Audit 321892

Finding 2023-001 – Allowable Costs/Cost Principles, Internal Control Identification of the federal program Assistance listing number and title: 93.493 Congressional Directives Agency: U.S. Department of Health and Human Services Federal award identification number (FAIN): H79FG000881 Federal award year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation) 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls would be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 2 CFR 200.430(i)(1)(i) states that charges to Federal awards for salaries and wages must be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. 2 CFR 200.430(i)(1)(v) also provides that salaries and wages must comply with the established accounting policies and practices of the non-Federal entity. Condition For four (4) of forty (40) payroll expenditures selected for testing, the System’s management did not perform the internal controls over the required allowability criteria. Cause The System failed to effectively implement controls over the required allowability criteria. Effect or potential effect Costs charged to Federal awards may be inaccurate, unallowable, or improperly allocated. Questioned costs None. Context From the population of payroll expenditures totaling $939,170, EY randomly selected 40 employees from different pay periods in 2023 totaling $94,279. Out of the 40 selections, 4 (or 10%) of employees’ timecards did not have evidence of manager’s review and approval of their time charged to the grant totaling $12,463 prior to processing payroll. Identification as a repeat finding, if applicable Not a repeat finding. Recommendation We recommend management to implement effective internal controls over the allowability of costs charged to the federal program. Management must ensure that costs charged to the federal program are adequately documented and reviewed. Views of responsible officials Management will implement an additional review and approval process. Staff assigned to grant activities will provide a screenshot of their bi-weekly timecard to their manager for review and approval. Upon manager review, the document will be forwarded to the grant program leadership team for approval and documentation.

Finding 2023-002, Level of Effort, Internal Control and Noncompliance Identification of the federal program Assistance listing number and title: 93.493 Congressional Directives Agency: U.S. Department of Health and Human Services Federal award identification number (FAIN): H79FG000881, H79FG000989, H79FG000996 Federal Award Year: 2022, 2023 Criteria or specific requirement (including statutory, regulatory or other citation) 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls would be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Each of the Notices of Award (NOA) lists a specific key personnel (also called a Project Director) at a 25% level of effort. Furthermore, the NOAs state that organizations receiving federal funds may not exceed 100% level of effort for any program staff member across all federally funded sources. Any changes to key personnel including level of effort involving separation from the project for more than three months or a 25% reduction in time dedicated to the project requires prior approval and must be submitted as a post-award amendment in eRA Commons. Condition Sufficient evidence was not provided evidencing that the System complied with the 25% level of effort required for the key personnel and whether there were any changes were approved by the Federal agency. Cause The System failed to implement controls over the level of effort requirement. Management did not retain evidence to properly support the level of effort of key personnel. Effect or potential effect The key personnel level of effort required by the grant was not maintained and any changes in the said level of effort was not approved by the Federal agency. Questioned costs None, as the key personnel’s salaries and benefits were not charged to the Federal grant in 2023. Context EY reviewed the three (3) NOAs under the Federal grant and identified three (3) key personnel with a 25% level of effort. Supporting documentation such as timesheet tracking or level of effort certifications was not provided. As a result, the System was unable to substantiate that the required level of effort was met. Per inquiry, management believed that they did not need to substantiate the level of effort indicated in the NOAs because the Federal agency did not require reporting of such. Identification as a repeat finding, if applicable Not a repeat finding. Recommendation Management should develop and implement internal controls to ensure that any level of effort listed in the grant award documents are documented and substantiated. Management should also obtain written communications from the Federal awarding agency for any clarifications they have on the provisions of the grant award documents. Views of responsible officials Management will implement effort tracking for all staff providing in-kind effort to any grant program. Documentation of time spent will be sent to grant management team bi-weekly for review and approval. Management will maintain electronic documentation of this review and approval in the grant files.

