ERAl Final Report, respectively. This is key line item four -Participant Households at Certain Income Levels Eligibility. • For one of the five performance reports, we were unable to trace the reported data to records that accumulate and summarize data for key line items one through four as the Demographics and Award Activity Amounts Approved (Obligated) and Amounts Paid (Expended) During the Quarter are blank in the Treasury report provided to us. This is ERA Compliance Report for ERA2 Ql 2023. Cause: Specific to the Project and Expenditure Report 5 and 6, the 2022 estimated revenue loss of $10,042,104.00 is a duplicate of the 2020 estimated revenue loss of $10,042,104.00. The City failed to identify this error prior to submission of the reports to the Treasury. Specific to the Revenue Replacement First Responder Payroll project, the City did not perform a comparison of actual expenditures to the total estimated revenue loss to ensure the limit for the amount of SLFRF funds that can be used to "provide government services" was not exceeded by the City. During the audit, the City posted an entry moving the expenditures of $2,569,094 to the General Fund. Specific to the remaining, the City lacks effective internal controls over financial grant management to ensure submitted reports are accurate and agree to supporting documentation. Effect: The auditor noted instances of noncompliance. Recommendation: We recommend the City implement a secondary review process of reports and supporting documentation prior to certification and submission of reports to federal funding agencies. Management Response: The City agrees with the finding. The Treasury Portal automatically fills in the amounts for revenue loss for 2022 with amounts reported in 2020. The Treasury portal has many flaws that would cause errors in reporting. In addition, the portal has changed every quarter, which makes it challenging to report accurately. The City will implement controls to ensure that a second review is completed prior to certification of the report. Additionally, the Grant Administrator will work with department staff responsible for reporting and ensure that each report's supporting documentation is complete and ties to underlying subrecipient reports, the general ledger and grantor reports. All supporting documentation, along with a copy of the submitted report, will be stored in a central location to ensure that they are available for subsequent reviews and audits. This will be completed by June 30, 2024. Timeline and Responsible Position: June 2024 - City Controller and Grants Administrator

Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Assistance Listing Number: 21.027 Federal Award Identification Number and Year: Pub. L. No. 117-2 2021 Award Period: 5/10/2021 - 12/31/2026 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: According to the 2023 Compliance Supplement Part 3, when a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. This verification may be accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration (GSA) and available at SAM.gov I Home (click on Search Record, then click on Advanced Search-Exclusions) (Note: The o:tvlB guidance at 2 CFR Part 180 and agency implementing regulations still refer to the SAM Exclusions as the Excluded Parties List System (EPLS)), (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity (2 CFR section 180.300). According to the City's Federal Procurement Guidance, www.sam.gov print screen of vendor (debarment check). Condition: During our testing, we noted that the City did not follow federal suspension and debarment regulation nor its federal suspension and debarment procedures. Management's Progress for Repeat Findings: This is a repeated and modified.finding. While the City has improved its efforts, there are still opportunities for improvement to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements as well as compliance with City policy. Questioned costs: Unknown Context: During our testing, we noted the following exceptions related to suspension and debarment. • For one of the three procurement transactions, the City conducted an exclusion check at SAM.gov. However, there is no date and initial evidencing that the exclusion check was done nor reviewed and approved prior to the City entering into the covered transaction. • For one of the three procurement transactions, the executed contract/agreement was not provided to us. As such, we are unable to determine if the City collected the certification from the entity prior to the City entering into the covered transaction. • For two of the three procurement transactions and five of the five subawards, the City collected a certification from the entity rather than conduct an exclusion check on SAM.gov. Although collecting a certification from the entity is one of the three ways a non-federal entity may accomplish the verification, this is not in accordance with the City's suspension and debarment procedures which is a search at SAM.gov with a print out of the search results and date/initial to certify that the City has confirmed status. Cause: The City failed to follow suspension and debarment procedures. Effect: The auditor noted instances of noncompliance. Recommendation: We recommend the City update its procedures to allow for any of the three ways in which a non-federal entity may accomplish the verification that the entity it is entering into a covered transaction with is not suspended or debarred or otherwise excluded from participating in the transaction. Also, we recommend the City implement a quality control process to ensure documentation supports that the City's verification was accomplished prior to entering into the covered transaction. Management Response: The City agrees with the finding. Over the past several years, the City has developed a significant