Audit 311568

Special Tests and Provisions Federal Department – U.S. Department of Housing and Urban Development Federal Award Identification Number and Year: E-20-UW-17-0001 and 2020 E-22-UC-17-0001 and 2022 Emergency Solutions Grant Program, Federal Assistance Listing #14.231 County Department – Department of Planning and Development Finding 2023 – 001 CRITERIA 24 CFR Part 576, Emergency Solutions Grants Program, Subpart C - Award and Use of Funds, Section 576.203 Obligations, expenditure, and payments requirements (c) Payments to Subrecipients states, “The recipient must pay each subrecipient for allowable costs within 30 days after receiving the subrecipient’s complete payment request. This requirement also applies to each subrecipient that is a unit of generalpurpose local government.” CONDITION During the current audit period, the Cook County Department of Planning and Development (DPD) did not adequately comply with its special tests and provisions requirements in accordance with federal regulations. CAUSE Based on discussions with management, this finding occurred due to the DPD receiving invoices from subrecipients that had missing support documentation or included incorrect support documentation. The DPD has hired new staff that will assist with training subrecipients on submission of invoices. EFFECT The failure to pay each subrecipient for allowable costs within 30 days after receiving the subrecipient’s complete payment request is a violation of federal regulations. This could impact the subrecipient’s ability to adequately perform its programmatic responsibilities under the program. QUESTIONED COSTS None. CONTEXT During the prior audit period, we noted four instances (of 44 subrecipients’ expenditures) where payments to the subrecipients were not made within 30 days after receiving the subrecipient’s complete payment request, as required. This resulted in the 2022 audit finding and subsequent corrective action planned prepared by DPD to address the finding, which included corrective action planning to be implemented on future grants as this grant will close in September 2023. During the current audit period, we received DPD’s current year status of the prior audit finding, noting that the corrective action plan discussed and implemented did not address the issues which were noted in the 2022 audit finding. Furthermore, we tested 40 subrecipients’ expenditures, noted four instances where payments to the subrecipients were not made within 30 days after receiving the subrecipient’s complete payment request, as required. The payments were submitted late, ranging from 13 to 74 days late. Also, we noted that for two of these subrecipients’ expenditures the payment request occurred after September 2023. IDENTIFICATION OF REPEATED FINDINGS Repeated (Prior Finding No. 2022-002) RECOMMENDATION We recommend that DPD develop and implement procedures to ensure payments to subrecipients are made within 30 days after receipt of the subrecipients complete payment request, as required. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 53.

Reporting Federal Department – U.S. Department of Housing and Urban Development Federal Award Identification Number and Year(s): B-13BUS-17-0001 and 2013 CDBG - Disaster Recovery Grants - Pub. L. No. 113-2 Cluster: Hurricane Sandy Community Development Block Grant Disaster Recovery Grants (CDBG-DR), Federal Assistance Listing #14.269 County Department – Department of Planning and Development Finding 2023 – 002 CRITERIA Per the 2013 Funding approval/agreement with the U.S. Department of Housing and Urban Development (HUD), Item 6 states, “The grantee shall comply with requirements established by the Office of Management and Budget (OMB) concerning the Dun and Bradstreet Data Universal Numbering System (DUNS), the System or Award Management (SAM) Central Contractor Registration database, and the Federal Funding Accountability and Transparency Act, including Appendix A to Part 25 of the Financial Assistance Use of Universal Identifier and Central Contractor Registration, 75 Fed. Reg. 55671 (Sept. 14, 2010) (to be codified at 2 CFR part 25) and Appendix A to Part 170 of the Requirements for Federal Funding Accountability and Transparency Act Implementation, 75 Fed. Reg. 55663 (Sept. 14, 2010) (codified at 2 CFR part 170).” The Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS) website states, “FSRS is the reporting tool Federal prime awardees (i.e. prime contractors and prime grants recipients) use to capture and report subaward and executive compensation data regarding their first-tier subawards to meet the FFATA reporting requirements. Prime contract awardees will report against subcontracts awarded, and prime grant awardees will report against sub-grants awarded.” In addition, “Prime Grant Recipients awarded a new Federal grant greater than or equal to $30,000 as of October 1, 2010 are subject to FFATA sub-award reporting requirements as outlined in the Office of Management and Budgets guidance issued August 27, 2010. The prime awardee is required to file a FFATA sub-award report by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000.” In accordance with 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, Appendix A, Award Term, b. 1. Reporting total compensation of recipient executives for non-Federal entities, states, “You must report total compensation for each of your five most highly compensated executives for the preceding completed fiscal year, if - i. The total Federal funding authorized to date under this Federal award equals or exceeds $30,000 as defined in 2 CFR 170.320; ii. in the preceding fiscal year, you received— (A) 80 percent or more of your annual gross revenues from Federal procurement contracts (and subcontracts) and Federal financial assistance subject to the Transparency Act, as defined at 2 CFR 170.320 (and subawards), and (B) $25,000,000 or more in annual gross revenues from Federal procurement contracts (and subcontracts) and Federal financial assistance subject to the Transparency Act, as defined at 2 CFR 170.320 (and subawards); and, iii. The public does not have access to information about the compensation of the executives through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986. 