Audit 309973

Program: Emergency Solutions Grant Program (ESG) ALN #: 14.231 Federal Agency: Housing and Urban Development Federal Award Numbers: E-20-MC-25-005, E-21-MC-25-0005, E-22-MC-25-0005, E-20-MW-25-005, and E-20-MW-35-005 Award Year: July 1, 2022–June 30, 2023 Suspension and Debarment Type of finding: Significant deficiency Prior-year finding: Yes Statistically valid sample: No Criteria The 2 CFR sections 180.215 and 180.220 provide the principles to be applied to ensure that nonfederal entities are not contracting with or making subawards under covered transactions to parties that are suspended or debarred. Also, when a nonfederal entity enters into a covered transaction with an entity at a lower tier, the nonfederal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition When establishing contracts for subrecipients under the Emergency Solutions Grant Program (ESG), the City requires that standard contract language be included to address the applicable suspension and debarment requirements. During fiscal year 2023, the required contract language was not included within the subrecipient contracts executed for the ESG program. Additionally, the City’s policy is to check the System of Award Management (SAM) to verify that its subrecipients were not suspended or debarred. During our audit, we noted one of four subrecipients selected for testing were not checked for suspension and debarment as evidenced via review of the subrecipient contracts or through SAM documentation. During compliance testing for the subrecipients, it was confirmed they were not suspended or debarred. Cause The City requires that standard contract language be included in all of its subrecipient contracts and that the City reviews SAM to address suspension and debarment requirements. The City was unaware that the required language was excluded from subrecipient contracts entered into for the ESG program as there was insufficient review of the contracts prior to execution to ensure all required elements were present. Additionally, the City requires that program personnel review SAM.gov to ensure the subrecipient is not suspended or debarred. There was no documentation that this review had occurred prior to entering into a contract with the subrecipient. Effect Lack of formal review of subrecipient contracts and review of entities on SAM could result in the City entering into contracts with prohibited entities. Questioned Costs None Recommendation We recommend the City ensure that required language is included within all subrecipient contracts prior to execution. We also recommend that the City review that subrecipients are not included on the SAM exclusion list and retain documentation of that check and review prior to entering into contracts with subrecipients. Views of Responsible Officials and Corrective Actions Based on the finding in the prior year audit, the City updated the subrecipient contract template in spring 2023 prior to execution of contracts for the FY24 ESG program year and will continue to utilize the updated template to ensure required language certifying that the agency, its officers, and employees are not suspended or debarred from doing business with the federal government. Staff will continue to verify that subrecipients are not suspended or debarred by checking against the Sam.gov Exclusion List and registration pages prior to executing contracts, and will document those checks through grant management meeting minutes and Smartsheet tracking. Implementation Date Updates to the contract template were completed in spring 2023 and updated contract template was utilized for FY24 program year beginning July 1, 2023 and will be utilized for FY25 ESG program year beginning July 1, 2024. Documentation from the Sam.gov website showing that all ESG subrecipients are in good standing will be included in each subrecipient file for the FY25 program year, with anticipated completion of June 30, 2024. Responsible Officials Anthony Woods, Planner and Contract Manager, and Liz Mengers, Planning and Development Manager

Program: Emergency Solutions Grant Program (ESG) ALN #: 14.231 Federal Agency: Housing and Urban Development Federal Award Numbers: E-20-MC-25-005, E-21-MC-25-0005, E-22-MC-25-0005, E-20-MW-25-005, and E-20-MW-35-005 Award Year: July 1, 2022–June 30, 2023 Suspension and Debarment Type of finding: Significant deficiency Prior-year finding: Yes Statistically valid sample: No Criteria The 2 CFR sections 180.215 and 180.220 provide the principles to be applied to ensure that nonfederal entities are not contracting with or making subawards under covered transactions to parties that are suspended or debarred. Also, when a nonfederal entity enters into a covered transaction with an entity at a lower tier, the nonfederal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition When establishing contracts for subrecipients under the Emergency Solutions Grant Program (ESG), the City requires that standard contract language be included to address the applicable suspension and debarment requirements. During fiscal year 2023, the required contract language was not included within the subrecipient contracts executed for the ESG program. Additionally, the City’s policy is to check the System of Award Management (SAM) to verify that its subrecipients were not suspended or debarred. During our audit, we noted one of four subrecipients selected for testing were not checked for suspension and debarment as evidenced via review of the subrecipient contracts or through SAM documentation. During compliance testing for the subrecipients, it was confirmed they were not suspended or debarred. Cause The City requires that standard contract language be included in all of its subrecipient contracts and that the City reviews SAM to address suspension and debarment requirements. The City was unaware that the required language was excluded from subrecipient contracts entered into for the ESG program as there was insufficient review of the contracts prior to execution to ensure all required elements were present. Additionally, the City requires that program personnel review SAM.gov to ensure the subrecipient is not suspended or debarred. There was no documentation that this review had occurred prior to entering into a contract with the subrecipient. Effect Lack of formal review of subrecipient contracts and review of entities on SAM could result in the City entering into contracts with prohibited entities. Questioned Costs None Recommendation We recommend the City ensure that required language is included within all subrecipient contracts prior to execution. We also recommend that the City review that subrecipients are not included on the SAM exclusion list and retain documentation of that check and review prior to entering into contracts with subrecipients. Views of Responsible Officials and Corrective Actions Based on the finding in the prior year audit, the City updated the subrecipient contract template in spring 2023 prior to execution of contracts for the FY24 ESG program year and will continue to utilize the updated template to ensure required language certifying that the agency, its officers, and employees are not suspended or debarred from doing business with the federal government. Staff will continue to verify that subrecipients are not suspended or debarred by checking against the Sam.gov Exclusion List and registration pages prior to executing contracts, and will document those checks through grant management meeting minutes and Smartsheet tracking. Implementation Date Updates to the contract template were completed in spring 2023 and updated contract template was utilized for FY24 program year beginning July 1, 2023 and will be utilized for FY25 ESG program year beginning July 1, 2024. Documentation from the Sam.gov website showing that all ESG subrecipients are in good standing will be included in each subrecipient file for the FY25 program year, with anticipated completion of June 30, 2024. Responsible Officials Anthony Woods, Planner and Contract Manager, and Liz Mengers, Planning and Development Manager

Program: Emergency Solutions Grant Program (ESG) ALN #: 14.231 Federal Agency: Housing and Urban Development Federal Award Numbers: E-20-MC-25-005, E-21-MC-25-0005, E-22-MC-25-0005, E-20-MW-25-005, and E-20-MW-35-005 Award Year: July 1, 2022–June 30, 2023 Special Tests; Payments to Subrecipients Type of finding: Material Weakness and Material noncompliance Prior-year finding: Yes Statistically valid sample: No Criteria According to 24 CFR section 576.203, a recipient must pay each subrecipient for allowable costs within 30 days after receiving the subrecipient’s complete payment request. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City’s ESG Program has a control in place to ensure that invoice cover sheets (i.e., reimbursement requests) are reviewed in a timely manner so that the City can subsequently reimburse subrecipients within 30 days and remain in compliance with the requirement. However, the control to ensure timely payments to subrecipients was not operating effectively as payments to 8 of 19 subrecipients tested had payment dates that ranged from 15 and 255, subsequent to the subrecipient’s completed request for payment. Cause The City did not have effective controls in place to ensure subrecipients were paid for allowable costs within 30 days after receiving the subrecipient’s completed payment request. Effect Lack of effective controls resulted in the City not complying with 24 CFR section 576.203. Effect Lack of effective controls resulted in the City not complying with 24 CFR section 576.203. Questioned Costs None Recommendation We recommend the City establish effective controls to ensure payment requests received from subrecipients are paid within 30 days of receipt. Views of Responsible Officials and Corrective Actions Based on prior year (FY22) findings, the City established the following procedures to ensure payment requests received from subrecipients are paid within 30 days of receipt of a complete request for reimbursement: 1. Department of Effect Lack of effective controls resulted in the City not complying with 24 CFR section 576.203.Human Service Programs (DHSP) Contract Manager reviews invoices within 5 business days of receipt of request for reimbursement from subrecipient. a. If invoice is complete, original date of receipt is recorded. b. If invoice is incomplete, subrecipient is notified of items or documentation that is missing and receipt date is updated to reflect date of receipt of complete invoice. 2. Contract Manager approves payment request and submits to DHSP Fiscal staff for processing. 3. Fiscal staff processes and submits to Auditing Department as Priority payment. Four of the 19 sampled payment requests were received or processed after receipt of the FY22 audit findings, and all of those requests for reimbursement were paid within 30 days receipt. Implementation Date Implementation of the above process began with the FY23 3rd quarter invoices in April 2023. Responsible Officials Anthony Woods, Planner and Contract Manager; Liz Mengers, DHSP Planning and Development Manager; Giovanna Alvarez, DHSP Fiscal Administrator; and Janice Alger, Assistant Director of Administration, Human Services

Program: Emergency Solutions Grant Program (ESG) ALN #: 14.231 Federal Agency: Housing and Urban Development Federal Award Numbers: E-20-MC-25-005, E-21-MC-25-0005, E-22-MC-25-0005, E-20-MW-25-005, and E-20-MW-35-005 Award Year: July 1, 2022–June 30, 2023 Special Tests; Payments to Subrecipients Type of finding: Material Weakness and Material noncompliance Prior-year finding: Yes Statistically valid sample: No Criteria According to 24 CFR section 576.203, a recipient must pay each subrecipient for allowable costs within 30 days after receiving the subrecipient’s complete payment request. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City’s ESG Program has a control in place to ensure that invoice cover sheets (i.e., reimbursement requests) are reviewed in a timely manner so that the City can subsequently reimburse subrecipients within 30 days and remain in compliance with the requirement. However, the control to ensure timely payments to subrecipients was not operating effectively as payments to 8 of 19 subrecipients tested had payment dates that ranged from 15 and 255, subsequent to the subrecipient’s completed request for payment. Cause The City did not have effective controls in place to ensure subrecipients were paid for allowable costs within 30 days after receiving the subrecipient’s completed payment request. Effect Lack of effective controls resulted in the City not complying with 24 CFR section 576.203. Effect Lack of effective controls resulted in the City not complying with 24 CFR section 576.203. Questioned Costs None Recommendation We recommend the City establish effective controls to ensure payment requests received from subrecipients are paid within 30 days of receipt. Views of Responsible Officials and Corrective Actions Based on prior year (FY22) findings, the City established the following procedures to ensure payment requests received from subrecipients are paid within 30 days of receipt of a complete request for reimbursement: 1. Department of Effect Lack of effective controls resulted in the City not complying with 24 CFR section 576.203.Human Service Programs (DHSP) Contract Manager reviews invoices within 5 business days of receipt of request for reimbursement from subrecipient. a. If invoice is complete, original date of receipt is recorded. b. If invoice is incomplete, subrecipient is notified of items or documentation that is missing and receipt date is updated to reflect date of receipt of complete invoice. 2. Contract Manager approves payment request and submits to DHSP Fiscal staff for processing. 3. Fiscal staff processes and submits to Auditing Department as Priority payment. Four of the 19 sampled payment requests were received or processed after receipt of the FY22 audit findings, and all of those requests for reimbursement were paid within 30 days receipt. Implementation Date Implementation of the above process began with the FY23 3rd quarter invoices in April 2023. Responsible Officials Anthony Woods, Planner and Contract Manager; Liz Mengers, DHSP Planning and Development Manager; Giovanna Alvarez, DHSP Fiscal Administrator; and Janice Alger, Assistant Director of Administration, Human Services

