Audit 317091

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-001 Internal Control over Compliance and Compliance with Allowable Costs/Cost Principles Program: Federal Agency: Department of Health and Human Services Funding Year(s): 2/1/2020 – 3/31/2023 Federal Award: 90ZU0351-03-05 AL Number: 93.676 Criteria: The Code of Federal Regulations 2 CFR 200.303, Internal Control, requires the non-federal entity to establish and maintain effective internal control over Federal awards that provides reasonable assurance that the non-federal entity is managing Federal awards in compliance with Federal statutes, regulations, and other terms and conditions. Per 2 CFR Section 200.430 Compensation – Personal Services: “Costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the establish written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity’s laws and/or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable.” 2 CFR Section 200.430(i): “Standards for Documentation of Personnel Expenses (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted and all other activities compensated by the non Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non Federal entity’s written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) [Reserved] (vii) Support the distribution of the employee’s salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non- Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (viii) Budget estimates (i.e., estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards.” Condition: During the audit, we noted an instance for which an employee was reinstated and received retroactive payment for the months of September through November 2022 for which we were not able to substantiate the allowability of the payroll charges. Cause: The Organization did not follow its policies and procedures in place to ensure compliance with the requirements allowable personnel costs. Effect: Failure to follow the Organization’s control system related to review and document payroll benefits so that only allowable costs are charged to the program can lead to noncompliance with federal statutes, regulations could lead to disallowed costs. Context: This is a condition identified based upon our review of the Organization’s compliance with specified requirements. Questioned Costs: $9,864 Identification as a Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure that all payroll costs including benefits charged to the federal awards are reviewed and documented for allowability.

FINDING 2023-001 Internal Control over Compliance and Compliance with Allowable Costs/Cost Principles Program: Federal Agency: Department of Health and Human Services Funding Year(s): 2/1/2020 – 3/31/2023 Federal Award: 90ZU0351-03-05 AL Number: 93.676 Criteria: The Code of Federal Regulations 2 CFR 200.303, Internal Control, requires the non-federal entity to establish and maintain effective internal control over Federal awards that provides reasonable assurance that the non-federal entity is managing Federal awards in compliance with Federal statutes, regulations, and other terms and conditions. Per 2 CFR Section 200.430 Compensation – Personal Services: “Costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the establish written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity’s laws and/or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable.” 2 CFR Section 200.430(i): “Standards for Documentation of Personnel Expenses (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted and all other activities compensated by the non Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non Federal entity’s written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) [Reserved] (vii) Support the distribution of the employee’s salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non- Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (viii) Budget estimates (i.e., estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards.” Condition: During the audit, we noted an instance for which an employee was reinstated and received retroactive payment for the months of September through November 2022 for which we were not able to substantiate the allowability of the payroll charges. Cause: The Organization did not follow its policies and procedures in place to ensure compliance with the requirements allowable personnel costs. Effect: Failure to follow the Organization’s control system related to review and document payroll benefits so that only allowable costs are charged to the program can lead to noncompliance with federal statutes, regulations could lead to disallowed costs. Context: This is a condition identified based upon our review of the Organization’s compliance with specified requirements. Questioned Costs: $9,864 Identification as a Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure that all payroll costs including benefits charged to the federal awards are reviewed and documented for allowability.