number of guidance documents and trainings in the area of federal procurement. All of the guidance documents for Central Purchasing are housed in the Purchasing SharePoint site. The guidance and training have in the past been directed at the members of the Purchasing Liaison User Group, but given the continued findings, the City intends to reach out to a much broader group to ensure compliance, including Directors, Deputy Directors, and program representatives. In addition, during Fiscal Year 2023 the City implemented a new system, Contracts Life :Management (CUA), which includes an intake form in the federal funding section. The intake form includes the question "Is the supplier suspended or debarred?" The user is required to upload the result of the SAMS check search, regardless of the status of the contractor. When the answer is yes, the contract process is not allowed to proceed. The system is set up for social services and professional services only at this time, with a slow rollout of the rest of the types of City contracts over the next year or so. This system did not go-live with the existing professional services contracts until the end of the Fiscal Year and management believes that, with sufficient time and build out of the system, this system will help to reduce the exceptions noted above. In addition, as discussed above, management will review and revise internal policies and procedures as appropriate and ensure changes are communicated to departments. This will be completed by June 30, 2024. Timeline and Responsible Position: June 2024 - Chief Procurement Officer and Grants Administrator

Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Assistance Listing Number: 21.027 Federal Award Identification Number and Year: Pub. L. No. 117-2 2021 Award Period: 5/10/2021 - 12/31/2026 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: According to § 200.320 Methods of procurement to be followed of 2 CFR Part 200, when the value of the procurement for property or services under a federal financial assistance award exceeds the simplified acquisition threshold, or a lower threshold established by a non-federal entity, formal procurement methods are required. According to the City's Federal Procurement Guidance, formal procurement methods are required when goods and services are over $100,000. Condition: During our testing, we noted the City did not follow federal procurement regulation nor its federal procurement policy. Management's Progress for Repeat Findings: This is a repeated and modified finding. While the City has improved its efforts, there are still opportUJ1itiesfor improvement to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements as well as compliance with City policy. Questioned costs: Unknown Context: During our testing, we noted the following exceptions related to procurement. • For one of the five procurement transactions, the executed contract/agreement was not provided to us. • For two of the five procurement transactions, no cost analysis was provided to us. • For one of the five procurement transactions, no public notice was provided to us. Cause: The City failed to follow federal procurement regulation nor its federal procurement policy. Effect: The auditor noted instances of noncompliance. Recommendation: We recommend the City design controls to ensure compliance with federal procurement regulation and its federal procurement policy. Management Response: The City agrees with the finding. Over the past several years, the City has developed a significant number of guidance documents and trainings in the area of federal procurement. All of the guidance documents for Central Purchasing are housed in the Purchasing SharePoint site. The guidance and training have in the past been directed at the members of the Purchasing Liaison User Group, but given the continued findings, the City intends to reach out to a much broader group to ensure compliance, including Directors, Deputy Directors, and program representatives. This will be complete by June 30, 2024. Timeline and Responsible Position: June 2024 - Chief Procurement Officer

Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Emergency Rental Assistance Program Assistance Listing Number: 21.027 and 21.023 Federal Award Identification Numberand Year: ALN 21.027 -Pub. L. No. 117-2 2021 ALN 21.023 -ERA0335 2021 Award Period: ALN 21.027 - 5/10/2021 - 12/31/2026 ALN 21.023 - 1/20/2021 - 9/30/2022 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: According to§ 200.303 Internal controls of 2 CFR Part 200, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. According to § 200.331 Subrecipient and contractor determinations of 2 CFR Part 200, a pass-through entity must make case-by­ case determinations whether each agreement it makes for the disbursement of federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. According to § 200.332 Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must: • Evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. • Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. • Verify that every subrecipient is audited as required by Subpart F ohhis part when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in§ 200.501. • Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. According to the City's subrecipient monitoring policies and procedures, monitoring of subrecipients shall be conducted as often as may be required at the discretion of the Community Development Division or at least once per program year. An annual Risk Assessment will be completed to determine a ranking for the activity. The Risk Assessment ranking score will determine whether a monitoring review will occur. According to the City's Sub-recipient Agreement, the Sub-recipient will provide to the Department of Family and Community Services cumulative quarterly program performance