Program: Emergency Solutions Grant Program (ESG) ALN #: 14.231 Federal Agency: Housing and Urban Development Federal Award Numbers: E-20-MC-25-005, E-21-MC-25-0005, E-22-MC-25-0005, E-20-MW-25-005, and E-20-MW-35-005 Award Year: July 1, 2022–June 30, 2023 Subrecipient Monitoring Type of finding: Material weakness and noncompliance Prior-year finding: Yes Statistically valid sample: No Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. During our audit, we noted that audited financial statements were obtained for the four subrecipients selected for testing, but there was no documentation to evidence the nature and extent of the City’s review of the audit reports obtained. Additionally, a documented risk assessment was not performed by the City over the four subrecipients selected for testing prior to entering into a contract. Cause The City requires that audited financial statements are obtained for subrecipients, but there is no checklist or formal documentation required to indicate what should be reviewed when reviewing the audit reports to ensure compliance with subrecipient monitoring requirements. Additionally, the City requires a risk assessment be completed over each subrecipient. However, due to time constraints, a risk assessment was not completed. Effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned Costs None Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining subrecipient audit reports to ensure required monitoring procedures are performed and well documented. Views of Responsible Officials and Corrective Actions The City has established an Audit Review Certification form that is completed by employees to formally document review of subrecipient agencies' audit reports. Implementation Date The City implemented use of the Audit Review Certification form starting in Spring 2023 as part of the ESG subrecipient application process for the FY24 program year beginning July 1, 2023, and will continue use of the form for the FY25 program year beginning on July 1, 2024. Responsible Officials Anthony Woods, Planner and Contract Manager, and Liz Mengers, Planning and Development Manager

Program: Emergency Solutions Grant Program (ESG) ALN #: 14.231 Federal Agency: Housing and Urban Development Federal Award Numbers: E-20-MC-25-005, E-21-MC-25-0005, E-22-MC-25-0005, E-20-MW-25-005, and E-20-MW-35-005 Award Year: July 1, 2022–June 30, 2023 Subrecipient Monitoring Type of finding: Material weakness and noncompliance Prior-year finding: Yes Statistically valid sample: No Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. During our audit, we noted that audited financial statements were obtained for the four subrecipients selected for testing, but there was no documentation to evidence the nature and extent of the City’s review of the audit reports obtained. Additionally, a documented risk assessment was not performed by the City over the four subrecipients selected for testing prior to entering into a contract. Cause The City requires that audited financial statements are obtained for subrecipients, but there is no checklist or formal documentation required to indicate what should be reviewed when reviewing the audit reports to ensure compliance with subrecipient monitoring requirements. Additionally, the City requires a risk assessment be completed over each subrecipient. However, due to time constraints, a risk assessment was not completed. Effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned Costs None Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining subrecipient audit reports to ensure required monitoring procedures are performed and well documented. Views of Responsible Officials and Corrective Actions The City has established an Audit Review Certification form that is completed by employees to formally document review of subrecipient agencies' audit reports. Implementation Date The City implemented use of the Audit Review Certification form starting in Spring 2023 as part of the ESG subrecipient application process for the FY24 program year beginning July 1, 2023, and will continue use of the form for the FY25 program year beginning on July 1, 2024. Responsible Officials Anthony Woods, Planner and Contract Manager, and Liz Mengers, Planning and Development Manager

Program: HOME Investment Partnerships Program (HOME) ALN #: 14.239 Federal Agency: Department of Housing and Urban Development Federal Award Number: M22-MC250202 Award Year: July 1, 2022–June 30, 2023 Eligibility/Subrecipient Monitoring Type of finding: Noncompliance Prior-year finding: No Statistically valid sample: No Criteria 24 CFR 92.252, Qualification as affordable housing: Rental housing (e) Periods of affordability. The HOME-assisted units must meet the affordability requirements for not less than the applicable period specified in the following table, beginning after project completion. (1) The affordability requirements: (i) Apply without regard to the term of any loan or mortgage, repayment of the HOME investment, or the transfer of ownership (ii) Must be imposed by a deed restriction, a covenant running with the land, an agreement restricting the use of the property, or other mechanisms approved by HUD and must give the participating jurisdiction the right to require specific performance (except that the participating jurisdiction may provide that the affordability restrictions may terminate upon foreclosure or transfer in lieu of foreclosure) (iii) Must be recorded in accordance with State recordation laws. (2) The participating jurisdiction may use purchase options, rights of first refusal, or other preemptive rights to purchase the housing before foreclosure or deed in lieu of foreclosure in order to preserve affordability. (3) The affordability restrictions shall be revived according to the original terms if, during the original affordability period, the owner of record before the foreclosure, or deed in lieu of foreclosure, or any entity that includes the former owner or those with whom the former owner has or had family or business ties obtains an ownership interest in the project or property. 4) The termination of the restrictions on the project does not terminate the participating jurisdiction’s repayment obligation under § 92.503(b). (h) Tenant income. The income of each tenant must be determined initially in accordance with § 92.203(a)(1)(i). In addition, each year during the period of affordability the project owner must reexamine each tenant’s annual income in accordance with one of the options in § 92.203 selected by the participating jurisdiction. 24 CFR92.203 Income determinations (a) The HOME program has income-targeting requirements for the HOME program and for HOME projects. Therefore, the participating jurisdiction must determine each family is income eligible by determining the family’s annual income. (1) For families who are tenants in HOME-assisted housing and not receiving HOME tenant-based rental assistance, the participating jurisdiction must initially determine annual income using the method in paragraph (a)(1)(i) of this section. For subsequent income determinations during the period of affordability, the participating jurisdiction may use any one of the following methods in accordance with § 92.252(h): (ii) Obtain from the family a written statement of the amount of the family’s annual income and family size, along with a certification that the information is complete and accurate. The certification must state that the family will provide source documents upon request. Title 45 US Code of Federal Regulations Part 75 (45 CFR part 75), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 75.303 also states that nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Additionally, the 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Condition During our testwork, we noted there were two individuals residing in a facility financed with a City HOME loan who did not meet the low-income requirements and were therefore determined not to be eligible. Cause The City’s property manager failed to ensure that another unit, or the next available unit, within the building would be designated as a HOME-floating unit as required in its loan agreement with the City. Effect Ineligible recipients could potentially cause the City to not be in compliance with HUD requirements. Questioned Costs Not determinable Recommendation We recommend the City work collaboratively with its property managers to ensure that the correct number of units are being designated as HOME-assisted units. Views of Responsible Officials and Corrective Actions The two individuals determined to have incomes in excess of HOME Program limits were noted in our FY23 monitoring of properties assisted with HOME funds. The HOME Program allows for a unit to be occupied by a household who was initially eligible and whose income later increases, but requires that a comparable unit be designated as a HOME unit and leased to an eligible household when one is available. Owners of each property were made aware of the circumstance when City monitoring was completed. Each will designate comparable units to be HOME units when available and lease them to eligible households. Implementation Date Dependent on when residents move and/or appropriate units are available. Responsible Officials Chris Cotter, Housing Director & Judith Tumusiime, Federal Grants Manager, Cambridge Community Development Department

Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Federal Agency: Housing and Urban Development Federal Award Numbers: MAH22-F005, MAH20-F005, and MAH21-F005 Award Year: July 1, 2022–June 30, 2023 Subrecipient Monitoring Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. During our audit, we noted that audited financial statements were obtained for the four subrecipients selected for testing, but there was no documentation to evidence the nature and extent of the City’s review of the reports obtained. Additionally, a documented risk assessment was not performed by the City over the four subrecipients selected for testing prior to entering into a contract. Cause The City requires that audited financial statements are obtained for subrecipients, but there is no checklist or formal documentation required to indicate what should be reviewed when reviewing the audit reports to ensure compliance with subrecipient monitoring requirements. Additionally, the City requires a risk assessment be completed over each subrecipient. However, due to time constraints, a risk assessment was not completed. Effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned Costs None Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining subrecipient audit reports to ensure required monitoring procedures are performed and well documented. Views of Responsible Officials and Corrective Actions The City will incorporate a more formal review of financial audits of subrecipients in conjunction with new contracts moving forward. These audits, and City staff’s verification of assessment will be included in each subrecipient file. Implementation Date FY2025 Contracts Responsible Officials Robert Keller, Project Planner, Cambridge Community Development Department, and Judith Tumusiime, Federal Grants Manager, Cambridge Community Development Department

Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Federal Agency: Housing and Urban Development Federal Award Numbers: MAH22-F005, MAH20-F005, and MAH21-F005 Award Year: July 1, 2022–June 30, 2023 Subrecipient Monitoring Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. During our audit, we noted that audited financial statements were obtained for the four subrecipients selected for testing, but there was no documentation to evidence the nature and extent of the City’s review of the reports obtained. Additionally, a documented risk assessment was not performed by the City over the four subrecipients selected for testing prior to entering into a contract. Cause The City requires that audited financial statements are obtained for subrecipients, but there is no checklist or formal documentation required to indicate what should be reviewed when reviewing the audit reports to ensure compliance with subrecipient monitoring requirements. Additionally, the City requires a risk assessment be completed over each subrecipient. However, due to time constraints, a risk assessment was not completed. Effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned Costs None Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining subrecipient audit reports to ensure required monitoring procedures are performed and well documented. Views of Responsible Officials and Corrective Actions The City will incorporate a more formal review of financial audits of subrecipients in conjunction with new contracts moving forward. These audits, and City staff’s verification of assessment will be included in each subrecipient file. Implementation Date FY2025 Contracts Responsible Officials Robert Keller, Project Planner, Cambridge Community Development Department, and Judith Tumusiime, Federal Grants Manager, Cambridge Community Development Department

Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Federal Agency: Housing and Urban Development Federal Award Numbers: MAH22-F005, MAH20-F005, and MAH21-F005 Award Year: July 1, 2022–June 30, 2023 Reporting Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria Special Reporting for Federal Funding Accountability and Transparency Act Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109-282), as amended by Section 6202 of Public Law 110-252, herein referred to as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Aspects of the Transparency Act that relate to subaward reporting (1) under grants and cooperative agreements were implemented in OMB in 2 CFR Part 170 and (2) under contracts, by the regulatory agencies responsible for the Federal Acquisition Regulation (FAR at 5 FR 39414 et seq., July 8, 2010). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Title 2 US Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, section 200.1 defines subaward as an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract. Further, 2 CFR 200.1 defines subrecipient as a nonfederal entity that receives a subaward from a passthrough entity to carry out part of a federal program but does not include an individual that is a beneficiary of such program. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City’s Community Development Department did not report awards granted to subrecipients for the HOPWA program by the end of the month following the month in which the City awarded the subrecipient award that is greater than or equal to $30,000 as required by FFATA. FFATA requires the City to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee DUNS/UEI number 3. Amount of subaward 4. Subaward obligation/action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that the City did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. During our testwork of four subawards, we also noted reporting exceptions as subawards were not reported in the required time. Cause The condition found was due to the City not reporting any amounts passed through to subrecipients for the period from July 2022 to June 2023, as the responsible officials were not aware of the reporting timeline requirements. As a result, all subawards were reported on a one-year lag. Effect Failure to submit all subaward amounts passed through to subrecipients and subcontractors under subawards as defined by 2 CFR 200.1 in the City’s FFATA reporting could result in the City reporting inaccurate and incomplete amounts to the federal government Questioned Costs None Recommendation We recommend that the City review and enhance its policies, procedures, and internal controls to ensure that all amounts passed through to subrecipients under subawards as defined in 2 CFR 200.1 are reported in accordance with the FFATA federal regulations. In addition, we recommend that the City use obligation date for FFATA reporting. Views of Responsible Officials and Corrective Actions HOPWA contracts have typically been obligated over the course of several or more months, as some subrecipients operate in different ways. Going forward, the City will use the contract start date (7/1) as the Obligation date, and will submit the FFATA report accordingly. Implementation Date 8/31/2024 (representing the end of the month following the obligation of funds). Responsible Officials Robert Keller, Project Planner, Cambridge Community Development Department, and Judith Tumusiime, Federal Grants Manager, Cambridge Community Development Department

Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Federal Agency: Housing and Urban Development Federal Award Numbers: MAH22-F005, MAH20-F005, and MAH21-F005 Award Year: July 1, 2022–June 30, 2023 Reporting Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria Special Reporting for Federal Funding Accountability and Transparency Act Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109-282), as amended by Section 6202 of Public Law 110-252, herein referred to as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Aspects of the Transparency Act that relate to subaward reporting (1) under grants and cooperative agreements were implemented in OMB in 2 CFR Part 170 and (2) under contracts, by the regulatory agencies responsible for the Federal Acquisition Regulation (FAR at 5 FR 39414 et seq., July 8, 2010). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Title 2 US Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, section 200.1 defines subaward as an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract. Further, 2 CFR 200.1 defines subrecipient as a nonfederal entity that receives a subaward from a passthrough entity to carry out part of a federal program but does not include an individual that is a beneficiary of such program. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City’s Community Development Department did not report awards granted to subrecipients for the HOPWA program by the end of the month following the month in which the City awarded the subrecipient award that is greater than or equal to $30,000 as required by FFATA. FFATA requires the City to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee DUNS/UEI number 3. Amount of subaward 4. Subaward obligation/action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that the City did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. During our testwork of four subawards, we also noted reporting exceptions as subawards were not reported in the required time. Cause The condition found was due to the City not reporting any amounts passed through to subrecipients for the period from July 2022 to June 2023, as the responsible officials were not aware of the reporting timeline requirements. As a result, all subawards were reported on a one-year lag. Effect Failure to submit all subaward amounts passed through to subrecipients and subcontractors under subawards as defined by 2 CFR 200.1 in the City’s FFATA reporting could result in the City reporting inaccurate and incomplete amounts to the federal government Questioned Costs None Recommendation We recommend that the City review and enhance its policies, procedures, and internal controls to ensure that all amounts passed through to subrecipients under subawards as defined in 2 CFR 200.1 are reported in accordance with the FFATA federal regulations. In addition, we recommend that the City use obligation date for FFATA reporting. Views of Responsible Officials and Corrective Actions HOPWA contracts have typically been obligated over the course of several or more months, as some subrecipients operate in different ways. Going forward, the City will use the contract start date (7/1) as the Obligation date, and will submit the FFATA report accordingly. Implementation Date 8/31/2024 (representing the end of the month following the obligation of funds). Responsible Officials Robert Keller, Project Planner, Cambridge Community Development Department, and Judith Tumusiime, Federal Grants Manager, Cambridge Community Development Department

Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Federal Agency: Housing and Urban Development Federal Award Numbers: MAH22-F005, MAH20-F005, and MAH21-F005 Award Year: July 1, 2022–June 30, 2023 Performance Reporting Type of finding: Material weakness and material noncompliance Prior-year finding: No Statistically valid sample: No Criteria Performance Reporting for the HOPWA Consolidated Annual Performance and Evaluation Report Per HUD, the Consolidated Annual Performance and Evaluation Report (CAPER) provides annual performance reporting on client outputs and outcomes that enables an assessment of grantee performance in achieving the housing stability outcome measure. The CAPER fulfills statutory and regulatory program reporting requirements and provides the grantee and HUD with the necessary information to assess the overall program performance and accomplishments against planned goals and objectives. HOPWA formula grantees are required to submit a CAPER demonstrating coordination with other Consolidated Plan resources. HUD uses the CAPER data to obtain essential information on grant activities, project sponsors, housing sites, units and households, and beneficiaries (which includes racial and ethnic data on program participants). The Consolidated Plan Management Process (CPMP) tool provides an optional tool to integrate the reporting of HOPWA-specific activities with other planning and reporting on Consolidated Plan activities. In accordance with 25 CFR 574.520(a), the City must submit a CAPER to HUD within 90 days of the end of each 12-month program year until all Grant Funds are expended. Key line items of the CAPER include amount of HOPWA funds expended with HOPWA in the program year for each HOPWA-eligible activity. Auditor should review Part 3 Accomplishment Data Planned Goal and Actual Outputs, Table 1 HOPWA Performance Planned Goal and Actual Outputs, Column f HOPWA Actual funds in the CAPER, and Part 3C Summary Overview of Grant Activities Performance and Expenditure Information, Table 1 Performance and Expenditure Information by Activity Type, Column 2 Outputs: Amount of HOPWA Funds Expended. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: – CAPER report is submitted to HUD within 90 days of the end of the 12-month program year. – Review of subrecipient’s CAPER to ensure complete and accurate reporting over key line items. The City failed to submit the CAPER that covers the period from July 1, 2021 to June 30, 2022 to HUD. The report is due to HUD by September 30, 2022. Additionally, the City has been unable to provide documentation that the subrecipient's CAPER has been reconciled to the Integrated Disbursement and Information System (IDIS). Cause Subrecipients are required to submit their individual CAPER reports to the City prior to the City submitting its report to HUD. The City has had difficulty in getting the subrecipients to comply with the CAPER reporting, which is primarily due to staffing issues at the subrecipients. As a result, the City did not submit its CAPER to HUD within the required time-frame. Effect Incomplete information from its subrecipients has resulted in the City’s inability to properly comply with HUD’s CAPER reporting requirements. Questioned Costs Not determinable Recommendation We recommend that the City review and enhance its policies, procedures, and internal controls to ensure that all subrecipient CAPER reports are reconciled to the IDIS system and submitted to HUD within 90 days of year-end. Views of Responsible Officials and Corrective Actions The FY22 CAPER was submitted to HUD on June 11, 2024. City will continue to work with all HOPWA subrecipients to ensure that a complete and accurate CAPER is completed in the appropriate format as required by HUD. This will include a focus on inputting the correct (eg, actual expended vs. award amount) funding amount. Implementation Date Beginning with CAPERs submitted for the FY ending 6/30/2024 (City 2024, Federal 2023). Responsible Officials Robert Keller, Project Planner, Cambridge Community Development Department, and Judith Tumusiime, Federal Grants Manager, Cambridge Community Development Department

Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Federal Agency: Housing and Urban Development Federal Award Numbers: MAH22-F005, MAH20-F005, and MAH21-F005 Award Year: July 1, 2022–June 30, 2023 Performance Reporting Type of finding: Material weakness and material noncompliance Prior-year finding: No Statistically valid sample: No Criteria Performance Reporting for the HOPWA Consolidated Annual Performance and Evaluation Report Per HUD, the Consolidated Annual Performance and Evaluation Report (CAPER) provides annual performance reporting on client outputs and outcomes that enables an assessment of grantee performance in achieving the housing stability outcome measure. The CAPER fulfills statutory and regulatory program reporting requirements and provides the grantee and HUD with the necessary information to assess the overall program performance and accomplishments against planned goals and objectives. HOPWA formula grantees are required to submit a CAPER demonstrating coordination with other Consolidated Plan resources. HUD uses the CAPER data to obtain essential information on grant activities, project sponsors, housing sites, units and households, and beneficiaries (which includes racial and ethnic data on program participants). The Consolidated Plan Management Process (CPMP) tool provides an optional tool to integrate the reporting of HOPWA-specific activities with other planning and reporting on Consolidated Plan activities. In accordance with 25 CFR 574.520(a), the City must submit a CAPER to HUD within 90 days of the end of each 12-month program year until all Grant Funds are expended. Key line items of the CAPER include amount of HOPWA funds expended with HOPWA in the program year for each HOPWA-eligible activity. Auditor should review Part 3 Accomplishment Data Planned Goal and Actual Outputs, Table 1 HOPWA Performance Planned Goal and Actual Outputs, Column f HOPWA Actual funds in the CAPER, and Part 3C Summary Overview of Grant Activities Performance and Expenditure Information, Table 1 Performance and Expenditure Information by Activity Type, Column 2 Outputs: Amount of HOPWA Funds Expended. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: – CAPER report is submitted to HUD within 90 days of the end of the 12-month program year. – Review of subrecipient’s CAPER to ensure complete and accurate reporting over key line items. The City failed to submit the CAPER that covers the period from July 1, 2021 to June 30, 2022 to HUD. The report is due to HUD by September 30, 2022. Additionally, the City has been unable to provide documentation that the subrecipient's CAPER has been reconciled to the Integrated Disbursement and Information System (IDIS). Cause Subrecipients are required to submit their individual CAPER reports to the City prior to the City submitting its report to HUD. The City has had difficulty in getting the subrecipients to comply with the CAPER reporting, which is primarily due to staffing issues at the subrecipients. As a result, the City did not submit its CAPER to HUD within the required time-frame. Effect Incomplete information from its subrecipients has resulted in the City’s inability to properly comply with HUD’s CAPER reporting requirements. Questioned Costs Not determinable Recommendation We recommend that the City review and enhance its policies, procedures, and internal controls to ensure that all subrecipient CAPER reports are reconciled to the IDIS system and submitted to HUD within 90 days of year-end. Views of Responsible Officials and Corrective Actions The FY22 CAPER was submitted to HUD on June 11, 2024. City will continue to work with all HOPWA subrecipients to ensure that a complete and accurate CAPER is completed in the appropriate format as required by HUD. This will include a focus on inputting the correct (eg, actual expended vs. award amount) funding amount. Implementation Date Beginning with CAPERs submitted for the FY ending 6/30/2024 (City 2024, Federal 2023). Responsible Officials Robert Keller, Project Planner, Cambridge Community Development Department, and Judith Tumusiime, Federal Grants Manager, Cambridge Community Development Department

Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Federal Agency: U.S. Department of Treasury Federal Award Number: NA Award Year: July 1, 2022–June 30, 2023 Suspension and Debarment Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria The 2 CFR sections 180.215 and 180.220 provide the principles to be applied to ensure nonfederal entities are not contracting with or making subawards under covered transactions to parties that are suspended or debarred. Also, when a nonfederal entity enters into a covered transaction with an entity at a lower tier, the nonfederal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition When establishing contracts for subrecipients under the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF), the City requires that standard contract language be included to address the applicable suspension and debarment requirements. During fiscal year 2023, the required contract language was not included within the subrecipient contracts executed for the CSLFRF program. Additionally, the City did not verify that its subrecipients were not suspended or debarred through the System for Award Management (SAM) or include self-certifications from the vendor/subrecipient during the contracting process. During our audit, we noted five of seven vendors and four of four subrecipients selected for testing were not checked for suspension and debarment as evidenced via review of the subrecipient contracts. During compliance testing, it was confirmed for all vendors and subrecipients, except for one, that they were not suspended or debarred. The engagement team was unable to determine if Neville Communities, Inc. is suspended or debarred as it is not registered with SAM.gov. Cause The City requires that standard contract language be included in all its subrecipient contracts that addresses suspension and debarment requirements. The City was unaware that the required language was excluded from subrecipient contracts entered into for the CSLFRF program as there was insufficient review of the contracts prior to execution to ensure all required elements were present. Additionally, the City requires that program personnel review SAM.gov to ensure the subrecipient is not suspended or debarred. There was no documentation that this review had occurred prior to entering into a contract with the subrecipient. Effect Lack of formal review of subrecipient contracts and review of entities on SAM could result in the City entering into contracts with prohibited entities. Questioned Costs None Recommendation We recommend the City ensure that required language is included within all subrecipient contracts prior to execution. We also recommend the City review that subrecipients are not suspended or debarred on the SAM website and retain documentation of this check prior to entering into contracts with subrecipients. Views of Responsible Officials and Corrective Actions The City will ensure that subrecipient contracts will include language about suspension and debarment. The City will also download a PDF copy of the subrecipients registration on SAM.GOV showing the subrecipient’s Exclusion Summary Status. Implementation Date FY25 Contracts (7/1/2024) Responsible Officials Michele Kincaid, Assistant Finance Director, and Sharon Pu, Grants Management

Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Federal Agency: U.S. Department of Treasury Federal Award Number: NA Award Year: July 1, 2022–June 30, 2023 Suspension and Debarment Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria The 2 CFR sections 180.215 and 180.220 provide the principles to be applied to ensure nonfederal entities are not contracting with or making subawards under covered transactions to parties that are suspended or debarred. Also, when a nonfederal entity enters into a covered transaction with an entity at a lower tier, the nonfederal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition When establishing contracts for subrecipients under the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF), the City requires that standard contract language be included to address the applicable suspension and debarment requirements. During fiscal year 2023, the required contract language was not included within the subrecipient contracts executed for the CSLFRF program. Additionally, the City did not verify that its subrecipients were not suspended or debarred through the System for Award Management (SAM) or include self-certifications from the vendor/subrecipient during the contracting process. During our audit, we noted five of seven vendors and four of four subrecipients selected for testing were not checked for suspension and debarment as evidenced via review of the subrecipient contracts. During compliance testing, it was confirmed for all vendors and subrecipients, except for one, that they were not suspended or debarred. The engagement team was unable to determine if Neville Communities, Inc. is suspended or debarred as it is not registered with SAM.gov. Cause The City requires that standard contract language be included in all its subrecipient contracts that addresses suspension and debarment requirements. The City was unaware that the required language was excluded from subrecipient contracts entered into for the CSLFRF program as there was insufficient review of the contracts prior to execution to ensure all required elements were present. Additionally, the City requires that program personnel review SAM.gov to ensure the subrecipient is not suspended or debarred. There was no documentation that this review had occurred prior to entering into a contract with the subrecipient. Effect Lack of formal review of subrecipient contracts and review of entities on SAM could result in the City entering into contracts with prohibited entities. Questioned Costs None Recommendation We recommend the City ensure that required language is included within all subrecipient contracts prior to execution. We also recommend the City review that subrecipients are not suspended or debarred on the SAM website and retain documentation of this check prior to entering into contracts with subrecipients. Views of Responsible Officials and Corrective Actions The City will ensure that subrecipient contracts will include language about suspension and debarment. The City will also download a PDF copy of the subrecipients registration on SAM.GOV showing the subrecipient’s Exclusion Summary Status. Implementation Date FY25 Contracts (7/1/2024) Responsible Officials Michele Kincaid, Assistant Finance Director, and Sharon Pu, Grants Management

Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Federal Agency: U.S. Department of Treasury Federal Award Number: NA Award Year: July 1, 2022–June 30, 2023 Subrecipient Monitoring Type of finding: Material weakness and noncompliance Prior-year finding: Yes Statistically valid sample: No Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. During our audit, we noted that audited financial statements were obtained for the four subrecipients selected for testing, but there was no documentation to evidence the nature and extent of the City’s review of the audit reports obtained. Additionally, a documented risk assessment was not performed by the City over the four subrecipients selected for testing prior to entering into a contract. Cause The City requires that audited financial statements are obtained for subrecipients, but there is no checklist or formal documentation required to indicate what should be reviewed when reviewing the audit reports to ensure compliance with subrecipient monitoring requirements. Additionally, the City requires a risk assessment be completed over each subrecipient. However, due to time constraints, a risk assessment was not completed or documented. Effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned Costs None Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining subrecipient audit reports to ensure required monitoring procedures are performed and well documented. Views of Responsible Officials and Corrective Actions The City will use a subrecipient audit certification form and a subrecipient risk assessment questionnaire to evaluate a subrecipient's risk/experience with federal funds as well as assess their federal funding threshold for having a single audit. Implementation Date FY25 Contracts (7/1/2024) Responsible Officials Michele Kincaid, Assistant Finance Director, and Sharon Pu, Grants Management

Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Federal Agency: U.S. Department of Treasury Federal Award Number: NA Award Year: July 1, 2022–June 30, 2023 Subrecipient Monitoring Type of finding: Material weakness and noncompliance Prior-year finding: Yes Statistically valid sample: No Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. During our audit, we noted that audited financial statements were obtained for the four subrecipients selected for testing, but there was no documentation to evidence the nature and extent of the City’s review of the audit reports obtained. Additionally, a documented risk assessment was not performed by the City over the four subrecipients selected for testing prior to entering into a contract. Cause The City requires that audited financial statements are obtained for subrecipients, but there is no checklist or formal documentation required to indicate what should be reviewed when reviewing the audit reports to ensure compliance with subrecipient monitoring requirements. Additionally, the City requires a risk assessment be completed over each subrecipient. However, due to time constraints, a risk assessment was not completed or documented. Effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned Costs None Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining subrecipient audit reports to ensure required monitoring procedures are performed and well documented. Views of Responsible Officials and Corrective Actions The City will use a subrecipient audit certification form and a subrecipient risk assessment questionnaire to evaluate a subrecipient's risk/experience with federal funds as well as assess their federal funding threshold for having a single audit. Implementation Date FY25 Contracts (7/1/2024) Responsible Officials Michele Kincaid, Assistant Finance Director, and Sharon Pu, Grants Management

Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Federal Agency: U.S. Department of Treasury Federal Award Number: SLFRP1982 Award Year: July 1, 2022–June 30, 2023 Reporting Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria The 2 CFR 200.328 and 31 CFR section 35.4 require quarterly and annual reporting of the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) grant. The report focuses on the following key line items: current-period obligation, cumulative obligation, current-period expenditure, and cumulative expenditures. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our audit, we selected the December 31, 2022 and June 30, 2023 report for testing. We noted that the current-period obligations, cumulative obligations, current-period expenditures, and cumulative expenditures contained on these reports could not be reconciled to the City’s books and records. As such, the engagement team was unable to determine if the amounts included in these key line items were complete and accurate. Cause PeopleSoft reports that were used to prepare the CSLFRF reports were not retained by the City. As PeopleSoft continuously updates, the detail used to prepare these reports could not be reproduced by the City. Effect Lack of document retention and reconciliation from the general ledger system to the CSLFRF could result in inaccurate reporting to the US Department of Treasury. Questioned Costs None Recommendation We recommend the City ensures proper document retention and complete reconciliations for how quarterly and annual reports are compiled. Views of Responsible Officials and Corrective Actions The Finance department will document the reconciliation of the City’s GL ARPA expenditures and obligations to the Department of Treasury ARPA reporting portal report both quarterly and annually. All reconciling adjustments and GL report documentation will be properly retained. Implementation Date 7/1/2023 Responsible Officials Michele Kincaid, Assistant Finance Director, and Sharon Pu, Grants Management

Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Federal Agency: U.S. Department of Treasury Federal Award Number: SLFRP1982 Award Year: July 1, 2022–June 30, 2023 Reporting Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria The 2 CFR 200.328 and 31 CFR section 35.4 require quarterly and annual reporting of the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) grant. The report focuses on the following key line items: current-period obligation, cumulative obligation, current-period expenditure, and cumulative expenditures. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our audit, we selected the December 31, 2022 and June 30, 2023 report for testing. We noted that the current-period obligations, cumulative obligations, current-period expenditures, and cumulative expenditures contained on these reports could not be reconciled to the City’s books and records. As such, the engagement team was unable to determine if the amounts included in these key line items were complete and accurate. Cause PeopleSoft reports that were used to prepare the CSLFRF reports were not retained by the City. As PeopleSoft continuously updates, the detail used to prepare these reports could not be reproduced by the City. Effect Lack of document retention and reconciliation from the general ledger system to the CSLFRF could result in inaccurate reporting to the US Department of Treasury. Questioned Costs None Recommendation We recommend the City ensures proper document retention and complete reconciliations for how quarterly and annual reports are compiled. Views of Responsible Officials and Corrective Actions The Finance department will document the reconciliation of the City’s GL ARPA expenditures and obligations to the Department of Treasury ARPA reporting portal report both quarterly and annually. All reconciling adjustments and GL report documentation will be properly retained. Implementation Date 7/1/2023 Responsible Officials Michele Kincaid, Assistant Finance Director, and Sharon Pu, Grants Management

Program: Special Education Cluster (IDEA) ALN #: 84.027 Federal Agency: Department of Education Federal Award Number: NA Award Year: July 1, 2022–June 30, 2023 Period of Performance Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria Per Part 4 of the Compliance Supplement, LEAs and SEAs must obligate funds during the 27 months, extending from July 1 of the fiscal year for which the funds were appropriated through September 30 of the second following fiscal year. This maximum period includes a 15-month period of initial availability plus a 12-month period for carryover. For example, funds from the fiscal year 2019 appropriation initially became available on July 1, 2019 and may be obligated by the grantee and subgrantee through September 30, 2021 (Section 421(b) of GEPA (20 USC 1225(b)); 34 CFR sections 76.703 through 76.710). According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During testing over period of performance for the IDEA program, 14 samples were selected for testwork. For four selections (all related to the same vendor), we noted that expenditures were charged to the SC23605 grant 52 days prior to the grant’s start date. The expenditures were invoiced on August 1, 2022, and the grant’s period of performance began on September 22, 2022 (the date the Massachusetts Department of Education notified the City of this grant’s effective date). Cause The cause of the noncompliance relates to an error assigning POs for a certain vendor. POs created for this vendor for July 2022 tuition were mistakenly charged to the incorrect grant. A lack of review over charges to individual grants and programs has caused the City to charge expenses to the IDEA grant outside of its period of performance. Questioned Costs Not determinable Recommendation We recommend the City establish more precise controls over the review and approval of invoices, specifically relating to the review and approval over the direct grant that the expense will be charged to. Views of Responsible Officials and Corrective Actions Cambridge Public Schools' CFO or Grants Coordinator will review and sign-off on all tuition requisitions that will be charged to grants to confirm the grant approval date and compliance with the period of performance. Implementation Date The new approval process will be in place by July 1, 2024. Responsible Officials Dr. Karyn Grace, Assistant Superintendent of Student Services, Cambridge Public Schools, Ivy Washington, Chief Financial Officer, Cambridge School Department, and Lindsay Smythe, Grant Coordinator, Cambridge School Department

Program: Special Education Cluster (IDEA) ALN #: 84.027 Federal Agency: Department of Education Federal Award Number: NA Award Year: July 1, 2022–June 30, 2023 Period of Performance Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria Per Part 4 of the Compliance Supplement, LEAs and SEAs must obligate funds during the 27 months, extending from July 1 of the fiscal year for which the funds were appropriated through September 30 of the second following fiscal year. This maximum period includes a 15-month period of initial availability plus a 12-month period for carryover. For example, funds from the fiscal year 2019 appropriation initially became available on July 1, 2019 and may be obligated by the grantee and subgrantee through September 30, 2021 (Section 421(b) of GEPA (20 USC 1225(b)); 34 CFR sections 76.703 through 76.710). According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During testing over period of performance for the IDEA program, 14 samples were selected for testwork. For four selections (all related to the same vendor), we noted that expenditures were charged to the SC23605 grant 52 days prior to the grant’s start date. The expenditures were invoiced on August 1, 2022, and the grant’s period of performance began on September 22, 2022 (the date the Massachusetts Department of Education notified the City of this grant’s effective date). Cause The cause of the noncompliance relates to an error assigning POs for a certain vendor. POs created for this vendor for July 2022 tuition were mistakenly charged to the incorrect grant. A lack of review over charges to individual grants and programs has caused the City to charge expenses to the IDEA grant outside of its period of performance. Questioned Costs Not determinable Recommendation We recommend the City establish more precise controls over the review and approval of invoices, specifically relating to the review and approval over the direct grant that the expense will be charged to. Views of Responsible Officials and Corrective Actions Cambridge Public Schools' CFO or Grants Coordinator will review and sign-off on all tuition requisitions that will be charged to grants to confirm the grant approval date and compliance with the period of performance. Implementation Date The new approval process will be in place by July 1, 2024. Responsible Officials Dr. Karyn Grace, Assistant Superintendent of Student Services, Cambridge Public Schools, Ivy Washington, Chief Financial Officer, Cambridge School Department, and Lindsay Smythe, Grant Coordinator, Cambridge School Department

