Audit 321336

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-003 The City did not have adequate internal controls in place for ensuring compliance with federal special reporting and rehabilitation requirements. Assistance Listing Number and Title: 14.218 Community Development Block Grants Federal Grantor Name: U.S. Department of Housing and Urban Development Federal Award/Contract Number: B16MC530012, B23MC530012, B22MC530012 Pass-through Entity Name: N/A Pass-through Award/Contract Number: N/A Known Questioned Cost Amount: N/A Prior Year Audit Finding: N/A Background The primary objective of the Community Development Block Grants/Entitlement Grants (CDBG) program is to help provide decent and affordable housing, particularly for people with moderate, low, and very low incomes. Funds also help recipients implement strategies for achieving an adequate supply of decent housing and providing suitable living environments and expanded economic opportunities for people with low incomes. In 2023, the City spent $1,109,016 for its CDBG program. Of this amount, it passed $911,886 through to subrecipients. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Special Reporting for Federal Funding Accountability and Transparency Act (FFATA) The Federal Funding Accountability and Transparency Act (FFATA) requires direct recipients that make first-tier subawards of $30,000 or more to report them in the FFATA Subaward Reporting System (FSRS). The City must report subawards by the end of the month following the month in which it made the subawards. Special Tests and Provisions – Rehabilitation When recipients use CDBG funds for housing rehabilitation projects, federal regulations require them to ensure that the work is properly completed by performing the following: • Conducting pre-rehabilitation inspections to determine deficiencies to be corrected • Incorporating the deficiencies to be corrected into the rehabilitation contract • Inspecting the rehabilitation work upon completion to assure that it is carried out in accordance with contract specifications Description of Condition Special Reporting for Federal Funding Accountability and Transparency Act (FFATA) The City’s internal controls were ineffective for ensuring compliance with FFATA reporting requirements. Specifically, the City made four new subawards in 2023 that exceeded $30,000, and it did not prepare or submit any FFATA reports for these subawards as federal regulations require. We consider these internal control deficiencies to be a material weakness that led to material noncompliance. Special Tests and Provisions – Rehabilitation Our audit found the City did not have a process in place to perform inspections of rehabilitation projects upon completion to ensure the work was carried out in accordance with contract specifications as federal regulations require. We consider this deficiency in internal controls to be a material weakness that led to material noncompliance. Cause of Condition Special Reporting for Federal Funding Accountability and Transparency Act (FFATA) City staff overseeing the program were not aware of the federal FFATA reporting requirements. Special Tests and Provisions – Rehabilitation The City staff overseeing the program did not know that they were required to perform post-rehabilitation inspections themselves to ensure that the project was complete. Staff stated that they have a process in place to review invoices and supporting documentation once work is complete to verify that the work performed appears to be within contract specifications based on documentation submitted. However, they do not physically inspect the project, nor do they require all subrecipients to submit photos or other documentation supporting that the work was performed in accordance with specifications. Effect of Condition Special Reporting for Federal Funding Accountability and Transparency Act (FFATA) Failing to submit the required reports diminishes the federal government's ability to ensure accountability and transparency of federal spending. The table below summarizes the discrepancies we identified. Transactions Tested Subaward not reported Report not timely Subaward amount incorrect* Subaward missing key elements 4 4 N/A N/A N/A Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $ 430,000 $ 430,000 N/A N/A N/A Page 17 Office of the Washington State Auditor sao.wa.gov Special Tests and Provisions – Rehabilitation We tested twenty-five rehabilitation projects and the City could not provide documentation for any of the projects to show that a review or inspection took place upon completion. Therefore, we could not determine the City ensured that contractors carried out and completed the