Audit 299671

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.

Finding No. 2023-002: Subrecipient Monitoring Federal Program Research and Development Cluster (multiple ALNs) Federal Award Year July 1, 2022 to June 30, 2023 Federal Award Agencies U.S. Department of Health and Human Services; National Science Foundation Criteria or Requirement Per CFR section 200.332(b), a pass-through entity (PTE) must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audits in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency. Per 2 CFR sections 200.332(d) through (f), a pass-through entity (PTE) must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In addition to the procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context In thirty-eight of forty samples totaling $2,821,079, there was no documentation showing that the University evaluated the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitored the activities of the subrecipient to ensure that the subaward complies with the terms and conditions of the subaward, and achieves performance goals. Cause and Potential Effect The University has a protocol in place outlining required risk evaluation and monitoring of subrecipients. Certain monitoring procedures were performed; however, the risk assessment process and the monitoring procedures related to review of subrecipient Uniform Guidance reports were not performed on a consistent basis due to certain transitions which occurred during the year. Questioned Costs None. Statistically Valid Sample The sample was not intended to be not, and was, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit This is not a repeat finding. Recommendation The University should continue to follow their established protocol and document the review of their ongoing risk evaluation and monitoring process for all subrecipients. View of Responsible Officials We concur with the auditor’s assessment that subrecipient monitoring did not happen in the auditor’s desired time frame, but as of publication of this report all monitoring activities have been completed for fiscal year 2023 and will be completed for fiscal year 2024 prior to our next audit cycle.