FINDING 2023-002 Internal Control over Compliance and Compliance with Period of Performance Program: Federal Agency: Department of Health and Human Services Funding Year(s): 2/1/2020 – 3/31/2023 Federal Award: 90ZU0351-03-05 AL Number: 93.676 Criteria: In accordance with §200.309, a non-Federal entity may charge to the Federal award only allowable costs incurred during the period of performance and any costs incurred before the Federal awarding agency or pass-through entity made the Federal award that were authorized by the Federal awarding agency or pass-through entity. Unless the Federal awarding agency or pass-through entity authorizes an extension, a non-Federal entity must liquidate all obligations incurred under the Federal award not later than 120 calendar days after the end date of the period of performance as specified in the terms and conditions of the Federal award as required by §200.344(b). When used in connection with a non-Federal entity’s utilization of funds under a Federal award, “obligations” means orders placed for property, services, contracts, and subawards made, and similar transactions during a given period that require payment by the non-Federal entity during the same or a future period as described in §200.71. Condition: During the audit, we identified 1 out of 40 items selected, whereby the expense was incurred after the end of the award period of performance. The expense totaled $1,407. Cause: The Organization has procedures in place to review expenditures to determine the appropriate period of performance; however, those procedures were not performed to a level of detail to identify this expense incurred outside of the period of the award. Effect: The lack of adherence to the established internal control procedures around the period of performance of the award resulted in noncompliance and questioned costs. Continued noncompliance with federal statutes, regulations, and the provisions of the grant agreements could ultimately result in additional disallowed costs for the major programs. Context: This is a condition identified based upon our review of the Organization’s compliance with specified requirements. Questioned Costs: $1,407 Identification as a Repeat Finding: This is a repeat finding, as 2022-006. Recommendation: We recommend management adhere to its internal control procedures around detecting expenditures incurred outside of the period of performance in order to prevent the charging of costs outside of the period of performance of the award.

FINDING 2023-002 Internal Control over Compliance and Compliance with Period of Performance Program: Federal Agency: Department of Health and Human Services Funding Year(s): 2/1/2020 – 3/31/2023 Federal Award: 90ZU0351-03-05 AL Number: 93.676 Criteria: In accordance with §200.309, a non-Federal entity may charge to the Federal award only allowable costs incurred during the period of performance and any costs incurred before the Federal awarding agency or pass-through entity made the Federal award that were authorized by the Federal awarding agency or pass-through entity. Unless the Federal awarding agency or pass-through entity authorizes an extension, a non-Federal entity must liquidate all obligations incurred under the Federal award not later than 120 calendar days after the end date of the period of performance as specified in the terms and conditions of the Federal award as required by §200.344(b). When used in connection with a non-Federal entity’s utilization of funds under a Federal award, “obligations” means orders placed for property, services, contracts, and subawards made, and similar transactions during a given period that require payment by the non-Federal entity during the same or a future period as described in §200.71. Condition: During the audit, we identified 1 out of 40 items selected, whereby the expense was incurred after the end of the award period of performance. The expense totaled $1,407. Cause: The Organization has procedures in place to review expenditures to determine the appropriate period of performance; however, those procedures were not performed to a level of detail to identify this expense incurred outside of the period of the award. Effect: The lack of adherence to the established internal control procedures around the period of performance of the award resulted in noncompliance and questioned costs. Continued noncompliance with federal statutes, regulations, and the provisions of the grant agreements could ultimately result in additional disallowed costs for the major programs. Context: This is a condition identified based upon our review of the Organization’s compliance with specified requirements. Questioned Costs: $1,407 Identification as a Repeat Finding: This is a repeat finding, as 2022-006. Recommendation: We recommend management adhere to its internal control procedures around detecting expenditures incurred outside of the period of performance in order to prevent the charging of costs outside of the period of performance of the award.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-003 Internal Control over Compliance and Compliance with Reporting Program: Federal Agency: USAID Funding Year(s): 8/1/2018 – 1/31/2023 Federal Award: 72026718CA00002 AL Number: 98.001 Criteria: Under the requirements of the Federal Funding Accountability and Transparency Act (“FFATA”) (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, hereafter referred as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The award information must be reported in FSRS no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: During fiscal year 2023, the grant awarded a total of 3 sub-awards that exceeded $30,000 to subrecipients. Refer to the table below for results of our testing. Cause: We were unable to verify that the Organization has established policies and procedures to ensure that the required reports are accurately completed and submitted on a timely basis, we noted the following matters for the subawards tested: • For the two samples tested, the Organization was unable to provide proof of submission of the FFATA reports. Effect: Failure to comply with the FFATA requirements of could result in lack of compliance with the Federal Funding Accountability and Transparency Act. Context: This is a condition identified based upon our review of the Organization’s compliance with specified requirements. Questioned Costs: None identified. Identification as a Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the Organization establish internal controls over the reporting process to ensure all FFATA reports are correctly submitted, and they keep a record of the submission.