Program: Emergency Solutions Grant Program (ESG) ALN #: 14.231 Federal Agency: Housing and Urban Development Federal Award Numbers: E-20-MC-25-005, E-21-MC-25-0005, E-22-MC-25-0005, E-20-MW-25-005, and E-20-MW-35-005 Award Year: July 1, 2022–June 30, 2023 Suspension and Debarment Type of finding: Significant deficiency Prior-year finding: Yes Statistically valid sample: No Criteria The 2 CFR sections 180.215 and 180.220 provide the principles to be applied to ensure that nonfederal entities are not contracting with or making subawards under covered transactions to parties that are suspended or debarred. Also, when a nonfederal entity enters into a covered transaction with an entity at a lower tier, the nonfederal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition When establishing contracts for subrecipients under the Emergency Solutions Grant Program (ESG), the City requires that standard contract language be included to address the applicable suspension and debarment requirements. During fiscal year 2023, the required contract language was not included within the subrecipient contracts executed for the ESG program. Additionally, the City’s policy is to check the System of Award Management (SAM) to verify that its subrecipients were not suspended or debarred. During our audit, we noted one of four subrecipients selected for testing were not checked for suspension and debarment as evidenced via review of the subrecipient contracts or through SAM documentation. During compliance testing for the subrecipients, it was confirmed they were not suspended or debarred. Cause The City requires that standard contract language be included in all of its subrecipient contracts and that the City reviews SAM to address suspension and debarment requirements. The City was unaware that the required language was excluded from subrecipient contracts entered into for the ESG program as there was insufficient review of the contracts prior to execution to ensure all required elements were present. Additionally, the City requires that program personnel review SAM.gov to ensure the subrecipient is not suspended or debarred. There was no documentation that this review had occurred prior to entering into a contract with the subrecipient. Effect Lack of formal review of subrecipient contracts and review of entities on SAM could result in the City entering into contracts with prohibited entities. Questioned Costs None Recommendation We recommend the City ensure that required language is included within all subrecipient contracts prior to execution. We also recommend that the City review that subrecipients are not included on the SAM exclusion list and retain documentation of that check and review prior to entering into contracts with subrecipients. Views of Responsible Officials and Corrective Actions Based on the finding in the prior year audit, the City updated the subrecipient contract template in spring 2023 prior to execution of contracts for the FY24 ESG program year and will continue to utilize the updated template to ensure required language certifying that the agency, its officers, and employees are not suspended or debarred from doing business with the federal government. Staff will continue to verify that subrecipients are not suspended or debarred by checking against the Sam.gov Exclusion List and registration pages prior to executing contracts, and will document those checks through grant management meeting minutes and Smartsheet tracking. Implementation Date Updates to the contract template were completed in spring 2023 and updated contract template was utilized for FY24 program year beginning July 1, 2023 and will be utilized for FY25 ESG program year beginning July 1, 2024. Documentation from the Sam.gov website showing that all ESG subrecipients are in good standing will be included in each subrecipient file for the FY25 program year, with anticipated completion of June 30, 2024. Responsible Officials Anthony Woods, Planner and Contract Manager, and Liz Mengers, Planning and Development Manager

Program: Emergency Solutions Grant Program (ESG) ALN #: 14.231 Federal Agency: Housing and Urban Development Federal Award Numbers: E-20-MC-25-005, E-21-MC-25-0005, E-22-MC-25-0005, E-20-MW-25-005, and E-20-MW-35-005 Award Year: July 1, 2022–June 30, 2023 Suspension and Debarment Type of finding: Significant deficiency Prior-year finding: Yes Statistically valid sample: No Criteria The 2 CFR sections 180.215 and 180.220 provide the principles to be applied to ensure that nonfederal entities are not contracting with or making subawards under covered transactions to parties that are suspended or debarred. Also, when a nonfederal entity enters into a covered transaction with an entity at a lower tier, the nonfederal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition When establishing contracts for subrecipients under the Emergency Solutions Grant Program (ESG), the City requires that standard contract language be included to address the applicable suspension and debarment requirements. During fiscal year 2023, the required contract language was not included within the subrecipient contracts executed for the ESG program. Additionally, the City’s policy is to check the System of Award Management (SAM) to verify that its subrecipients were not suspended or debarred. During our audit, we noted one of four subrecipients selected for testing were not checked for suspension and debarment as evidenced via review of the subrecipient contracts or through SAM documentation. During compliance testing for the subrecipients, it was confirmed they were not suspended or debarred. Cause The City requires that standard contract language be included in all of its subrecipient contracts and that the City reviews SAM to address suspension and debarment requirements. The City was unaware that the required language was excluded from subrecipient contracts entered into for the ESG program as there was insufficient review of the contracts prior to execution to ensure all required elements were present. Additionally, the City requires that program personnel review SAM.gov to ensure the subrecipient is not suspended or debarred. There was no documentation that this review had occurred prior to entering into a contract with the subrecipient. Effect Lack of formal review of subrecipient contracts and review of entities on SAM could result in the City entering into contracts with prohibited entities. Questioned Costs None Recommendation We recommend the City ensure that required language is included within all subrecipient contracts prior to execution. We also recommend that the City review that subrecipients are not included on the SAM exclusion list and retain documentation of that check and review prior to entering into contracts with subrecipients. Views of Responsible Officials and Corrective Actions Based on the finding in the prior year audit, the City updated the subrecipient contract template in spring 2023 prior to execution of contracts for the FY24 ESG program year and will continue to utilize the updated template to ensure required language certifying that the agency, its officers, and employees are not suspended or debarred from doing business with the federal government. Staff will continue to verify that subrecipients are not suspended or debarred by checking against the Sam.gov Exclusion List and registration pages prior to executing contracts, and will document those checks through grant management meeting minutes and Smartsheet tracking. Implementation Date Updates to the contract template were completed in spring 2023 and updated contract template was utilized for FY24 program year beginning July 1, 2023 and will be utilized for FY25 ESG program year beginning July 1, 2024. Documentation from the Sam.gov website showing that all ESG subrecipients are in good standing will be included in each subrecipient file for the FY25 program year, with anticipated completion of June 30, 2024. Responsible Officials Anthony Woods, Planner and Contract Manager, and Liz Mengers, Planning and Development Manager

Program: Emergency Solutions Grant Program (ESG) ALN #: 14.231 Federal Agency: Housing and Urban Development Federal Award Numbers: E-20-MC-25-005, E-21-MC-25-0005, E-22-MC-25-0005, E-20-MW-25-005, and E-20-MW-35-005 Award Year: July 1, 2022–June 30, 2023 Special Tests; Payments to Subrecipients Type of finding: Material Weakness and Material noncompliance Prior-year finding: Yes Statistically valid sample: No Criteria According to 24 CFR section 576.203, a recipient must pay each subrecipient for allowable costs within 30 days after receiving the subrecipient’s complete payment request. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City’s ESG Program has a control in place to ensure that invoice cover sheets (i.e., reimbursement requests) are reviewed in a timely manner so that the City can subsequently reimburse subrecipients within 30 days and remain in compliance with the requirement. However, the control to ensure timely payments to subrecipients was not operating effectively as payments to 8 of 19 subrecipients tested had payment dates that ranged from 15 and 255, subsequent to the subrecipient’s completed request for payment. Cause The City did not have effective controls in place to ensure subrecipients were paid for allowable costs within 30 days after receiving the subrecipient’s completed payment request. Effect Lack of effective controls resulted in the City not complying with 24 CFR section 576.203. Effect Lack of effective controls resulted in the City not complying with 24 CFR section 576.203. Questioned Costs None Recommendation We recommend the City establish effective controls to ensure payment requests received from subrecipients are paid within 30 days of receipt. Views of Responsible Officials and Corrective Actions Based on prior year (FY22) findings, the City established the following procedures to ensure payment requests received from subrecipients are paid within 30 days of receipt of a complete request for reimbursement: 1. Department of Effect Lack of effective controls resulted in the City not complying with 24 CFR section 576.203.Human Service Programs (DHSP) Contract Manager reviews invoices within 5 business days of receipt of request for reimbursement from subrecipient. a. If invoice is complete, original date of receipt is recorded. b. If invoice is incomplete, subrecipient is notified of items or documentation that is missing and receipt date is updated to reflect date of receipt of complete invoice. 2. Contract Manager approves payment request and submits to DHSP Fiscal staff for processing. 3. Fiscal staff processes and submits to Auditing Department as Priority payment. Four of the 19 sampled payment requests were received or processed after receipt of the FY22 audit findings, and all of those requests for reimbursement were paid within 30 days receipt. Implementation Date Implementation of the above process began with the FY23 3rd quarter invoices in April 2023. Responsible Officials Anthony Woods, Planner and Contract Manager; Liz Mengers, DHSP Planning and Development Manager; Giovanna Alvarez, DHSP Fiscal Administrator; and Janice Alger, Assistant Director of Administration, Human Services

Program: Emergency Solutions Grant Program (ESG) ALN #: 14.231 Federal Agency: Housing and Urban Development Federal Award Numbers: E-20-MC-25-005, E-21-MC-25-0005, E-22-MC-25-0005, E-20-MW-25-005, and E-20-MW-35-005 Award Year: July 1, 2022–June 30, 2023 Special Tests; Payments to Subrecipients Type of finding: Material Weakness and Material noncompliance Prior-year finding: Yes Statistically valid sample: No Criteria According to 24 CFR section 576.203, a recipient must pay each subrecipient for allowable costs within 30 days after receiving the subrecipient’s complete payment request. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City’s ESG Program has a control in place to ensure that invoice cover sheets (i.e., reimbursement requests) are reviewed in a timely manner so that the City can subsequently reimburse subrecipients within 30 days and remain in compliance with the requirement. However, the control to ensure timely payments to subrecipients was not operating effectively as payments to 8 of 19 subrecipients tested had payment dates that ranged from 15 and 255, subsequent to the subrecipient’s completed request for payment. Cause The City did not have effective controls in place to ensure subrecipients were paid for allowable costs within 30 days after receiving the subrecipient’s completed payment request. Effect Lack of effective controls resulted in the City not complying with 24 CFR section 576.203. Effect Lack of effective controls resulted in the City not complying with 24 CFR section 576.203. Questioned Costs None Recommendation We recommend the City establish effective controls to ensure payment requests received from subrecipients are paid within 30 days of receipt. Views of Responsible Officials and Corrective Actions Based on prior year (FY22) findings, the City established the following procedures to ensure payment requests received from subrecipients are paid within 30 days of receipt of a complete request for reimbursement: 1. Department of Effect Lack of effective controls resulted in the City not complying with 24 CFR section 576.203.Human Service Programs (DHSP) Contract Manager reviews invoices within 5 business days of receipt of request for reimbursement from subrecipient. a. If invoice is complete, original date of receipt is recorded. b. If invoice is incomplete, subrecipient is notified of items or documentation that is missing and receipt date is updated to reflect date of receipt of complete invoice. 2. Contract Manager approves payment request and submits to DHSP Fiscal staff for processing. 3. Fiscal staff processes and submits to Auditing Department as Priority payment. Four of the 19 sampled payment requests were received or processed after receipt of the FY22 audit findings, and all of those requests for reimbursement were paid within 30 days receipt. Implementation Date Implementation of the above process began with the FY23 3rd quarter invoices in April 2023. Responsible Officials Anthony Woods, Planner and Contract Manager; Liz Mengers, DHSP Planning and Development Manager; Giovanna Alvarez, DHSP Fiscal Administrator; and Janice Alger, Assistant Director of Administration, Human Services