2. Where and when to report. You must report executive total compensation described in paragraph b.1. of this award term: i. As part of your registration profile at https://www.sam.gov. ii. By the end of the month following the month in which this award is made, and annually thereafter.” CONDITION During the current audit period, the Cook County Department of Planning and Development (DPD) did not comply with its FFATA reporting requirements as outlined in its grant agreement and federal regulations. CAUSE Based on discussions with management, this finding occurred due to not reporting FFATA information for one subrecipient that was awarded in fiscal year 2023 for the CDBG-DR grant. EFFECT Failure to prepare and submit required reports is a violation of federal regulations and impairs the grantor agency’s ability to adequately monitor the program activities/federally funded program. QUESTIONED COSTS None. CONTEXT We noted a total of 37 subrecipients received a sub-award greater than $30,000 in the prior fiscal year(s). Of these 37 subrecipients, we noted 7 had grant disbursements during the County’s fiscal year 2023 and hence, should have been subject to FFATA Subaward reporting. Based on our follow up discussions with DPD personnel, of the 37 subrecipients awarded, only one (1) subrecipient received a new sub-award during fiscal year 2023. Consequently, we were not provided with any evidence that DPD submitted any reporting information as required under the FFATA Subaward Reporting, in the FSRS system. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend that DPD develop and implement procedures to ensure required reports are prepared, reviewed, and submitted in a timely manner and in compliance with its grant agreement and federal regulations. Per federal regulations, prime grant recipients awarded a new federal grant greater than or equal to $30,000 as of October 1, 2010, are subject to FFATA sub-award reporting requirements as outlined in the Office of Management and Budgets guidance issued August 27, 2010. The prime awardee (i.e., County DPD) is required to file a FFATA sub-award report by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If any federal requirement is unclear, we recommend that DPD reach out to its grantor agency for additional clarification and guidance. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 53.

Special Tests and Provisions (Reporting) Federal Department – U.S. Department of Transportation Pass-through Illinois Department of Transportation Highway Planning and Construction, Federal Assistance Listing #20.205 County Department – Department of Transportation and Highway Finding 2023 – 003 CRITERIA As required by the grant agreement(s) with the State of Illinois, Department of Transportation (IDOT), grantee agrees to submit periodic financial and performance reporting on the approved IDOT BoBS 2832 form. Grantee shall file quarterly BoBS 2832 reports with grantor describing the expenditure(s) of the funds and performance measures related thereto. Quarterly reports must be submitted no later than 30 calendar days following the period covered by the report. For the purpose of reconciliation, the grantee must submit a BoBS 2832 report for the period ending 11/30. BoBS 2832 report marked as "Final Report" must be submitted to the grantor 60 days after the end date of the agreement. Failure to submit the required BoBS 2832 reports may cause a delay or suspension of funding. The grant agreement also states that “pursuant to 2 CFR 200.328, periodic performance reports shall be submitted no later than 30 calendar days following the period covered by the report.” CONDITION During the current audit period, Cook County Department of Transportation and Highway (DOTH) did not comply with the reporting requirements as outlined in its grant agreement(s). CAUSE Based on discussions with management, this finding was the result of working with consultants who had not previously submitted reports of this nature. The reports they produced required multiple revisions due to errors which lead to DOTH failing to submit the reports in a timely manner. EFFECT Failure to submit reports in a timely manner could impair the grantor agency’s ability to monitor program activities and could result in the loss of grant funding. Also, the failure to ensure accurate amounts are reported could result in the over-reporting and future spending of grant funds. QUESTIONED COSTS None. CONTEXT During our review of seven reports submitted (five quarterly reports and two annual BoBS periodic performance and financial) under three DOTH grants, we noted the 2 annual reports were submitted late. See Finding for chart/table. In addition, for grant C-91-381-19 report, we noted that the “remaining balance available” amount included in the report was overstated by $15,924. This occurred due to a recalculation error in the report. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend that DOTH develop and implement procedures to ensure reports are submitted in a timely manner and in compliance with its grant agreements. A compliance calendar of all grants reporting due dates should be maintained to assist with ensuring compliance with reporting requirements. In addition, we recommend DOTH ensure all amounts included on grant reports are accurately calculated and reported. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 54.