FINDING 2023-004 Internal Control over Compliance and Compliance with Subrecipient Monitoring Program: Federal Agency: USAID Funding Year(s): 8/1/2018 – 1/31/2023 Federal Award: 72026718CA00002 AL Number: 98.001 Criteria: In accordance with §200.331(b) and §200.331(d), Requirements for Pass-Through Entities, the Organization, the recipient of these federal funds) must evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Organization must also monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statues, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) reviewing financial and performance reports required by the pass-through entity; (2) following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means; and (3) issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the pass-through entity. Condition: During our testing of subrecipient monitoring, we selected two subrecipient samples. We identified the following conditions: • For one of the two samples testing, the Organization was unable to provide documented evidence for the evaluation of the subrecipient’s risk assessment. • For one sample tested, there was no timely evidence that the Organization verified the subrecipient’s audit requirements. Therefore, monitoring activities related to the verification of the audit requirements were not performed in accordance with §200.331(b) and §200.331(d). Cause: The Organization did not follow its policies and procedures in place to ensure compliance with the requirements regarding subrecipient monitoring. Effect: Failure to comply with the subrecipient monitoring requirements of the Uniform Guidance could result in unallowable expenses being charged to the grants by the subrecipients. Context: This is a condition identified based upon our review of the Organization’s compliance with specified requirements. Questioned Costs: None identified. Identification as a Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure the subrecipient process from identification of that subrecipient through verification of subrecipients’ audit requirements, occurs to ensure compliance.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-001 Internal Control over Compliance and Compliance with Allowable Costs/Cost Principles Program: Federal Agency: Department of Health and Human Services Funding Year(s): 2/1/2020 – 3/31/2023 Federal Award: 90ZU0351-03-05 AL Number: 93.676 Criteria: The Code of Federal Regulations 2 CFR 200.303, Internal Control, requires the non-federal entity to establish and maintain effective internal control over Federal awards that provides reasonable assurance that the non-federal entity is managing Federal awards in compliance with Federal statutes, regulations, and other terms and conditions. Per 2 CFR Section 200.430 Compensation – Personal Services: “Costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the establish written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity’s laws and/or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable.” 2 CFR Section 200.430(i): “Standards for Documentation of Personnel Expenses (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted and all other activities compensated by the non Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non Federal entity’s written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) [Reserved] (vii) Support the distribution of the employee’s salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non- Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (viii) Budget estimates (i.e., estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards.” Condition: During the audit, we noted an instance for which an employee was reinstated and received retroactive payment for the months of September through November 2022 for which we were not able to substantiate the allowability of the payroll charges. Cause: The Organization did not follow its policies and procedures in place to ensure compliance with the requirements allowable personnel costs. Effect: Failure to follow the Organization’s control system related to review and document payroll benefits so that only allowable costs are charged to the program can lead to noncompliance with federal statutes, regulations could lead to disallowed costs. Context: This is a condition identified based upon our review of the Organization’s compliance with specified requirements. Questioned Costs: $9,864 Identification as a Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure that all payroll costs including benefits charged to the federal awards are reviewed and documented for allowability.

FINDING 2023-001 Internal Control over Compliance and Compliance with Allowable Costs/Cost Principles Program: Federal Agency: Department of Health and Human Services Funding Year(s): 2/1/2020 – 3/31/2023 Federal Award: 90ZU0351-03-05 AL Number: 93.676 Criteria: The Code of Federal Regulations 2 CFR 200.303, Internal Control, requires the non-federal entity to establish and maintain effective internal control over Federal awards that provides reasonable assurance that the non-federal entity is managing Federal awards in compliance with Federal statutes, regulations, and other terms and conditions. Per 2 CFR Section 200.430 Compensation – Personal Services: “Costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the establish written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity’s laws and/or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable.” 2 CFR Section 200.430(i): “Standards for Documentation of Personnel Expenses (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted and all other activities compensated by the non Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non Federal entity’s written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) [Reserved] (vii) Support the distribution of the employee’s salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non- Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (viii) Budget estimates (i.e., estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards.” Condition: During the audit, we noted an instance for which an employee was reinstated and received retroactive payment for the months of September through November 2022 for which we were not able to substantiate the allowability of the payroll charges. Cause: The Organization did not follow its policies and procedures in place to ensure compliance with the requirements allowable personnel costs. Effect: Failure to follow the Organization’s control system related to review and document payroll benefits so that only allowable costs are charged to the program can lead to noncompliance with federal statutes, regulations could lead to disallowed costs. Context: This is a condition identified based upon our review of the Organization’s compliance with specified requirements. Questioned Costs: $9,864 Identification as a Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure that all payroll costs including benefits charged to the federal awards are reviewed and documented for allowability.