Program: Emergency Solutions Grant Program (ESG) ALN #: 14.231 Federal Agency: Housing and Urban Development Federal Award Numbers: E-20-MC-25-005, E-21-MC-25-0005, E-22-MC-25-0005, E-20-MW-25-005, and E-20-MW-35-005 Award Year: July 1, 2022–June 30, 2023 Subrecipient Monitoring Type of finding: Material weakness and noncompliance Prior-year finding: Yes Statistically valid sample: No Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. During our audit, we noted that audited financial statements were obtained for the four subrecipients selected for testing, but there was no documentation to evidence the nature and extent of the City’s review of the audit reports obtained. Additionally, a documented risk assessment was not performed by the City over the four subrecipients selected for testing prior to entering into a contract. Cause The City requires that audited financial statements are obtained for subrecipients, but there is no checklist or formal documentation required to indicate what should be reviewed when reviewing the audit reports to ensure compliance with subrecipient monitoring requirements. Additionally, the City requires a risk assessment be completed over each subrecipient. However, due to time constraints, a risk assessment was not completed. Effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned Costs None Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining subrecipient audit reports to ensure required monitoring procedures are performed and well documented. Views of Responsible Officials and Corrective Actions The City has established an Audit Review Certification form that is completed by employees to formally document review of subrecipient agencies' audit reports. Implementation Date The City implemented use of the Audit Review Certification form starting in Spring 2023 as part of the ESG subrecipient application process for the FY24 program year beginning July 1, 2023, and will continue use of the form for the FY25 program year beginning on July 1, 2024. Responsible Officials Anthony Woods, Planner and Contract Manager, and Liz Mengers, Planning and Development Manager

Program: Emergency Solutions Grant Program (ESG) ALN #: 14.231 Federal Agency: Housing and Urban Development Federal Award Numbers: E-20-MC-25-005, E-21-MC-25-0005, E-22-MC-25-0005, E-20-MW-25-005, and E-20-MW-35-005 Award Year: July 1, 2022–June 30, 2023 Subrecipient Monitoring Type of finding: Material weakness and noncompliance Prior-year finding: Yes Statistically valid sample: No Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. During our audit, we noted that audited financial statements were obtained for the four subrecipients selected for testing, but there was no documentation to evidence the nature and extent of the City’s review of the audit reports obtained. Additionally, a documented risk assessment was not performed by the City over the four subrecipients selected for testing prior to entering into a contract. Cause The City requires that audited financial statements are obtained for subrecipients, but there is no checklist or formal documentation required to indicate what should be reviewed when reviewing the audit reports to ensure compliance with subrecipient monitoring requirements. Additionally, the City requires a risk assessment be completed over each subrecipient. However, due to time constraints, a risk assessment was not completed. Effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned Costs None Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining subrecipient audit reports to ensure required monitoring procedures are performed and well documented. Views of Responsible Officials and Corrective Actions The City has established an Audit Review Certification form that is completed by employees to formally document review of subrecipient agencies' audit reports. Implementation Date The City implemented use of the Audit Review Certification form starting in Spring 2023 as part of the ESG subrecipient application process for the FY24 program year beginning July 1, 2023, and will continue use of the form for the FY25 program year beginning on July 1, 2024. Responsible Officials Anthony Woods, Planner and Contract Manager, and Liz Mengers, Planning and Development Manager

Program: HOME Investment Partnerships Program (HOME) ALN #: 14.239 Federal Agency: Department of Housing and Urban Development Federal Award Number: M22-MC250202 Award Year: July 1, 2022–June 30, 2023 Eligibility/Subrecipient Monitoring Type of finding: Noncompliance Prior-year finding: No Statistically valid sample: No Criteria 24 CFR 92.252, Qualification as affordable housing: Rental housing (e) Periods of affordability. The HOME-assisted units must meet the affordability requirements for not less than the applicable period specified in the following table, beginning after project completion. (1) The affordability requirements: (i) Apply without regard to the term of any loan or mortgage, repayment of the HOME investment, or the transfer of ownership (ii) Must be imposed by a deed restriction, a covenant running with the land, an agreement restricting the use of the property, or other mechanisms approved by HUD and must give the participating jurisdiction the right to require specific performance (except that the participating jurisdiction may provide that the affordability restrictions may terminate upon foreclosure or transfer in lieu of foreclosure) (iii) Must be recorded in accordance with State recordation laws. (2) The participating jurisdiction may use purchase options, rights of first refusal, or other preemptive rights to purchase the housing before foreclosure or deed in lieu of foreclosure in order to preserve affordability. (3) The affordability restrictions shall be revived according to the original terms if, during the original affordability period, the owner of record before the foreclosure, or deed in lieu of foreclosure, or any entity that includes the former owner or those with whom the former owner has or had family or business ties obtains an ownership interest in the project or property. 4) The termination of the restrictions on the project does not terminate the participating jurisdiction’s repayment obligation under § 92.503(b). (h) Tenant income. The income of each tenant must be determined initially in accordance with § 92.203(a)(1)(i). In addition, each year during the period of affordability the project owner must reexamine each tenant’s annual income in accordance with one of the options in § 92.203 selected by the participating jurisdiction. 24 CFR92.203 Income determinations (a) The HOME program has income-targeting requirements for the HOME program and for HOME projects. Therefore, the participating jurisdiction must determine each family is income eligible by determining the family’s annual income. (1) For families who are tenants in HOME-assisted housing and not receiving HOME tenant-based rental assistance, the participating jurisdiction must initially determine annual income using the method in paragraph (a)(1)(i) of this section. For subsequent income determinations during the period of affordability, the participating jurisdiction may use any one of the following methods in accordance with § 92.252(h): (ii) Obtain from the family a written statement of the amount of the family’s annual income and family size, along with a certification that the information is complete and accurate. The certification must state that the family will provide source documents upon request. Title 45 US Code of Federal Regulations Part 75 (45 CFR part 75), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 75.303 also states that nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Additionally, the 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Condition During our testwork, we noted there were two individuals residing in a facility financed with a City HOME loan who did not meet the low-income requirements and were therefore determined not to be eligible. Cause The City’s property manager failed to ensure that another unit, or the next available unit, within the building would be designated as a HOME-floating unit as required in its loan agreement with the City. Effect Ineligible recipients could potentially cause the City to not be in compliance with HUD requirements. Questioned Costs Not determinable Recommendation We recommend the City work collaboratively with its property managers to ensure that the correct number of units are being designated as HOME-assisted units. Views of Responsible Officials and Corrective Actions The two individuals determined to have incomes in excess of HOME Program limits were noted in our FY23 monitoring of properties assisted with HOME funds. The HOME Program allows for a unit to be occupied by a household who was initially eligible and whose income later increases, but requires that a comparable unit be designated as a HOME unit and leased to an eligible household when one is available. Owners of each property were made aware of the circumstance when City monitoring was completed. Each will designate comparable units to be HOME units when available and lease them to eligible households. Implementation Date Dependent on when residents move and/or appropriate units are available. Responsible Officials Chris Cotter, Housing Director & Judith Tumusiime, Federal Grants Manager, Cambridge Community Development Department

Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Federal Agency: Housing and Urban Development Federal Award Numbers: MAH22-F005, MAH20-F005, and MAH21-F005 Award Year: July 1, 2022–June 30, 2023 Subrecipient Monitoring Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. During our audit, we noted that audited financial statements were obtained for the four subrecipients selected for testing, but there was no documentation to evidence the nature and extent of the City’s review of the reports obtained. Additionally, a documented risk assessment was not performed by the City over the four subrecipients selected for testing prior to entering into a contract. Cause The City requires that audited financial statements are obtained for subrecipients, but there is no checklist or formal documentation required to indicate what should be reviewed when reviewing the audit reports to ensure compliance with subrecipient monitoring requirements. Additionally, the City requires a risk assessment be completed over each subrecipient. However, due to time constraints, a risk assessment was not completed. Effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned Costs None Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining subrecipient audit reports to ensure required monitoring procedures are performed and well documented. Views of Responsible Officials and Corrective Actions The City will incorporate a more formal review of financial audits of subrecipients in conjunction with new contracts moving forward. These audits, and City staff’s verification of assessment will be included in each subrecipient file. Implementation Date FY2025 Contracts Responsible Officials Robert Keller, Project Planner, Cambridge Community Development Department, and Judith Tumusiime, Federal Grants Manager, Cambridge Community Development Department

Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Federal Agency: Housing and Urban Development Federal Award Numbers: MAH22-F005, MAH20-F005, and MAH21-F005 Award Year: July 1, 2022–June 30, 2023 Subrecipient Monitoring Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. During our audit, we noted that audited financial statements were obtained for the four subrecipients selected for testing, but there was no documentation to evidence the nature and extent of the City’s review of the reports obtained. Additionally, a documented risk assessment was not performed by the City over the four subrecipients selected for testing prior to entering into a contract. Cause The City requires that audited financial statements are obtained for subrecipients, but there is no checklist or formal documentation required to indicate what should be reviewed when reviewing the audit reports to ensure compliance with subrecipient monitoring requirements. Additionally, the City requires a risk assessment be completed over each subrecipient. However, due to time constraints, a risk assessment was not completed. Effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned Costs None Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining subrecipient audit reports to ensure required monitoring procedures are performed and well documented. Views of Responsible Officials and Corrective Actions The City will incorporate a more formal review of financial audits of subrecipients in conjunction with new contracts moving forward. These audits, and City staff’s verification of assessment will be included in each subrecipient file. Implementation Date FY2025 Contracts Responsible Officials Robert Keller, Project Planner, Cambridge Community Development Department, and Judith Tumusiime, Federal Grants Manager, Cambridge Community Development Department

Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Federal Agency: Housing and Urban Development Federal Award Numbers: MAH22-F005, MAH20-F005, and MAH21-F005 Award Year: July 1, 2022–June 30, 2023 Reporting Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria Special Reporting for Federal Funding Accountability and Transparency Act Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109-282), as amended by Section 6202 of Public Law 110-252, herein referred to as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Aspects of the Transparency Act that relate to subaward reporting (1) under grants and cooperative agreements were implemented in OMB in 2 CFR Part 170 and (2) under contracts, by the regulatory agencies responsible for the Federal Acquisition Regulation (FAR at 5 FR 39414 et seq., July 8, 2010). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Title 2 US Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, section 200.1 defines subaward as an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract. Further, 2 CFR 200.1 defines subrecipient as a nonfederal entity that receives a subaward from a passthrough entity to carry out part of a federal program but does not include an individual that is a beneficiary of such program. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City’s Community Development Department did not report awards granted to subrecipients for the HOPWA program by the end of the month following the month in which the City awarded the subrecipient award that is greater than or equal to $30,000 as required by FFATA. FFATA requires the City to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee DUNS/UEI number 3. Amount of subaward 4. Subaward obligation/action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that the City did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. During our testwork of four subawards, we also noted reporting exceptions as subawards were not reported in the required time. Cause The condition found was due to the City not reporting any amounts passed through to subrecipients for the period from July 2022 to June 2023, as the responsible officials were not aware of the reporting timeline requirements. As a result, all subawards were reported on a one-year lag. Effect Failure to submit all subaward amounts passed through to subrecipients and subcontractors under subawards as defined by 2 CFR 200.1 in the City’s FFATA reporting could result in the City reporting inaccurate and incomplete amounts to the federal government Questioned Costs None Recommendation We recommend that the City review and enhance its policies, procedures, and internal controls to ensure that all amounts passed through to subrecipients under subawards as defined in 2 CFR 200.1 are reported in accordance with the FFATA federal regulations. In addition, we recommend that the City use obligation date for FFATA reporting. Views of Responsible Officials and Corrective Actions HOPWA contracts have typically been obligated over the course of several or more months, as some subrecipients operate in different ways. Going forward, the City will use the contract start date (7/1) as the Obligation date, and will submit the FFATA report accordingly. Implementation Date 8/31/2024 (representing the end of the month following the obligation of funds). Responsible Officials Robert Keller, Project Planner, Cambridge Community Development Department, and Judith Tumusiime, Federal Grants Manager, Cambridge Community Development Department

Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Federal Agency: Housing and Urban Development Federal Award Numbers: MAH22-F005, MAH20-F005, and MAH21-F005 Award Year: July 1, 2022–June 30, 2023 Reporting Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria Special Reporting for Federal Funding Accountability and Transparency Act Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109-282), as amended by Section 6202 of Public Law 110-252, herein referred to as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Aspects of the Transparency Act that relate to subaward reporting (1) under grants and cooperative agreements were implemented in OMB in 2 CFR Part 170 and (2) under contracts, by the regulatory agencies responsible for the Federal Acquisition Regulation (FAR at 5 FR 39414 et seq., July 8, 2010). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Title 2 US Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, section 200.1 defines subaward as an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract. Further, 2 CFR 200.1 defines subrecipient as a nonfederal entity that receives a subaward from a passthrough entity to carry out part of a federal program but does not include an individual that is a beneficiary of such program. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City’s Community Development Department did not report awards granted to subrecipients for the HOPWA program by the end of the month following the month in which the City awarded the subrecipient award that is greater than or equal to $30,000 as required by FFATA. FFATA requires the City to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee DUNS/UEI number 3. Amount of subaward 4. Subaward obligation/action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that the City did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. During our testwork of four subawards, we also noted reporting exceptions as subawards were not reported in the required time. Cause The condition found was due to the City not reporting any amounts passed through to subrecipients for the period from July 2022 to June 2023, as the responsible officials were not aware of the reporting timeline requirements. As a result, all subawards were reported on a one-year lag. Effect Failure to submit all subaward amounts passed through to subrecipients and subcontractors under subawards as defined by 2 CFR 200.1 in the City’s FFATA reporting could result in the City reporting inaccurate and incomplete amounts to the federal government Questioned Costs None Recommendation We recommend that the City review and enhance its policies, procedures, and internal controls to ensure that all amounts passed through to subrecipients under subawards as defined in 2 CFR 200.1 are reported in accordance with the FFATA federal regulations. In addition, we recommend that the City use obligation date for FFATA reporting. Views of Responsible Officials and Corrective Actions HOPWA contracts have typically been obligated over the course of several or more months, as some subrecipients operate in different ways. Going forward, the City will use the contract start date (7/1) as the Obligation date, and will submit the FFATA report accordingly. Implementation Date 8/31/2024 (representing the end of the month following the obligation of funds). Responsible Officials Robert Keller, Project Planner, Cambridge Community Development Department, and Judith Tumusiime, Federal Grants Manager, Cambridge Community Development Department

Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Federal Agency: Housing and Urban Development Federal Award Numbers: MAH22-F005, MAH20-F005, and MAH21-F005 Award Year: July 1, 2022–June 30, 2023 Performance Reporting Type of finding: Material weakness and material noncompliance Prior-year finding: No Statistically valid sample: No Criteria Performance Reporting for the HOPWA Consolidated Annual Performance and Evaluation Report Per HUD, the Consolidated Annual Performance and Evaluation Report (CAPER) provides annual performance reporting on client outputs and outcomes that enables an assessment of grantee performance in achieving the housing stability outcome measure. The CAPER fulfills statutory and regulatory program reporting requirements and provides the grantee and HUD with the necessary information to assess the overall program performance and accomplishments against planned goals and objectives. HOPWA formula grantees are required to submit a CAPER demonstrating coordination with other Consolidated Plan resources. HUD uses the CAPER data to obtain essential information on grant activities, project sponsors, housing sites, units and households, and beneficiaries (which includes racial and ethnic data on program participants). The Consolidated Plan Management Process (CPMP) tool provides an optional tool to integrate the reporting of HOPWA-specific activities with other planning and reporting on Consolidated Plan activities. In accordance with 25 CFR 574.520(a), the City must submit a CAPER to HUD within 90 days of the end of each 12-month program year until all Grant Funds are expended. Key line items of the CAPER include amount of HOPWA funds expended with HOPWA in the program year for each HOPWA-eligible activity. Auditor should review Part 3 Accomplishment Data Planned Goal and Actual Outputs, Table 1 HOPWA Performance Planned Goal and Actual Outputs, Column f HOPWA Actual funds in the CAPER, and Part 3C Summary Overview of Grant Activities Performance and Expenditure Information, Table 1 Performance and Expenditure Information by Activity Type, Column 2 Outputs: Amount of HOPWA Funds Expended. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: – CAPER report is submitted to HUD within 90 days of the end of the 12-month program year. – Review of subrecipient’s CAPER to ensure complete and accurate reporting over key line items. The City failed to submit the CAPER that covers the period from July 1, 2021 to June 30, 2022 to HUD. The report is due to HUD by September 30, 2022. Additionally, the City has been unable to provide documentation that the subrecipient's CAPER has been reconciled to the Integrated Disbursement and Information System (IDIS). Cause Subrecipients are required to submit their individual CAPER reports to the City prior to the City submitting its report to HUD. The City has had difficulty in getting the subrecipients to comply with the CAPER reporting, which is primarily due to staffing issues at the subrecipients. As a result, the City did not submit its CAPER to HUD within the required time-frame. Effect Incomplete information from its subrecipients has resulted in the City’s inability to properly comply with HUD’s CAPER reporting requirements. Questioned Costs Not determinable Recommendation We recommend that the City review and enhance its policies, procedures, and internal controls to ensure that all subrecipient CAPER reports are reconciled to the IDIS system and submitted to HUD within 90 days of year-end. Views of Responsible Officials and Corrective Actions The FY22 CAPER was submitted to HUD on June 11, 2024. City will continue to work with all HOPWA subrecipients to ensure that a complete and accurate CAPER is completed in the appropriate format as required by HUD. This will include a focus on inputting the correct (eg, actual expended vs. award amount) funding amount. Implementation Date Beginning with CAPERs submitted for the FY ending 6/30/2024 (City 2024, Federal 2023). Responsible Officials Robert Keller, Project Planner, Cambridge Community Development Department, and Judith Tumusiime, Federal Grants Manager, Cambridge Community Development Department

Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Federal Agency: Housing and Urban Development Federal Award Numbers: MAH22-F005, MAH20-F005, and MAH21-F005 Award Year: July 1, 2022–June 30, 2023 Performance Reporting Type of finding: Material weakness and material noncompliance Prior-year finding: No Statistically valid sample: No Criteria Performance Reporting for the HOPWA Consolidated Annual Performance and Evaluation Report Per HUD, the Consolidated Annual Performance and Evaluation Report (CAPER) provides annual performance reporting on client outputs and outcomes that enables an assessment of grantee performance in achieving the housing stability outcome measure. The CAPER fulfills statutory and regulatory program reporting requirements and provides the grantee and HUD with the necessary information to assess the overall program performance and accomplishments against planned goals and objectives. HOPWA formula grantees are required to submit a CAPER demonstrating coordination with other Consolidated Plan resources. HUD uses the CAPER data to obtain essential information on grant activities, project sponsors, housing sites, units and households, and beneficiaries (which includes racial and ethnic data on program participants). The Consolidated Plan Management Process (CPMP) tool provides an optional tool to integrate the reporting of HOPWA-specific activities with other planning and reporting on Consolidated Plan activities. In accordance with 25 CFR 574.520(a), the City must submit a CAPER to HUD within 90 days of the end of each 12-month program year until all Grant Funds are expended. Key line items of the CAPER include amount of HOPWA funds expended with HOPWA in the program year for each HOPWA-eligible activity. Auditor should review Part 3 Accomplishment Data Planned Goal and Actual Outputs, Table 1 HOPWA Performance Planned Goal and Actual Outputs, Column f HOPWA Actual funds in the CAPER, and Part 3C Summary Overview of Grant Activities Performance and Expenditure Information, Table 1 Performance and Expenditure Information by Activity Type, Column 2 Outputs: Amount of HOPWA Funds Expended. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: – CAPER report is submitted to HUD within 90 days of the end of the 12-month program year. – Review of subrecipient’s CAPER to ensure complete and accurate reporting over key line items. The City failed to submit the CAPER that covers the period from July 1, 2021 to June 30, 2022 to HUD. The report is due to HUD by September 30, 2022. Additionally, the City has been unable to provide documentation that the subrecipient's CAPER has been reconciled to the Integrated Disbursement and Information System (IDIS). Cause Subrecipients are required to submit their individual CAPER reports to the City prior to the City submitting its report to HUD. The City has had difficulty in getting the subrecipients to comply with the CAPER reporting, which is primarily due to staffing issues at the subrecipients. As a result, the City did not submit its CAPER to HUD within the required time-frame. Effect Incomplete information from its subrecipients has resulted in the City’s inability to properly comply with HUD’s CAPER reporting requirements. Questioned Costs Not determinable Recommendation We recommend that the City review and enhance its policies, procedures, and internal controls to ensure that all subrecipient CAPER reports are reconciled to the IDIS system and submitted to HUD within 90 days of year-end. Views of Responsible Officials and Corrective Actions The FY22 CAPER was submitted to HUD on June 11, 2024. City will continue to work with all HOPWA subrecipients to ensure that a complete and accurate CAPER is completed in the appropriate format as required by HUD. This will include a focus on inputting the correct (eg, actual expended vs. award amount) funding amount. Implementation Date Beginning with CAPERs submitted for the FY ending 6/30/2024 (City 2024, Federal 2023). Responsible Officials Robert Keller, Project Planner, Cambridge Community Development Department, and Judith Tumusiime, Federal Grants Manager, Cambridge Community Development Department

Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Federal Agency: U.S. Department of Treasury Federal Award Number: NA Award Year: July 1, 2022–June 30, 2023 Suspension and Debarment Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria The 2 CFR sections 180.215 and 180.220 provide the principles to be applied to ensure nonfederal entities are not contracting with or making subawards under covered transactions to parties that are suspended or debarred. Also, when a nonfederal entity enters into a covered transaction with an entity at a lower tier, the nonfederal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition When establishing contracts for subrecipients under the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF), the City requires that standard contract language be included to address the applicable suspension and debarment requirements. During fiscal year 2023, the required contract language was not included within the subrecipient contracts executed for the CSLFRF program. Additionally, the City did not verify that its subrecipients were not suspended or debarred through the System for Award Management (SAM) or include self-certifications from the vendor/subrecipient during the contracting process. During our audit, we noted five of seven vendors and four of four subrecipients selected for testing were not checked for suspension and debarment as evidenced via review of the subrecipient contracts. During compliance testing, it was confirmed for all vendors and subrecipients, except for one, that they were not suspended or debarred. The engagement team was unable to determine if Neville Communities, Inc. is suspended or debarred as it is not registered with SAM.gov. Cause The City requires that standard contract language be included in all its subrecipient contracts that addresses suspension and debarment requirements. The City was unaware that the required language was excluded from subrecipient contracts entered into for the CSLFRF program as there was insufficient review of the contracts prior to execution to ensure all required elements were present. Additionally, the City requires that program personnel review SAM.gov to ensure the subrecipient is not suspended or debarred. There was no documentation that this review had occurred prior to entering into a contract with the subrecipient. Effect Lack of formal review of subrecipient contracts and review of entities on SAM could result in the City entering into contracts with prohibited entities. Questioned Costs None Recommendation We recommend the City ensure that required language is included within all subrecipient contracts prior to execution. We also recommend the City review that subrecipients are not suspended or debarred on the SAM website and retain documentation of this check prior to entering into contracts with subrecipients. Views of Responsible Officials and Corrective Actions The City will ensure that subrecipient contracts will include language about suspension and debarment. The City will also download a PDF copy of the subrecipients registration on SAM.GOV showing the subrecipient’s Exclusion Summary Status. Implementation Date FY25 Contracts (7/1/2024) Responsible Officials Michele Kincaid, Assistant Finance Director, and Sharon Pu, Grants Management

Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Federal Agency: U.S. Department of Treasury Federal Award Number: NA Award Year: July 1, 2022–June 30, 2023 Suspension and Debarment Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria The 2 CFR sections 180.215 and 180.220 provide the principles to be applied to ensure nonfederal entities are not contracting with or making subawards under covered transactions to parties that are suspended or debarred. Also, when a nonfederal entity enters into a covered transaction with an entity at a lower tier, the nonfederal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition When establishing contracts for subrecipients under the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF), the City requires that standard contract language be included to address the applicable suspension and debarment requirements. During fiscal year 2023, the required contract language was not included within the subrecipient contracts executed for the CSLFRF program. Additionally, the City did not verify that its subrecipients were not suspended or debarred through the System for Award Management (SAM) or include self-certifications from the vendor/subrecipient during the contracting process. During our audit, we noted five of seven vendors and four of four subrecipients selected for testing were not checked for suspension and debarment as evidenced via review of the subrecipient contracts. During compliance testing, it was confirmed for all vendors and subrecipients, except for one, that they were not suspended or debarred. The engagement team was unable to determine if Neville Communities, Inc. is suspended or debarred as it is not registered with SAM.gov. Cause The City requires that standard contract language be included in all its subrecipient contracts that addresses suspension and debarment requirements. The City was unaware that the required language was excluded from subrecipient contracts entered into for the CSLFRF program as there was insufficient review of the contracts prior to execution to ensure all required elements were present. Additionally, the City requires that program personnel review SAM.gov to ensure the subrecipient is not suspended or debarred. There was no documentation that this review had occurred prior to entering into a contract with the subrecipient. Effect Lack of formal review of subrecipient contracts and review of entities on SAM could result in the City entering into contracts with prohibited entities. Questioned Costs None Recommendation We recommend the City ensure that required language is included within all subrecipient contracts prior to execution. We also recommend the City review that subrecipients are not suspended or debarred on the SAM website and retain documentation of this check prior to entering into contracts with subrecipients. Views of Responsible Officials and Corrective Actions The City will ensure that subrecipient contracts will include language about suspension and debarment. The City will also download a PDF copy of the subrecipients registration on SAM.GOV showing the subrecipient’s Exclusion Summary Status. Implementation Date FY25 Contracts (7/1/2024) Responsible Officials Michele Kincaid, Assistant Finance Director, and Sharon Pu, Grants Management

Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Federal Agency: U.S. Department of Treasury Federal Award Number: NA Award Year: July 1, 2022–June 30, 2023 Subrecipient Monitoring Type of finding: Material weakness and noncompliance Prior-year finding: Yes Statistically valid sample: No Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. During our audit, we noted that audited financial statements were obtained for the four subrecipients selected for testing, but there was no documentation to evidence the nature and extent of the City’s review of the audit reports obtained. Additionally, a documented risk assessment was not performed by the City over the four subrecipients selected for testing prior to entering into a contract. Cause The City requires that audited financial statements are obtained for subrecipients, but there is no checklist or formal documentation required to indicate what should be reviewed when reviewing the audit reports to ensure compliance with subrecipient monitoring requirements. Additionally, the City requires a risk assessment be completed over each subrecipient. However, due to time constraints, a risk assessment was not completed or documented. Effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned Costs None Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining subrecipient audit reports to ensure required monitoring procedures are performed and well documented. Views of Responsible Officials and Corrective Actions The City will use a subrecipient audit certification form and a subrecipient risk assessment questionnaire to evaluate a subrecipient's risk/experience with federal funds as well as assess their federal funding threshold for having a single audit. Implementation Date FY25 Contracts (7/1/2024) Responsible Officials Michele Kincaid, Assistant Finance Director, and Sharon Pu, Grants Management

Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Federal Agency: U.S. Department of Treasury Federal Award Number: NA Award Year: July 1, 2022–June 30, 2023 Subrecipient Monitoring Type of finding: Material weakness and noncompliance Prior-year finding: Yes Statistically valid sample: No Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. During our audit, we noted that audited financial statements were obtained for the four subrecipients selected for testing, but there was no documentation to evidence the nature and extent of the City’s review of the audit reports obtained. Additionally, a documented risk assessment was not performed by the City over the four subrecipients selected for testing prior to entering into a contract. Cause The City requires that audited financial statements are obtained for subrecipients, but there is no checklist or formal documentation required to indicate what should be reviewed when reviewing the audit reports to ensure compliance with subrecipient monitoring requirements. Additionally, the City requires a risk assessment be completed over each subrecipient. However, due to time constraints, a risk assessment was not completed or documented. Effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned Costs None Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining subrecipient audit reports to ensure required monitoring procedures are performed and well documented. Views of Responsible Officials and Corrective Actions The City will use a subrecipient audit certification form and a subrecipient risk assessment questionnaire to evaluate a subrecipient's risk/experience with federal funds as well as assess their federal funding threshold for having a single audit. Implementation Date FY25 Contracts (7/1/2024) Responsible Officials Michele Kincaid, Assistant Finance Director, and Sharon Pu, Grants Management

Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Federal Agency: U.S. Department of Treasury Federal Award Number: SLFRP1982 Award Year: July 1, 2022–June 30, 2023 Reporting Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria The 2 CFR 200.328 and 31 CFR section 35.4 require quarterly and annual reporting of the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) grant. The report focuses on the following key line items: current-period obligation, cumulative obligation, current-period expenditure, and cumulative expenditures. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our audit, we selected the December 31, 2022 and June 30, 2023 report for testing. We noted that the current-period obligations, cumulative obligations, current-period expenditures, and cumulative expenditures contained on these reports could not be reconciled to the City’s books and records. As such, the engagement team was unable to determine if the amounts included in these key line items were complete and accurate. Cause PeopleSoft reports that were used to prepare the CSLFRF reports were not retained by the City. As PeopleSoft continuously updates, the detail used to prepare these reports could not be reproduced by the City. Effect Lack of document retention and reconciliation from the general ledger system to the CSLFRF could result in inaccurate reporting to the US Department of Treasury. Questioned Costs None Recommendation We recommend the City ensures proper document retention and complete reconciliations for how quarterly and annual reports are compiled. Views of Responsible Officials and Corrective Actions The Finance department will document the reconciliation of the City’s GL ARPA expenditures and obligations to the Department of Treasury ARPA reporting portal report both quarterly and annually. All reconciling adjustments and GL report documentation will be properly retained. Implementation Date 7/1/2023 Responsible Officials Michele Kincaid, Assistant Finance Director, and Sharon Pu, Grants Management

Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Federal Agency: U.S. Department of Treasury Federal Award Number: SLFRP1982 Award Year: July 1, 2022–June 30, 2023 Reporting Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria The 2 CFR 200.328 and 31 CFR section 35.4 require quarterly and annual reporting of the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) grant. The report focuses on the following key line items: current-period obligation, cumulative obligation, current-period expenditure, and cumulative expenditures. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our audit, we selected the December 31, 2022 and June 30, 2023 report for testing. We noted that the current-period obligations, cumulative obligations, current-period expenditures, and cumulative expenditures contained on these reports could not be reconciled to the City’s books and records. As such, the engagement team was unable to determine if the amounts included in these key line items were complete and accurate. Cause PeopleSoft reports that were used to prepare the CSLFRF reports were not retained by the City. As PeopleSoft continuously updates, the detail used to prepare these reports could not be reproduced by the City. Effect Lack of document retention and reconciliation from the general ledger system to the CSLFRF could result in inaccurate reporting to the US Department of Treasury. Questioned Costs None Recommendation We recommend the City ensures proper document retention and complete reconciliations for how quarterly and annual reports are compiled. Views of Responsible Officials and Corrective Actions The Finance department will document the reconciliation of the City’s GL ARPA expenditures and obligations to the Department of Treasury ARPA reporting portal report both quarterly and annually. All reconciling adjustments and GL report documentation will be properly retained. Implementation Date 7/1/2023 Responsible Officials Michele Kincaid, Assistant Finance Director, and Sharon Pu, Grants Management

Program: Special Education Cluster (IDEA) ALN #: 84.027 Federal Agency: Department of Education Federal Award Number: NA Award Year: July 1, 2022–June 30, 2023 Period of Performance Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria Per Part 4 of the Compliance Supplement, LEAs and SEAs must obligate funds during the 27 months, extending from July 1 of the fiscal year for which the funds were appropriated through September 30 of the second following fiscal year. This maximum period includes a 15-month period of initial availability plus a 12-month period for carryover. For example, funds from the fiscal year 2019 appropriation initially became available on July 1, 2019 and may be obligated by the grantee and subgrantee through September 30, 2021 (Section 421(b) of GEPA (20 USC 1225(b)); 34 CFR sections 76.703 through 76.710). According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During testing over period of performance for the IDEA program, 14 samples were selected for testwork. For four selections (all related to the same vendor), we noted that expenditures were charged to the SC23605 grant 52 days prior to the grant’s start date. The expenditures were invoiced on August 1, 2022, and the grant’s period of performance began on September 22, 2022 (the date the Massachusetts Department of Education notified the City of this grant’s effective date). Cause The cause of the noncompliance relates to an error assigning POs for a certain vendor. POs created for this vendor for July 2022 tuition were mistakenly charged to the incorrect grant. A lack of review over charges to individual grants and programs has caused the City to charge expenses to the IDEA grant outside of its period of performance. Questioned Costs Not determinable Recommendation We recommend the City establish more precise controls over the review and approval of invoices, specifically relating to the review and approval over the direct grant that the expense will be charged to. Views of Responsible Officials and Corrective Actions Cambridge Public Schools' CFO or Grants Coordinator will review and sign-off on all tuition requisitions that will be charged to grants to confirm the grant approval date and compliance with the period of performance. Implementation Date The new approval process will be in place by July 1, 2024. Responsible Officials Dr. Karyn Grace, Assistant Superintendent of Student Services, Cambridge Public Schools, Ivy Washington, Chief Financial Officer, Cambridge School Department, and Lindsay Smythe, Grant Coordinator, Cambridge School Department

Program: Special Education Cluster (IDEA) ALN #: 84.027 Federal Agency: Department of Education Federal Award Number: NA Award Year: July 1, 2022–June 30, 2023 Period of Performance Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria Per Part 4 of the Compliance Supplement, LEAs and SEAs must obligate funds during the 27 months, extending from July 1 of the fiscal year for which the funds were appropriated through September 30 of the second following fiscal year. This maximum period includes a 15-month period of initial availability plus a 12-month period for carryover. For example, funds from the fiscal year 2019 appropriation initially became available on July 1, 2019 and may be obligated by the grantee and subgrantee through September 30, 2021 (Section 421(b) of GEPA (20 USC 1225(b)); 34 CFR sections 76.703 through 76.710). According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During testing over period of performance for the IDEA program, 14 samples were selected for testwork. For four selections (all related to the same vendor), we noted that expenditures were charged to the SC23605 grant 52 days prior to the grant’s start date. The expenditures were invoiced on August 1, 2022, and the grant’s period of performance began on September 22, 2022 (the date the Massachusetts Department of Education notified the City of this grant’s effective date). Cause The cause of the noncompliance relates to an error assigning POs for a certain vendor. POs created for this vendor for July 2022 tuition were mistakenly charged to the incorrect grant. A lack of review over charges to individual grants and programs has caused the City to charge expenses to the IDEA grant outside of its period of performance. Questioned Costs Not determinable Recommendation We recommend the City establish more precise controls over the review and approval of invoices, specifically relating to the review and approval over the direct grant that the expense will be charged to. Views of Responsible Officials and Corrective Actions Cambridge Public Schools' CFO or Grants Coordinator will review and sign-off on all tuition requisitions that will be charged to grants to confirm the grant approval date and compliance with the period of performance. Implementation Date The new approval process will be in place by July 1, 2024. Responsible Officials Dr. Karyn Grace, Assistant Superintendent of Student Services, Cambridge Public Schools, Ivy Washington, Chief Financial Officer, Cambridge School Department, and Lindsay Smythe, Grant Coordinator, Cambridge School Department