Cash Management Federal Department – U.S. Department of Health and Human Services Federal Award Identification Number and Year: NH75OT000024 and 2021 COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises, Federal Assistance Listing #93.391 County Department – Department of Public Health Finding 2023 – 004 CRITERIA Federal regulations (45 CFR Part 75.305) Payment. (b) (3) states that reimbursement is the preferred method when the requirements in paragraph (b) cannot be met, when the US Department of Health and Human Service (HHS) awarding agency sets a specific condition per Section 75.207 or when the non- Federal entity requests payment by reimbursement. When the reimbursement method is used, the HHS awarding agency or pass-through entity must make payment within 30 calendar days after receipt of the billing, unless the HHS awarding agency or pass-through entity reasonably believes the request to be improper. CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not adequately comply with its cash management requirements in accordance with federal regulations. CAUSE Based on discussions with management, the cause of this finding is due to 1) instances of misplaced and/or lost vendor invoices preventing them from submitting the invoice to Finance for processing, 2) lack of personnel resources and staff turnover resulting in invoice review, approval, and submission delays, 3) vendor/subrecipient contract execution delays, 4) delays in processing invoices due to verification of invoices for a) invoice date, b) description of services, c) amounts requested, d) allowability; if stated information is missing, then invoices are returned to the vendor, accordingly; if invoice submitted to DPH/Cook County Health (CCH) Finance, then the invoices are returned to the program staff. EFFECT The failure to pay each subrecipient for allowable costs within 30 days after receiving the subrecipient’s billing or payment request is a violation of federal regulations. This could impact the subrecipient’s ability to adequately perform its programmatic responsibilities under the program. QUESTIONED COSTS None. CONTEXT We noted DPH does not currently track the receipt date on invoices submitted by the subrecipients. As a result, we were unable to verify if payments to the subrecipients were made within 30 days after receipt of the subrecipient’s billing. To perform our testing, we utilized the invoice date on the billings provided by the subrecipients to determine if payments were made within the 30-day requirement. Specifically, during our test of 24 subrecipients’ expenditures, we noted 15 instances where payments to the subrecipients’ appear to be submitted late, ranging from 2 to 248 days late. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend that DPH develop and implement procedures to ensure payments to subrecipients are made within 30 days after receipt of the subrecipients billing or payment request, as required. Also, we suggest DPH include a date stamp of the receipt date on each invoice to ensure compliance with the 30-day requirement. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 55.