FINDING 2023-002 Internal Control over Compliance and Compliance with Period of Performance Program: Federal Agency: Department of Health and Human Services Funding Year(s): 2/1/2020 – 3/31/2023 Federal Award: 90ZU0351-03-05 AL Number: 93.676 Criteria: In accordance with §200.309, a non-Federal entity may charge to the Federal award only allowable costs incurred during the period of performance and any costs incurred before the Federal awarding agency or pass-through entity made the Federal award that were authorized by the Federal awarding agency or pass-through entity. Unless the Federal awarding agency or pass-through entity authorizes an extension, a non-Federal entity must liquidate all obligations incurred under the Federal award not later than 120 calendar days after the end date of the period of performance as specified in the terms and conditions of the Federal award as required by §200.344(b). When used in connection with a non-Federal entity’s utilization of funds under a Federal award, “obligations” means orders placed for property, services, contracts, and subawards made, and similar transactions during a given period that require payment by the non-Federal entity during the same or a future period as described in §200.71. Condition: During the audit, we identified 1 out of 40 items selected, whereby the expense was incurred after the end of the award period of performance. The expense totaled $1,407. Cause: The Organization has procedures in place to review expenditures to determine the appropriate period of performance; however, those procedures were not performed to a level of detail to identify this expense incurred outside of the period of the award. Effect: The lack of adherence to the established internal control procedures around the period of performance of the award resulted in noncompliance and questioned costs. Continued noncompliance with federal statutes, regulations, and the provisions of the grant agreements could ultimately result in additional disallowed costs for the major programs. Context: This is a condition identified based upon our review of the Organization’s compliance with specified requirements. Questioned Costs: $1,407 Identification as a Repeat Finding: This is a repeat finding, as 2022-006. Recommendation: We recommend management adhere to its internal control procedures around detecting expenditures incurred outside of the period of performance in order to prevent the charging of costs outside of the period of performance of the award.

FINDING 2023-002 Internal Control over Compliance and Compliance with Period of Performance Program: Federal Agency: Department of Health and Human Services Funding Year(s): 2/1/2020 – 3/31/2023 Federal Award: 90ZU0351-03-05 AL Number: 93.676 Criteria: In accordance with §200.309, a non-Federal entity may charge to the Federal award only allowable costs incurred during the period of performance and any costs incurred before the Federal awarding agency or pass-through entity made the Federal award that were authorized by the Federal awarding agency or pass-through entity. Unless the Federal awarding agency or pass-through entity authorizes an extension, a non-Federal entity must liquidate all obligations incurred under the Federal award not later than 120 calendar days after the end date of the period of performance as specified in the terms and conditions of the Federal award as required by §200.344(b). When used in connection with a non-Federal entity’s utilization of funds under a Federal award, “obligations” means orders placed for property, services, contracts, and subawards made, and similar transactions during a given period that require payment by the non-Federal entity during the same or a future period as described in §200.71. Condition: During the audit, we identified 1 out of 40 items selected, whereby the expense was incurred after the end of the award period of performance. The expense totaled $1,407. Cause: The Organization has procedures in place to review expenditures to determine the appropriate period of performance; however, those procedures were not performed to a level of detail to identify this expense incurred outside of the period of the award. Effect: The lack of adherence to the established internal control procedures around the period of performance of the award resulted in noncompliance and questioned costs. Continued noncompliance with federal statutes, regulations, and the provisions of the grant agreements could ultimately result in additional disallowed costs for the major programs. Context: This is a condition identified based upon our review of the Organization’s compliance with specified requirements. Questioned Costs: $1,407 Identification as a Repeat Finding: This is a repeat finding, as 2022-006. Recommendation: We recommend management adhere to its internal control procedures around detecting expenditures incurred outside of the period of performance in order to prevent the charging of costs outside of the period of performance of the award.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-003 Internal Control over Compliance and Compliance with Reporting Program: Federal Agency: USAID Funding Year(s): 8/1/2018 – 1/31/2023 Federal Award: 72026718CA00002 AL Number: 98.001 Criteria: Under the requirements of the Federal Funding Accountability and Transparency Act (“FFATA”) (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, hereafter referred as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The award information must be reported in FSRS no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: During fiscal year 2023, the grant awarded a total of 3 sub-awards that exceeded $30,000 to subrecipients. Refer to the table below for results of our testing. Cause: We were unable to verify that the Organization has established policies and procedures to ensure that the required reports are accurately completed and submitted on a timely basis, we noted the following matters for the subawards tested: • For the two samples tested, the Organization was unable to provide proof of submission of the FFATA reports. Effect: Failure to comply with the FFATA requirements of could result in lack of compliance with the Federal Funding Accountability and Transparency Act. Context: This is a condition identified based upon our review of the Organization’s compliance with specified requirements. Questioned Costs: None identified. Identification as a Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the Organization establish internal controls over the reporting process to ensure all FFATA reports are correctly submitted, and they keep a record of the submission.