reports covering the Services provided under this Agreement. Reports are due no later than fifteen (15) days after the end of the reporting quarter, and shall be in accordance with City of Albuquerque reporting instructions. Condition: During our testing, it was noted that the City did not follow federal subrecipient monitoring and management regulation nor its subrecipient monitoring policies and procedures. Management's Progress for Repeat Findings: This is a repeated and modified.finding. While the City has improved its efforts, there are still opportunities for improvement to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements as well as compliance with City policy. Questioned costs: None Context: During our testing, we noted the following exceptions related to subrecipient monitoring. ALN 21.027 • For one of the five subrecipients, the City did not utilize the risk assessment tool specific to ARPA which does have a different risk assessment ranking score determining the monitoring of the subrecipient. The City did, however, perform a monitoring visit for the subrecipient. • For one of the five subrecipients, the City was unable to locate the subrecipient/contract determination worksheet. • For one of the five subrecipients, the City was unable to locate the quarterly program performance reports submitted by the subrecipient. ALN 21.023 • For one of the five subrecipients, the most recent annual audit report for the year ended June 30, 2022 was not reviewed by the City nor included in the risk assessment. Cause: The City does not have sufficient internal controls to ensure appropriate risk assessment and subrecipient monitoring. Effect: The auditor noted instances of noncompliance. Recommendation: The City has developed standard City-wide subrecipient management and monitoring policies and procedures effective June 2023. We recommend the City design controls to ensure departments are abiding by the subrecipient management and monitoring policies and procedures including Individual departments that develop their own department­ specific and/or grant-specific subrecipient management policies and procedures. Management Response: The City agrees with the finding. The City's Grant Administrator will provide training to each City department which currently oversees subrecipients, ensuring that all department staff understand general and ARPA-specific subrecipient requirements. Additionally, the Grant Administrator will review City departments' subrecipient management checklists to ensure all required documentation is obtained from subrecipients and reviewed as required. This will be complete by June 30, 2024. Timeline and Responsible Position: June 2024 - Grants Administrator

Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Emergency Rental Assistance Program Assistance Listing Number: 21.027 and 21.023 Federal Award Identification Numberand Year: ALN 21.027 -Pub. L. No. 117-2 2021 ALN 21.023 -ERA0335 2021 Award Period: ALN 21.027 - 5/10/2021 - 12/31/2026 ALN 21.023 - 1/20/2021 - 9/30/2022 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: According to§ 200.303 Internal controls of 2 CFR Part 200, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. According to § 200.331 Subrecipient and contractor determinations of 2 CFR Part 200, a pass-through entity must make case-by­ case determinations whether each agreement it makes for the disbursement of federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. According to § 200.332 Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must: • Evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. • Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. • Verify that every subrecipient is audited as required by Subpart F ohhis part when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in§ 200.501. • Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. According to the City's subrecipient monitoring policies and procedures, monitoring of subrecipients shall be conducted as often as may be required at the discretion of the Community Development Division or at least once per program year. An annual Risk Assessment will be completed to determine a ranking for the activity. The Risk Assessment ranking score will determine whether a monitoring review will occur. According to the City's Sub-recipient Agreement, the Sub-recipient will provide to the Department of Family and Community Services cumulative quarterly program performance reports covering the Services provided under this Agreement. Reports are due no later than fifteen (15) days after the end of the reporting quarter, and shall be in accordance with City of Albuquerque reporting instructions. Condition: During our testing, it was noted that the City did not follow federal subrecipient monitoring and management regulation nor its subrecipient monitoring policies and procedures. Management's Progress for Repeat Findings: This is a repeated and modified.finding. While the City has improved its efforts, there are still opportunities for improvement to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements as well as compliance with City policy. Questioned costs: None Context: During our testing, we noted the following exceptions related to subrecipient monitoring. ALN 21.027 • For one of the five subrecipients, the City did not utilize the risk assessment tool specific to ARPA which does have a different risk assessment ranking score determining the monitoring of the subrecipient. The City did, however, perform a monitoring visit for the subrecipient. • For one of the five subrecipients, the City was unable to locate the subrecipient/contract determination worksheet. • For one of the five subrecipients, the City was unable to locate the quarterly program performance reports submitted by the subrecipient. ALN 21.023 • For one of the five