Subrecipient Monitoring Federal Department – U.S. Department of Health and Human Services Federal Award Identification Number and Year: NH75OT000024 and 2021 COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises, Federal Assistance Listing #93.391 County Department – Department of Public Health Finding 2023 – 005 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D—Post Federal Award Requirements Standards for Financial and Program Management, Section 200.332. Requirements for pass-through entities, requires that “All pass-through entities must: (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F—Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in Section 200.208 Specific conditions. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by Section 200.521 Management decision. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in Section 200.425 Audit services. (f) Verify that every subrecipient is audited as required by Subpart F— Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in Section 200.501 Audit requirements. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in Section 200.338 Remedies for noncompliance of this part and in program regulations.” CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not adequately comply with its subrecipient monitoring requirements in accordance with federal regulations. CAUSE Based on discussions with management, the cause of this finding was due to DPH/CCH identifying a consultant agency to conduct the subrecipient monitoring; this was accomplished October 2023. Current Status: These documents were created, shared with the auditor pending management approval; 1) Subrecipient Monitoring Policy 2). Subrecipient Commitment Form 3). Subrecipient Determination Tool 4). Subrecipient Risk Assessment and Monitoring Guide. EFFECT Failure to adequately monitor the activities and performance of a subrecipient could result in Federal awards being used for unauthorized purposes and DPH’s inability to adequately perform risk assessments on its subrecipient(s). QUESTIONED COSTS None. CONTEXT During the prior audit period, we noted 6 instances (of 27 subrecipients), whereby adequate documentation was not maintained to support both the financial and programmatic monitoring of these subrecipients. Also, we noted no evidence of the performance of subrecipients’ risk assessment and whether the subrecipients were required to have a Single audit conducted. This resulted in the 2022 audit finding and subsequent corrective action planned prepared by DPH to address the finding, which was anticipated to be completed by December 31, 2023. During the current audit period, we received DPH’s current year status of the prior audit finding, noting that risk assessment and monitoring will be ongoing during the 2023 Single audit. To assess the current year’s status, we reviewed 5 of 35 subrecipients, noting that risk assessments were conducted in April 2024. We also noted that 4 of the 5 subrecipients reviewed were subject to a Single Audit per the risk assessment documentation. However, we noted no evidence financial monitoring conducted, including whether a Single Audit report was obtained and reviewed by DPH. IDENTIFICATION OF REPEATED FINDINGS Repeated (Prior Finding No. 2022-009) RECOMMENDATION We recommend DPH implement its prior corrective action plan for any future subrecipients awarded under the federal program. Also, procedures should be in place to adequately document financial monitoring conducted, as well as the review of the Single Audit report, as required by federal regulations. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 56.

Subrecipient Monitoring Federal Department – U.S. Department of Health and Human Services Federal Award Identification Number and Year: NU58DP006993 and 2022/2023 COVID-19 - Community Health Workers for Public Health Response and Resilient, Federal Assistance Listing #93.495 County Department – Department of Public Health Finding 2023 – 006 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D—Post Federal Award Requirements Standards for Financial and Program Management, Section 200.332. Requirements for pass-through entities, requires that “All pass-through entities must: (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F—Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in Section 200.208 Specific conditions. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by Section 200.521 Management decision. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in Section 200.425 Audit services. (f) Verify that every subrecipient is audited as required by Subpart F— Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in Section 200.501 Audit requirements. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in Section 200.338 Remedies for noncompliance of this part and in program regulations.” CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not perform adequate monitoring of its subrecipients as required by Federal regulations. CAUSE Based on discussions with management, the cause of this finding was due to DPH/CCH identifying a consultant agency to conduct the subrecipient monitoring; this was accomplished October 2023. Current Status: These documents were created, shared with the auditor pending management approval; 1) Subrecipient Monitoring Policy 2). Subrecipient Commitment Form 3). Subrecipient Determination Tool 4). Subrecipient Risk Assessment and Monitoring Guide. EFFECT Failure to adequately monitor the activities and performance of a subrecipient could result in Federal awards being used for unauthorized purposes and DPH’s inability to adequately perform risk assessments on its subrecipient(s). QUESTIONED COSTS None. CONTEXT During the current audit period, we noted 12 subrecipients were awarded funds. During our review of three (3) subrecipients, we noted the following:  For all three subrecipients, we noted that adequate documentation was not maintained to support the financial monitoring of these subrecipients. Also, no documentation was provided to verify whether the subrecipients were required to have a Single Audit conducted, including DPH’s review of the report, and if applicable, issuance of a management decision on audit findings noted as required by 2 CFR 200.332d(3).  For one subrecipient, we noted documentation was not maintained to support DPH’s evaluation of the subrecipient’s risk of noncompliance and the frequency of monitoring to be conducted by DPH based on the assessed risk. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend DPH implement procedures to ensure that adequate documentation is maintained to support financial monitoring conducted, evaluation of each subrecipient’s risk of noncompliance and review of the Single Audit report, as required by federal regulations. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 56.