rehabilitation work in accordance with contract specifications. Without documented rehabilitation inspections, the City cannot demonstrate it is complying with program requirements. Failure to comply with program requirements could result in the U.S. Department of Housing and Urban Development withholding future annual allocations of CDBG funding from the City. Recommendation We recommend the City establish and follow internal controls to ensure it prepares and submits FFATA reports for all applicable subawards, as federal regulations require. Further, we recommend the City establish controls and procedures to ensure all applicable housing projects receive rehabilitation inspections upon completion of the work, as federal regulations require. City’s Response The City takes seriously the use of federal funds, and the compliance requirements associated with them. The Housing and Homelessness Response team is committed to ensuring there are no further instances of noncompliance by updating our processes to meet these requirements. The inspections of rehabilitation projects were being performed remotely by reviewing contractor invoices and payments as evidence of work completion. Though each individual project site was not visited, the team did perform on-site monitoring visits at subrecipients’ locations and reviewed subrecipients’ documentation of project files. This process was a holdover from COVID, when we were unable to physically go on site to every project site. As COVID restrictions have lifted, we understand that a physical inspection at each site is now necessary. Moving forward, we have implemented requirements to inspect all sites receiving CDBG rehabilitation funding as a part of project close-out. Staff will also continue to review subrecipient records during monitoring to ensure subrecipients have adequate recordkeeping of completed rehabilitation projects. The department was unaware of the requirements of the FFATA filing and will be scheduling trainings to learn more about grant requirements. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, establishes the Federal Funding Accountability and Transparency Act (FFATA) requirements of reporting the subaward information through the FFATA Subaward Reporting System (FSRS). Title 24 CFR Part 570, Community Development Block Grants, section 506, records to be maintained.

City of Olympia January 1, 2023 through December 31, 2023 2023-003 The City did not have adequate internal controls in place for ensuring compliance with federal special reporting and rehabilitation requirements. Assistance Listing Number and Title: 14.218 Community Development Block Grants Federal Grantor Name: U.S. Department of Housing and Urban Development Federal Award/Contract Number: B16MC530012, B23MC530012, B22MC530012 Pass-through Entity Name: N/A Pass-through Award/Contract Number: N/A Known Questioned Cost Amount: N/A Prior Year Audit Finding: N/A Background The primary objective of the Community Development Block Grants/Entitlement Grants (CDBG) program is to help provide decent and affordable housing, particularly for people with moderate, low, and very low incomes. Funds also help recipients implement strategies for achieving an adequate supply of decent housing and providing suitable living environments and expanded economic opportunities for people with low incomes. In 2023, the City spent $1,109,016 for its CDBG program. Of this amount, it passed $911,886 through to subrecipients. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Special Reporting for Federal Funding Accountability and Transparency Act (FFATA) The Federal Funding Accountability and Transparency Act (FFATA) requires direct recipients that make first-tier subawards of $30,000 or more to report them in the FFATA Subaward Reporting System (FSRS). The City must report subawards by the end of the month following the month in which it made the subawards. Special Tests and Provisions – Rehabilitation When recipients use CDBG funds for housing rehabilitation projects, federal regulations require them to ensure that the work is properly completed by performing the following: • Conducting pre-rehabilitation inspections to determine deficiencies to be corrected • Incorporating the deficiencies to be corrected into the rehabilitation contract • Inspecting the rehabilitation work upon completion to assure that it is carried out in accordance with contract specifications Description of Condition Special Reporting for Federal Funding Accountability and Transparency Act (FFATA) The City’s internal controls were ineffective for ensuring compliance with FFATA reporting requirements. Specifically, the City made four new subawards in 2023 that exceeded $30,000, and it did not prepare or submit any FFATA reports for these subawards as federal regulations require. We consider these internal control deficiencies to be a material weakness that led to material noncompliance. Special Tests and Provisions – Rehabilitation Our audit found the City did not have a process in place to perform inspections of rehabilitation projects upon completion to ensure the work was carried out in accordance with contract specifications as federal regulations require. We consider this deficiency in internal controls to be a material weakness that led to material noncompliance. Cause of Condition Special Reporting for Federal Funding Accountability and Transparency Act (FFATA) City staff overseeing the program were not aware of the federal FFATA reporting requirements. Special Tests and Provisions – Rehabilitation The City staff overseeing the program did not know that they were required to perform post-rehabilitation inspections themselves to ensure that the project was complete. Staff stated that they have a process in place to review invoices and supporting documentation once work is complete to verify that the work performed appears to be within contract specifications based on documentation submitted. However, they do not physically inspect the project, nor do they require all subrecipients to submit photos or other documentation supporting that the work was performed in accordance with specifications. Effect of Condition Special Reporting for Federal Funding Accountability and Transparency Act (FFATA) Failing to submit the required reports diminishes the federal government's ability to ensure accountability and transparency of federal spending. The table below summarizes the discrepancies we identified. Transactions Tested Subaward not reported Report not timely Subaward amount incorrect* Subaward missing key elements 4 4 N/A N/A N/A Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $ 430,000 $ 430,000 N/A N/A N/A Page 17 Office of the Washington State Auditor sao.wa.gov Special Tests and Provisions – Rehabilitation We tested twenty-five rehabilitation projects and the City could not provide documentation for any of the projects to show that a review or inspection took place upon completion. Therefore, we could not determine the City ensured that contractors carried out and completed the rehabilitation work in accordance with contract specifications. Without documented rehabilitation inspections, the City cannot demonstrate it is complying with program requirements. Failure to comply with program requirements could result in the U.S. Department of Housing and Urban Development withholding future annual allocations of CDBG funding from the City. Recommendation We recommend the City establish and follow internal controls to ensure it prepares and submits FFATA reports for all applicable subawards, as federal regulations require. Further, we recommend the City establish controls and procedures to ensure all applicable housing projects receive rehabilitation inspections upon completion of the work, as federal regulations require. City’s Response The City takes seriously the use of federal funds, and the compliance requirements associated with them. The Housing and Homelessness Response team is committed to ensuring there are no further instances of noncompliance by updating our processes to meet these requirements. The inspections of rehabilitation projects were being performed remotely by reviewing contractor invoices and payments as evidence of work completion. Though each individual project site was not visited, the team did perform on-site monitoring visits at subrecipients’ locations and reviewed subrecipients’ documentation of project files. This process was a holdover from COVID, when we were unable to physically go on site to every project site. As COVID restrictions have lifted, we understand that a physical inspection at each site is now necessary. Moving forward, we have implemented requirements to inspect all sites receiving CDBG rehabilitation funding as a part of project close-out. Staff will also continue to review subrecipient records during monitoring to ensure subrecipients have adequate recordkeeping of completed rehabilitation projects. The department was unaware of the requirements of the FFATA filing and will be scheduling trainings to learn more about grant requirements. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, establishes the Federal Funding Accountability and Transparency Act (FFATA) requirements of reporting the subaward information through the FFATA Subaward Reporting System (FSRS). Title 24 CFR Part 570, Community Development Block Grants, section 506, records to be maintained.