FINDING 2023-004 Internal Control over Compliance and Compliance with Subrecipient Monitoring Program: Federal Agency: USAID Funding Year(s): 8/1/2018 – 1/31/2023 Federal Award: 72026718CA00002 AL Number: 98.001 Criteria: In accordance with §200.331(b) and §200.331(d), Requirements for Pass-Through Entities, the Organization, the recipient of these federal funds) must evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Organization must also monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statues, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) reviewing financial and performance reports required by the pass-through entity; (2) following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means; and (3) issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the pass-through entity. Condition: During our testing of subrecipient monitoring, we selected two subrecipient samples. We identified the following conditions: • For one of the two samples testing, the Organization was unable to provide documented evidence for the evaluation of the subrecipient’s risk assessment. • For one sample tested, there was no timely evidence that the Organization verified the subrecipient’s audit requirements. Therefore, monitoring activities related to the verification of the audit requirements were not performed in accordance with §200.331(b) and §200.331(d). Cause: The Organization did not follow its policies and procedures in place to ensure compliance with the requirements regarding subrecipient monitoring. Effect: Failure to comply with the subrecipient monitoring requirements of the Uniform Guidance could result in unallowable expenses being charged to the grants by the subrecipients. Context: This is a condition identified based upon our review of the Organization’s compliance with specified requirements. Questioned Costs: None identified. Identification as a Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure the subrecipient process from identification of that subrecipient through verification of subrecipients’ audit requirements, occurs to ensure compliance.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.

FINDING 2023-005 Internal Control over Compliance and Compliance with Reporting Programs: Federal Agency: Department of Health and Human services AL Number: 93.224/93.527 Federal Agency: USAID AL Number: 98.001 Criteria: CFR Section 200.303, Internal Controls, Section (a) states the Organization must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its reporting process. 2 CFR section 200.512(a) states that the data collection form and reporting package must be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period to the Federal Audit Clearinghouse (FAC). If the due date falls on a Saturday, Sunday, or federal holiday, the reporting package is due the next business day. The Uniform Guidance does not have a provision addressing whether the cognizant or oversight agencies may extend due dates. Condition: During the fiscal year, we noted that the Organization failed to submit the data collection form and reporting package to FAC on a timely basis. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure timely submission of required reports to federal funding source. Effect: Failure to properly track all reporting submission deadlines could lead to delayed funding. Context: This is a condition identified during the testing of the financial reporting requirements as outlined in the terms and conditions of the award documents. The data collection form and reporting package must be submitted to the FAC the earlier of 30 calendar days after receipt of the auditor’s reports or by March 31, 2023, nine months after the end of the audit period. Questioned Costs: None identified. Identification as a Repeat Finding: This is a repeat finding, as 2022-007. Recommendation: We recommend that the Organization strictly enforce its existing policies and procedures to ensure compliance with the requirements of the Uniform Guidance to ensure required reports are properly submitted to the federal government on a timely basis.