Special Tests and Provisions Federal Department – U.S. Department of Housing and Urban Development Federal Award Identification Number and Year: E-20-UW-17-0001 and 2020 E-22-UC-17-0001 and 2022 Emergency Solutions Grant Program, Federal Assistance Listing #14.231 County Department – Department of Planning and Development Finding 2023 – 001 CRITERIA 24 CFR Part 576, Emergency Solutions Grants Program, Subpart C - Award and Use of Funds, Section 576.203 Obligations, expenditure, and payments requirements (c) Payments to Subrecipients states, “The recipient must pay each subrecipient for allowable costs within 30 days after receiving the subrecipient’s complete payment request. This requirement also applies to each subrecipient that is a unit of generalpurpose local government.” CONDITION During the current audit period, the Cook County Department of Planning and Development (DPD) did not adequately comply with its special tests and provisions requirements in accordance with federal regulations. CAUSE Based on discussions with management, this finding occurred due to the DPD receiving invoices from subrecipients that had missing support documentation or included incorrect support documentation. The DPD has hired new staff that will assist with training subrecipients on submission of invoices. EFFECT The failure to pay each subrecipient for allowable costs within 30 days after receiving the subrecipient’s complete payment request is a violation of federal regulations. This could impact the subrecipient’s ability to adequately perform its programmatic responsibilities under the program. QUESTIONED COSTS None. CONTEXT During the prior audit period, we noted four instances (of 44 subrecipients’ expenditures) where payments to the subrecipients were not made within 30 days after receiving the subrecipient’s complete payment request, as required. This resulted in the 2022 audit finding and subsequent corrective action planned prepared by DPD to address the finding, which included corrective action planning to be implemented on future grants as this grant will close in September 2023. During the current audit period, we received DPD’s current year status of the prior audit finding, noting that the corrective action plan discussed and implemented did not address the issues which were noted in the 2022 audit finding. Furthermore, we tested 40 subrecipients’ expenditures, noted four instances where payments to the subrecipients were not made within 30 days after receiving the subrecipient’s complete payment request, as required. The payments were submitted late, ranging from 13 to 74 days late. Also, we noted that for two of these subrecipients’ expenditures the payment request occurred after September 2023. IDENTIFICATION OF REPEATED FINDINGS Repeated (Prior Finding No. 2022-002) RECOMMENDATION We recommend that DPD develop and implement procedures to ensure payments to subrecipients are made within 30 days after receipt of the subrecipients complete payment request, as required. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 53.

Reporting Federal Department – U.S. Department of Housing and Urban Development Federal Award Identification Number and Year(s): B-13BUS-17-0001 and 2013 CDBG - Disaster Recovery Grants - Pub. L. No. 113-2 Cluster: Hurricane Sandy Community Development Block Grant Disaster Recovery Grants (CDBG-DR), Federal Assistance Listing #14.269 County Department – Department of Planning and Development Finding 2023 – 002 CRITERIA Per the 2013 Funding approval/agreement with the U.S. Department of Housing and Urban Development (HUD), Item 6 states, “The grantee shall comply with requirements established by the Office of Management and Budget (OMB) concerning the Dun and Bradstreet Data Universal Numbering System (DUNS), the System or Award Management (SAM) Central Contractor Registration database, and the Federal Funding Accountability and Transparency Act, including Appendix A to Part 25 of the Financial Assistance Use of Universal Identifier and Central Contractor Registration, 75 Fed. Reg. 55671 (Sept. 14, 2010) (to be codified at 2 CFR part 25) and Appendix A to Part 170 of the Requirements for Federal Funding Accountability and Transparency Act Implementation, 75 Fed. Reg. 55663 (Sept. 14, 2010) (codified at 2 CFR part 170).” The Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS) website states, “FSRS is the reporting tool Federal prime awardees (i.e. prime contractors and prime grants recipients) use to capture and report subaward and executive compensation data regarding their first-tier subawards to meet the FFATA reporting requirements. Prime contract awardees will report against subcontracts awarded, and prime grant awardees will report against sub-grants awarded.” In addition, “Prime Grant Recipients awarded a new Federal grant greater than or equal to $30,000 as of October 1, 2010 are subject to FFATA sub-award reporting requirements as outlined in the Office of Management and Budgets guidance issued August 27, 2010. The prime awardee is required to file a FFATA sub-award report by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000.” In accordance with 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, Appendix A, Award Term, b. 1. Reporting total compensation of recipient executives for non-Federal entities, states, “You must report total compensation for each of your five most highly compensated executives for the preceding completed fiscal year, if - i. The total Federal funding authorized to date under this Federal award equals or exceeds $30,000 as defined in 2 CFR 170.320; ii. in the preceding fiscal year, you received— (A) 80 percent or more of your annual gross revenues from Federal procurement contracts (and subcontracts) and Federal financial assistance subject to the Transparency Act, as defined at 2 CFR 170.320 (and subawards), and (B) $25,000,000 or more in annual gross revenues from Federal procurement contracts (and subcontracts) and Federal financial assistance subject to the Transparency Act, as defined at 2 CFR 170.320 (and subawards); and, iii. The public does not have access to information about the compensation of the executives through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986. 