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-002 The City had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring. Assistance Listing Number and Title: 21.027, COVID 19 - The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: Washington State Department of Commerce Pass-through Award/Contract Number: 22-96720-203 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Description of Condition During fiscal year 2023, the City spent $6,400,211 in federal funding for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program including $2,499,997 that it passed through to one subrecipient. The purpose of the SLFRF is to respond to the COVID-19 pandemic’s negative effects on public health and the economy, provide premium pay to essential workers during the pandemic, provide government services to the extent COVID-19 caused a reduction in revenues collected and make necessary investments in water, sewer or broadband infrastructure. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Federal regulations require the City to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The City did not have adequate controls for evaluating the subrecipient’s risk of noncompliance with federal requirements and monitoring its subrecipients. Specifically, it did not have adequate controls for ensuring a subrecipient received a federal single audit when required and then reviewing subrecipients’ audits when applicable. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Employees responsible for ensuring compliance with subrecipient monitoring were unaware that the subrecipient was in fact a subrecipient, and therefore did not perform a risk assessment as required. They were also unaware of the annual requirement to verify that subrecipients receive a single audit if they have total federal expenditures more than the single audit threshold of $750,000. Effect of Condition The City could not provide supporting documentation showing that it performed the following monitoring procedures to prevent or detect subrecipient noncompliance: • A risk assessment to determine adequate monitoring of the subrecipient • Verifying if the subrecipient received a federal single audit, if required • Ensuring subrecipient took corrective actions on any deficiencies • Issuing management decisions within six months of an audit report’s publication Recommendation We recommend the City establish internal controls over subrecipient monitoring to ensure it performs risk assessments for its subrecipients, verifies that subrecipients receive a federal single audit when required and develops follow-up procedures if it detects deficiencies. City’s Response The City takes seriously the use of federal funds and the compliance requirements associated with them. While there were no compliance violations found due to this lack of controls, the Housing and Homelessness Response team is committed to learning more about compliance requirements as well as documenting how those requirements were met. We will be scheduling trainings and implementing new procedures to adequately document our compliance requirement processes. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities

City of Olympia January 1, 2023 through December 31, 2023 2023-003 The City did not have adequate internal controls in place for ensuring compliance with federal special reporting and rehabilitation requirements. Assistance Listing Number and Title: 14.218 Community Development Block Grants Federal Grantor Name: U.S. Department of Housing and Urban Development Federal Award/Contract Number: B16MC530012, B23MC530012, B22MC530012 Pass-through Entity Name: N/A Pass-through Award/Contract Number: N/A Known Questioned Cost Amount: N/A Prior Year Audit Finding: N/A Background The primary objective of the Community Development Block Grants/Entitlement Grants (CDBG) program is to help provide decent and affordable housing, particularly for people with moderate, low, and very low incomes. Funds also help recipients implement strategies for achieving an adequate supply of decent housing and providing suitable living environments and expanded economic opportunities for people with low incomes. In 2023, the City spent $1,109,016 for its CDBG program. Of this amount, it passed $911,886 through to subrecipients. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Special Reporting for Federal Funding Accountability and Transparency Act (FFATA) The Federal Funding Accountability and Transparency Act (FFATA) requires direct recipients that make first-tier subawards of $30,000 or more to report them in the FFATA Subaward Reporting System (FSRS). The City must report subawards by the end of the month following the month in which it made the subawards. Special Tests and Provisions – Rehabilitation When recipients use CDBG funds for housing rehabilitation projects, federal regulations require them to ensure that the work is properly completed by performing the following: • Conducting pre-rehabilitation inspections to determine deficiencies to be corrected • Incorporating the deficiencies to be corrected into the rehabilitation contract • Inspecting the rehabilitation work upon completion to assure that it is carried out in accordance with contract specifications Description of Condition Special Reporting for Federal Funding Accountability and Transparency Act (FFATA) The City’s internal controls were ineffective for ensuring compliance with FFATA reporting requirements. Specifically, the City made four new subawards in 2023 that exceeded $30,000, and it did not prepare or submit any FFATA reports for these subawards as federal regulations require. We consider these internal control deficiencies to be a material weakness that led to material noncompliance. Special Tests and Provisions – Rehabilitation Our audit found the City did not