subrecipients, the most recent annual audit report for the year ended June 30, 2022 was not reviewed by the City nor included in the risk assessment. Cause: The City does not have sufficient internal controls to ensure appropriate risk assessment and subrecipient monitoring. Effect: The auditor noted instances of noncompliance. Recommendation: The City has developed standard City-wide subrecipient management and monitoring policies and procedures effective June 2023. We recommend the City design controls to ensure departments are abiding by the subrecipient management and monitoring policies and procedures including Individual departments that develop their own department­ specific and/or grant-specific subrecipient management policies and procedures. Management Response: The City agrees with the finding. The City's Grant Administrator will provide training to each City department which currently oversees subrecipients, ensuring that all department staff understand general and ARPA-specific subrecipient requirements. Additionally, the Grant Administrator will review City departments' subrecipient management checklists to ensure all required documentation is obtained from subrecipients and reviewed as required. This will be complete by June 30, 2024. Timeline and Responsible Position: June 2024 - Grants Administrator

Federal Agency: U.S. Department of Transportation Federal Program Name: Highway Planning and Construction Assistance Listing Number: 20.205 Federal Award Identification Number and Year: A301032 - 2021 35A301050M23E - 2015 693JJ22030000Z230NMA301050 - 2015 693JJ22130000M23ENMA300759 - 2021 693JJ22130000M230NMA300847 - 2021 693JJ22130000M23ENMA300847 - 2021 Pass-Through Agency: New Mexico Department of Transportation (NMDOT) Pass-Through Number(s): A301032, A301050, A300759, and A300847 Award Period: A301032 - 9/22/2021 - 9/30/2023 A301050 - 6/17/2015 - 6/26/2024 A300759 - 9/17/2021 - 3/27/2025 A300847 - 9/22/2021 - 12/30/2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: According to§ 200.303 Internal controls of 2 CFR Part 200, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. According to the 2023 Compliance Supplement Part 4, 20.001 Wage Rate Requirements Cross-Cutting Section, nonfederal entities shall include in their construction contracts subject to the Wage Rate Requirements (which still may be referenced as the Davis-Bacon Act) a provision that the contractor or subcontractor comply with those requirements and the DOL regulations. This includes a requirement for the contractor or subcontractor to submit to the nonfederal entity weekly, for each week in which any contract work is performed, a copy of the payroll and a statement of compliance (certified payrolls). According to the New Mexico Department of Transportation TLPA Handbook for Federal Projects, the contractor and each subcontractor shall furnish certified payrolls to the T/LPA for each consecutive week starting from the second week it performs work on the project. Certified payrolls shall be submitted by uploading required payroll information into LCPtracker. The T/LPA shall verify the data contained on each certified payroll and, should errors or discrepancies be found, the T/LPA shall reject the payroll in LCPtracker and notify the contractor or subcontractor of the error. The contractor or subcontractor will be required to correct the error and submit a revised payroll. The T/LPA may utilize Form A-1102, NMDOT Contractors and Subcontractors Payroll Checklist on a weekly basis. Condition: During our testing, we noted that the City did not follow wage rate requirements nor state requirements. Management's Progress for Repeat Findings: This is a repeated and modified.finding. While the City has improved its efforts, there are still opportunities for improvement to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements as well as compliance with City policy. Questioned costs: None Context: During our testing, we noted the following exceptions related to wage rate requirements. • For one of the five contracts, the City does not have a monitoring process in place to ensure that the consultant hired to perform the duties related to certified payrolls is done correctly and in compliance with federal requirements. • For two of the five contracts, there are certified payrolls after the completion date on the change order provided to us. However, the City was unable to provide clarification or supporting documentation to confirm if the completion date on the change order provided to us is the final completion date. As such, we are unable to verify that the contractor or subcontractor submitted the required certified payrolls. • For one of the five contracts, the contract book was not provided to us. • For three of the five contracts, the City did not provide all of the signed and dated NMDOT contractors and subcontractors payroll checklists to us. Cause: The City was unaware of it being ultimately the responsible party for the project even in situations in which the City hires consultants. Specific to the remaining, the City lacks effective internal controls over wage rate requirements to ensure documentation is in place supporting compliance with federal requirements. Effect: The auditor noted instances of noncompliance. Recommendation: We recommend the City design controls to ensure compliance with federal and state wage rate requirements. Management Response: The City agrees with the finding. The Grant Administrator will work with City departments with construction contracts subject to wage rate requirements to ensure policies and procedures are documented and that a monitoring process is implemented to ensure adherence to established policies and grantor requirements. This will be complete by June 30, 2024. Timeline and Responsible Position: June 2024 - Grants Administrator