2. Where and when to report. You must report executive total compensation described in paragraph b.1. of this award term: i. As part of your registration profile at https://www.sam.gov. ii. By the end of the month following the month in which this award is made, and annually thereafter.” CONDITION During the current audit period, the Cook County Department of Planning and Development (DPD) did not comply with its FFATA reporting requirements as outlined in its grant agreement and federal regulations. CAUSE Based on discussions with management, this finding occurred due to not reporting FFATA information for one subrecipient that was awarded in fiscal year 2023 for the CDBG-DR grant. EFFECT Failure to prepare and submit required reports is a violation of federal regulations and impairs the grantor agency’s ability to adequately monitor the program activities/federally funded program. QUESTIONED COSTS None. CONTEXT We noted a total of 37 subrecipients received a sub-award greater than $30,000 in the prior fiscal year(s). Of these 37 subrecipients, we noted 7 had grant disbursements during the County’s fiscal year 2023 and hence, should have been subject to FFATA Subaward reporting. Based on our follow up discussions with DPD personnel, of the 37 subrecipients awarded, only one (1) subrecipient received a new sub-award during fiscal year 2023. Consequently, we were not provided with any evidence that DPD submitted any reporting information as required under the FFATA Subaward Reporting, in the FSRS system. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend that DPD develop and implement procedures to ensure required reports are prepared, reviewed, and submitted in a timely manner and in compliance with its grant agreement and federal regulations. Per federal regulations, prime grant recipients awarded a new federal grant greater than or equal to $30,000 as of October 1, 2010, are subject to FFATA sub-award reporting requirements as outlined in the Office of Management and Budgets guidance issued August 27, 2010. The prime awardee (i.e., County DPD) is required to file a FFATA sub-award report by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If any federal requirement is unclear, we recommend that DPD reach out to its grantor agency for additional clarification and guidance. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 53.

Special Tests and Provisions (Reporting) Federal Department – U.S. Department of Transportation Pass-through Illinois Department of Transportation Highway Planning and Construction, Federal Assistance Listing #20.205 County Department – Department of Transportation and Highway Finding 2023 – 003 CRITERIA As required by the grant agreement(s) with the State of Illinois, Department of Transportation (IDOT), grantee agrees to submit periodic financial and performance reporting on the approved IDOT BoBS 2832 form. Grantee shall file quarterly BoBS 2832 reports with grantor describing the expenditure(s) of the funds and performance measures related thereto. Quarterly reports must be submitted no later than 30 calendar days following the period covered by the report. For the purpose of reconciliation, the grantee must submit a BoBS 2832 report for the period ending 11/30. BoBS 2832 report marked as "Final Report" must be submitted to the grantor 60 days after the end date of the agreement. Failure to submit the required BoBS 2832 reports may cause a delay or suspension of funding. The grant agreement also states that “pursuant to 2 CFR 200.328, periodic performance reports shall be submitted no later than 30 calendar days following the period covered by the report.” CONDITION During the current audit period, Cook County Department of Transportation and Highway (DOTH) did not comply with the reporting requirements as outlined in its grant agreement(s). CAUSE Based on discussions with management, this finding was the result of working with consultants who had not previously submitted reports of this nature. The reports they produced required multiple revisions due to errors which lead to DOTH failing to submit the reports in a timely manner. EFFECT Failure to submit reports in a timely manner could impair the grantor agency’s ability to monitor program activities and could result in the loss of grant funding. Also, the failure to ensure accurate amounts are reported could result in the over-reporting and future spending of grant funds. QUESTIONED COSTS None. CONTEXT During our review of seven reports submitted (five quarterly reports and two annual BoBS periodic performance and financial) under three DOTH grants, we noted the 2 annual reports were submitted late. See Finding for chart/table. In addition, for grant C-91-381-19 report, we noted that the “remaining balance available” amount included in the report was overstated by $15,924. This occurred due to a recalculation error in the report. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend that DOTH develop and implement procedures to ensure reports are submitted in a timely manner and in compliance with its grant agreements. A compliance calendar of all grants reporting due dates should be maintained to assist with ensuring compliance with reporting requirements. In addition, we recommend DOTH ensure all amounts included on grant reports are accurately calculated and reported. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 54.