Finding 2023-003, Procurement, Suspension and Debarment, Internal Control and Noncompliance Identification of the federal program Assistance listing number and title: 93.493 Congressional Directives Agency: U.S. Department of Health and Human Services Federal award identification number (FAIN): H79FG000996 Federal Award Year: 2023 Criteria or specific requirement (including statutory, regulatory or other citation) 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls would be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 2 CFR 200.318 states that the non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or services required under a Federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standards identified in 2 CFR 200.318 through 200.327. 2 CFR 200.320 discusses the methods of procurement to be followed for the acquisition of property or services required under a Federal award or sub-award. Part 3-I-1 of the 2023 OMB Compliance Supplement summarizes the regulation as follows: • Use the micro-purchase and small purchase methods only for procurements that meet the applicable criteria under 2 CFR sections 200.320(a) (1) and (2). Under the micro-purchase method, the aggregate dollar amount does not exceed $10,000 ($2,000 in the case of acquisition for construction subject to the Wage Rate Requirements (Davis-Bacon Act)). Small purchase procedures are used for purchases that exceed the micro-purchase amount but do not exceed the simplified acquisition threshold ($250,000). Micro-purchases may be awarded without soliciting competitive quotations if the non-federal entity considers the price to be reasonable (2 CFR section 200.320(a)). If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources (2 CFR section 200.320(b)). Criteria or specific requirement (including statutory, regulatory or other citation), continued • For acquisitions exceeding the simplified acquisition threshold, the non-federal entity must use one of the following procurement methods: the sealed bid method if the acquisition meets the criteria in 2 CFR section 200.320(b); the competitive proposals method under the conditions specified in 2 CFR section 200.320((b) (2); or the noncompetitive proposals method (i.e., solicit a proposal from only one source) but only when one or more of four circumstances are met, in accordance with 2 CFR section 200.320(c)). 2 CFR 200.214 provides that non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. Condition The System’s procurement policies did not conform to applicable federal statutes and the procurement requirements identified in 2 CFR Part 200.320, and the suspension and debarment requirements in 2 CFR Part 180. Cause The System’s procurement policies lack certain elements of federal procurement, suspension and debarment standards. Effect or potential effect Not having policies that are consistent with federal requirements could lead to procurements under federal awards being inappropriate, not adequately documented or entered into with covered entities. Questioned costs None. Context The System’s procurement policies did not conform to applicable federal statutes and the procurement requirements identified in 2 CFR Part 200.320. Specifically, the System’s procurement policies did not include a discussion of the criteria, thresholds and procedures to be followed for formal procurement methods (such as sealed bids and proposals), and for noncompetitive procurement. Further, the System’s vendor credentialing policy that is meant to address suspension and debarment requirements, includes a list of certain entities (such as academic institutions) that are exempted from the screening process. No such exemptions are provided for in 2 CFR Part 180. Identification as a repeat finding, if applicable Not a repeat finding. Recommendation: Management should enhance its procurement policies to ensure that all Federal requirements on procurement, suspension and debarment are incorporated. Management must ensure that the policies are supported by effective internal control activities to ensure compliance with Federal requirements. Views of responsible officials Vendor review for suspension and disbarment was performed monthly for all but one vendor in accordance with current CHST policies and management was informed of any vendors with issues; however, documentation of clean vendors was not provided. Management will coordinate with appropriate departments to review federal provisions for grant procurement and adjust policies and procedures to comply. Management will work with appropriate departments and each grant team to document monthly suspension and disbarment review process. Grant teams will review all current sourcing and provide sole source documentation where applicable.