have a process in place to perform inspections of rehabilitation projects upon completion to ensure the work was carried out in accordance with contract specifications as federal regulations require. We consider this deficiency in internal controls to be a material weakness that led to material noncompliance. Cause of Condition Special Reporting for Federal Funding Accountability and Transparency Act (FFATA) City staff overseeing the program were not aware of the federal FFATA reporting requirements. Special Tests and Provisions – Rehabilitation The City staff overseeing the program did not know that they were required to perform post-rehabilitation inspections themselves to ensure that the project was complete. Staff stated that they have a process in place to review invoices and supporting documentation once work is complete to verify that the work performed appears to be within contract specifications based on documentation submitted. However, they do not physically inspect the project, nor do they require all subrecipients to submit photos or other documentation supporting that the work was performed in accordance with specifications. Effect of Condition Special Reporting for Federal Funding Accountability and Transparency Act (FFATA) Failing to submit the required reports diminishes the federal government's ability to ensure accountability and transparency of federal spending. The table below summarizes the discrepancies we identified. Transactions Tested Subaward not reported Report not timely Subaward amount incorrect* Subaward missing key elements 4 4 N/A N/A N/A Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $ 430,000 $ 430,000 N/A N/A N/A Page 17 Office of the Washington State Auditor sao.wa.gov Special Tests and Provisions – Rehabilitation We tested twenty-five rehabilitation projects and the City could not provide documentation for any of the projects to show that a review or inspection took place upon completion. Therefore, we could not determine the City ensured that contractors carried out and completed the rehabilitation work in accordance with contract specifications. Without documented rehabilitation inspections, the City cannot demonstrate it is complying with program requirements. Failure to comply with program requirements could result in the U.S. Department of Housing and Urban Development withholding future annual allocations of CDBG funding from the City. Recommendation We recommend the City establish and follow internal controls to ensure it prepares and submits FFATA reports for all applicable subawards, as federal regulations require. Further, we recommend the City establish controls and procedures to ensure all applicable housing projects receive rehabilitation inspections upon completion of the work, as federal regulations require. City’s Response The City takes seriously the use of federal funds, and the compliance requirements associated with them. The Housing and Homelessness Response team is committed to ensuring there are no further instances of noncompliance by updating our processes to meet these requirements. The inspections of rehabilitation projects were being performed remotely by reviewing contractor invoices and payments as evidence of work completion. Though each individual project site was not visited, the team did perform on-site monitoring visits at subrecipients’ locations and reviewed subrecipients’ documentation of project files. This process was a holdover from COVID, when we were unable to physically go on site to every project site. As COVID restrictions have lifted, we understand that a physical inspection at each site is now necessary. Moving forward, we have implemented requirements to inspect all sites receiving CDBG rehabilitation funding as a part of project close-out. Staff will also continue to review subrecipient records during monitoring to ensure subrecipients have adequate recordkeeping of completed rehabilitation projects. The department was unaware of the requirements of the FFATA filing and will be scheduling trainings to learn more about grant requirements. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, establishes the Federal Funding Accountability and Transparency Act (FFATA) requirements of reporting the subaward information through the FFATA Subaward Reporting System (FSRS). Title 24 CFR Part 570, Community Development Block Grants, section 506, records to be maintained.

City of Olympia January 1, 2023 through December 31, 2023 2023-003 The City did not have adequate internal controls in place for ensuring compliance with federal special reporting and rehabilitation requirements. Assistance Listing Number and Title: 14.218 Community Development Block Grants Federal Grantor Name: U.S. Department of Housing and Urban Development Federal Award/Contract Number: B16MC530012, B23MC530012, B22MC530012 Pass-through Entity Name: N/A Pass-through Award/Contract Number: N/A Known Questioned Cost Amount: N/A Prior Year Audit Finding: N/A Background The primary objective of the Community Development Block Grants/Entitlement Grants (CDBG) program is to help provide decent and affordable housing, particularly for people with moderate, low, and very low incomes. Funds also help recipients implement strategies for achieving an adequate supply of decent housing and providing suitable living environments and expanded economic opportunities for people with low incomes. In 2023, the City spent $1,109,016 for its CDBG program. Of this amount, it passed $911,886 through to subrecipients. Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Special Reporting for Federal Funding Accountability and Transparency Act (FFATA) The Federal Funding Accountability and Transparency Act (FFATA) requires direct recipients that make first-tier subawards of $30,000 or more to report them in the FFATA Subaward Reporting System (FSRS). The City must report subawards by the end of the month following the month in which it made the subawards. Special Tests and Provisions – Rehabilitation When recipients use CDBG funds for housing rehabilitation projects, federal regulations require them to ensure that the work is properly completed by performing the following: • Conducting pre-rehabilitation inspections to determine deficiencies to be corrected • Incorporating the deficiencies to be corrected into the rehabilitation contract • Inspecting the rehabilitation work upon completion to assure that it is carried out in accordance with contract specifications Description of Condition Special Reporting for Federal Funding Accountability and Transparency Act (FFATA) The City’s internal controls were ineffective for ensuring compliance with FFATA reporting requirements. Specifically, the City made four new subawards in 2023 that exceeded $30,000, and it did not prepare or submit any FFATA reports for these subawards as federal regulations require. We consider these internal control deficiencies to be a material weakness that led to material noncompliance. Special Tests and Provisions – Rehabilitation Our audit found the City did not have a process in place to perform inspections of rehabilitation projects upon completion to ensure the work was carried out in accordance with contract specifications as federal regulations require. We consider this deficiency in internal controls to be a material weakness that led to material noncompliance. Cause of Condition Special Reporting for Federal Funding Accountability and Transparency Act (FFATA) City staff overseeing the program were not aware of the federal FFATA reporting requirements. Special Tests and Provisions – Rehabilitation The City staff overseeing the program did not know that they were required to perform post-rehabilitation inspections themselves to ensure that the project was complete. Staff stated that they have a process in place to review invoices and supporting documentation once work is complete to verify that the work performed appears to be within contract specifications based on documentation submitted. However, they do not physically inspect the project, nor do they require all subrecipients to submit photos or other documentation supporting that the work was performed in accordance with specifications. Effect of Condition Special Reporting for Federal Funding Accountability and Transparency Act (FFATA) Failing to submit the required reports diminishes the federal government's ability to ensure accountability and transparency of federal spending. The table below summarizes the discrepancies we identified. Transactions Tested Subaward not reported Report not timely Subaward amount incorrect* Subaward missing key elements 4 4 N/A N/A N/A Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $ 430,000 $ 430,000 N/A N/A N/A Page 17 Office of the Washington State Auditor sao.wa.gov Special Tests and Provisions – Rehabilitation We tested twenty-five rehabilitation projects and the City could not provide documentation for any of the projects to show that a review or inspection took place upon completion. Therefore, we could not determine the City ensured that contractors carried out and completed the rehabilitation work in accordance with contract specifications. Without documented rehabilitation inspections, the City cannot demonstrate it is complying with program requirements. Failure to comply with program requirements could result in the U.S. Department of Housing and Urban Development withholding future annual allocations of CDBG funding from the City. Recommendation We recommend the City establish and follow internal controls to ensure it prepares and submits FFATA reports for all applicable subawards, as federal regulations require. Further, we recommend the City establish controls and procedures to ensure all applicable housing projects receive rehabilitation inspections upon completion of the work, as federal regulations require. City’s Response The City takes seriously the use of federal funds, and the compliance requirements associated with them. The Housing and Homelessness Response team is committed to ensuring there are no further instances of noncompliance by updating our processes to meet these requirements. The inspections of rehabilitation projects were being performed remotely by reviewing contractor invoices and payments as evidence of work completion. Though each individual project site was not visited, the team did perform on-site monitoring visits at subrecipients’ locations and reviewed subrecipients’ documentation of project files. This process was a holdover from COVID, when we were unable to physically go on site to every project site. As COVID restrictions have lifted, we understand that a physical inspection at each site is now necessary. Moving forward, we have implemented requirements to inspect all sites receiving CDBG rehabilitation funding as a part of project close-out. Staff will also continue to review subrecipient records during monitoring to ensure subrecipients have adequate recordkeeping of completed rehabilitation projects. The department was unaware of the requirements of the FFATA filing and will be scheduling trainings to learn more about grant requirements. We thank the auditors for bringing the requirements to our attention. Auditor’s Remarks We thank the City for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the City’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, establishes the Federal Funding Accountability and Transparency Act (FFATA) requirements of reporting the subaward information through the FFATA Subaward Reporting System (FSRS). Title 24 CFR Part 570, Community Development Block Grants, section 506, records to be maintained.