Cash Management Federal Department – U.S. Department of Health and Human Services Federal Award Identification Number and Year: NH75OT000024 and 2021 COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises, Federal Assistance Listing #93.391 County Department – Department of Public Health Finding 2023 – 004 CRITERIA Federal regulations (45 CFR Part 75.305) Payment. (b) (3) states that reimbursement is the preferred method when the requirements in paragraph (b) cannot be met, when the US Department of Health and Human Service (HHS) awarding agency sets a specific condition per Section 75.207 or when the non- Federal entity requests payment by reimbursement. When the reimbursement method is used, the HHS awarding agency or pass-through entity must make payment within 30 calendar days after receipt of the billing, unless the HHS awarding agency or pass-through entity reasonably believes the request to be improper. CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not adequately comply with its cash management requirements in accordance with federal regulations. CAUSE Based on discussions with management, the cause of this finding is due to 1) instances of misplaced and/or lost vendor invoices preventing them from submitting the invoice to Finance for processing, 2) lack of personnel resources and staff turnover resulting in invoice review, approval, and submission delays, 3) vendor/subrecipient contract execution delays, 4) delays in processing invoices due to verification of invoices for a) invoice date, b) description of services, c) amounts requested, d) allowability; if stated information is missing, then invoices are returned to the vendor, accordingly; if invoice submitted to DPH/Cook County Health (CCH) Finance, then the invoices are returned to the program staff. EFFECT The failure to pay each subrecipient for allowable costs within 30 days after receiving the subrecipient’s billing or payment request is a violation of federal regulations. This could impact the subrecipient’s ability to adequately perform its programmatic responsibilities under the program. QUESTIONED COSTS None. CONTEXT We noted DPH does not currently track the receipt date on invoices submitted by the subrecipients. As a result, we were unable to verify if payments to the subrecipients were made within 30 days after receipt of the subrecipient’s billing. To perform our testing, we utilized the invoice date on the billings provided by the subrecipients to determine if payments were made within the 30-day requirement. Specifically, during our test of 24 subrecipients’ expenditures, we noted 15 instances where payments to the subrecipients’ appear to be submitted late, ranging from 2 to 248 days late. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend that DPH develop and implement procedures to ensure payments to subrecipients are made within 30 days after receipt of the subrecipients billing or payment request, as required. Also, we suggest DPH include a date stamp of the receipt date on each invoice to ensure compliance with the 30-day requirement. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 55.

Subrecipient Monitoring Federal Department – U.S. Department of Health and Human Services Federal Award Identification Number and Year: NH75OT000024 and 2021 COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises, Federal Assistance Listing #93.391 County Department – Department of Public Health Finding 2023 – 005 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D—Post Federal Award Requirements Standards for Financial and Program Management, Section 200.332. Requirements for pass-through entities, requires that “All pass-through entities must: (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F—Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in Section 200.208 Specific conditions. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by Section 200.521 Management decision. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in Section 200.425 Audit services. (f) Verify that every subrecipient is audited as required by Subpart F— Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in Section 200.501 Audit requirements. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in Section 200.338 Remedies for noncompliance of this part and in program regulations.” CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not adequately comply with its subrecipient monitoring requirements in accordance with federal regulations. CAUSE Based on discussions with management, the cause of this finding was due to DPH/CCH identifying a consultant agency to conduct the subrecipient monitoring; this was accomplished October 2023. Current Status: These documents were created, shared with the auditor pending management approval; 1) Subrecipient Monitoring Policy 2). Subrecipient Commitment Form 3). Subrecipient Determination Tool 4). Subrecipient Risk Assessment and Monitoring Guide. EFFECT Failure to adequately monitor the activities and performance of a subrecipient could result in Federal awards being used for unauthorized purposes and DPH’s inability to adequately perform risk assessments on its subrecipient(s). QUESTIONED COSTS None. CONTEXT During the prior audit period, we noted 6 instances (of 27 subrecipients), whereby adequate documentation was not maintained to support both the financial and programmatic monitoring of these subrecipients. Also, we noted no evidence of the performance of subrecipients’ risk assessment and whether the subrecipients were required to have a Single audit conducted. This resulted in the 2022 audit finding and subsequent corrective action planned prepared by DPH to address the finding, which was anticipated to be completed by December 31, 2023. During the current audit period, we received DPH’s current year status of the prior audit finding, noting that risk assessment and monitoring will be ongoing during the 2023 Single audit. To assess the current year’s status, we reviewed 5 of 35 subrecipients, noting that risk assessments were conducted in April 2024. We also noted that 4 of the 5 subrecipients reviewed were subject to a Single Audit per the risk assessment documentation. However, we noted no evidence financial monitoring conducted, including whether a Single Audit report was obtained and reviewed by DPH. IDENTIFICATION OF REPEATED FINDINGS Repeated (Prior Finding No. 2022-009) RECOMMENDATION We recommend DPH implement its prior corrective action plan for any future subrecipients awarded under the federal program. Also, procedures should be in place to adequately document financial monitoring conducted, as well as the review of the Single Audit report, as required by federal regulations. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 56.

Subrecipient Monitoring Federal Department – U.S. Department of Health and Human Services Federal Award Identification Number and Year: NU58DP006993 and 2022/2023 COVID-19 - Community Health Workers for Public Health Response and Resilient, Federal Assistance Listing #93.495 County Department – Department of Public Health Finding 2023 – 006 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D—Post Federal Award Requirements Standards for Financial and Program Management, Section 200.332. Requirements for pass-through entities, requires that “All pass-through entities must: (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F—Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in Section 200.208 Specific conditions. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by Section 200.521 Management decision. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in Section 200.425 Audit services. (f) Verify that every subrecipient is audited as required by Subpart F— Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in Section 200.501 Audit requirements. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in Section 200.338 Remedies for noncompliance of this part and in program regulations.” CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not perform adequate monitoring of its subrecipients as required by Federal regulations. CAUSE Based on discussions with management, the cause of this finding was due to DPH/CCH identifying a consultant agency to conduct the subrecipient monitoring; this was accomplished October 2023. Current Status: These documents were created, shared with the auditor pending management approval; 1) Subrecipient Monitoring Policy 2). Subrecipient Commitment Form 3). Subrecipient Determination Tool 4). Subrecipient Risk Assessment and Monitoring Guide. EFFECT Failure to adequately monitor the activities and performance of a subrecipient could result in Federal awards being used for unauthorized purposes and DPH’s inability to adequately perform risk assessments on its subrecipient(s). QUESTIONED COSTS None. CONTEXT During the current audit period, we noted 12 subrecipients were awarded funds. During our review of three (3) subrecipients, we noted the following:  For all three subrecipients, we noted that adequate documentation was not maintained to support the financial monitoring of these subrecipients. Also, no documentation was provided to verify whether the subrecipients were required to have a Single Audit conducted, including DPH’s review of the report, and if applicable, issuance of a management decision on audit findings noted as required by 2 CFR 200.332d(3).  For one subrecipient, we noted documentation was not maintained to support DPH’s evaluation of the subrecipient’s risk of noncompliance and the frequency of monitoring to be conducted by DPH based on the assessed risk. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend DPH implement procedures to ensure that adequate documentation is maintained to support financial monitoring conducted, evaluation of each subrecipient’s risk of noncompliance and review of the Single Audit report, as required by federal regulations. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 56.