Finding 2023-004 – Schedule of Expenditures of Federal Awards (SEFA) Preparation, Internal Control Identification of the federal program Assistance listing number and title: 93.493 Congressional Directives Agency: U.S. Department of Health and Human Services Federal award identification number (FAIN): H79FG000996 Federal award year: 2023 Criteria or specific requirement (including statutory, regulatory or other citation) Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ‘Standards for Internal Control in the Federal Government’ issued by the Comptroller General of the United States or the ‘Internal Control Integrated Framework,’ issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Title 2, Subtitle A Chapter II Part 200 Subpart F Section 200.510(b) Schedule of expenditures of Federal awards. The auditee must prepare a schedule of expenditures of Federal awards for the period covered by the auditee’s financial statements which must include the total federal awards expended as determined in accordance with Section 200.502. Section 200.502(a) states the determination of when a federal award is expended must be based on when the activity related to the federal award occurs. Condition During the audit, significant adjustments were made to the SEFA in order to reconcile to the underlying detail and supporting documentation. Cause Management did not accurately reflect the expenditures related to one grant on the SEFA resulting in a material change to the major program 93.493 Congressional Directives. Management did not have effective internal controls in place to ensure accurate and complete reporting of the federal program on the SEFA. Effect or potential effect This resulted in an overstatement of the expenditures reported in the initial SEFA. Amounts initially included on the initial SEFA have not yet been requested for reimbursement. Questioned costs None. Context The System was unable to provide supporting documentation for two 2 out of 5 samples pertaining to test and conference fees which were initially selected for testing of direct costs. These expenses were initially based upon calculations and due to turnover, management did not have an understanding of the detailed requirements that comprised the expenses. Management did a complete review of the expenditures for this grant and ultimately concluded to remove these expenditures from the SEFA totaling $112,298. These expenditures have not been submitted for reimbursement, and thus not reflected as questioned costs. Identification as a repeat finding, if applicable This is not a repeat finding. Recommendation The System should develop and implement effective internal controls to ensure the SEFA only includes expenditures which are adequately supported, and for which the System has been reimbursed or intends to submit for reimbursement. View of responsible officials Management will institute additional review procedures and levels of review to SEFA preparation process. Grant project team will review allowable expenditures under grant specific and federal grant requirements prior to SEFA preparation. Management and grant project team will review SEFA amounts prior to submission to auditors.

Finding 2023-005, Allowable Costs/Cost Principles and Period of Performance, Internal Control Identification of the federal program Assistance listing number and title: COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Agency: U.S. Department of Homeland Security Name of the pass-through entity: Texas Division of Emergency Management (TDEM) Federal award identification number (FAIN): 4485DRTXP0000001 Criteria or specific requirement (including statutory, regulatory or other citation) 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls would be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition For all expenditures selected for testing, sufficient evidence was not provided over the control of review of allowability of costs, and of whether the costs were incurred within the period of performance. Cause The System failed to effectively implement controls over the required criteria on allowability and period of performance. Effect or potential effect Costs charged to Federal awards may be inaccurate, unallowable, and incurred outside of the allowable period. Questioned costs None. Context From the population of expenditures amounting to $12,170,642, EY randomly selected 40 expenditures for testing of internal controls. All (or 100%) of the 40 selections totaling $218,630 did not have evidence of the review and approval performed over the allowability of costs and of whether they were incurred within the period of performance. Identification as a repeat finding, if applicable Not a repeat finding. Recommendation We recommend management implement effective internal controls to ensure expenses are allowable under the awarded and incurred in the period of availability. Management must maintain documentation evidencing the controls. Views of responsible officials Management involved in this project performed the review of costs noting such costs were allowable and incurred in the proper period per the program requirements. No documentation of this review and approval was prepared. Management has implemented formal documentation processes to demonstrate that review and approval was performed.

Finding 2023-005, Allowable Costs/Cost Principles and Period of Performance, Internal Control Identification of the federal program Assistance listing number and title: COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Agency: U.S. Department of Homeland Security Name of the pass-through entity: Texas Division of Emergency Management (TDEM) Federal award identification number (FAIN): 4485DRTXP0000001 Criteria or specific requirement (including statutory, regulatory or other citation) 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls would be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition For all expenditures selected for testing, sufficient evidence was not provided over the control of review of allowability of costs, and of whether the costs were incurred within the period of performance. Cause The System failed to effectively implement controls over the required criteria on allowability and period of performance. Effect or potential effect Costs charged to Federal awards may be inaccurate, unallowable, and incurred outside of the allowable period. Questioned costs None. Context From the population of expenditures amounting to $12,170,642, EY randomly selected 40 expenditures for testing of internal controls. All (or 100%) of the 40 selections totaling $218,630 did not have evidence of the review and approval performed over the allowability of costs and of whether they were incurred within the period of performance. Identification as a repeat finding, if applicable Not a repeat finding. Recommendation We recommend management implement effective internal controls to ensure expenses are allowable under the awarded and incurred in the period of availability. Management must maintain documentation evidencing the controls. Views of responsible officials Management involved in this project performed the review of costs noting such costs were allowable and incurred in the proper period per the program requirements. No documentation of this review and approval was prepared. Management has implemented formal documentation processes to demonstrate that review and approval was performed.

Finding 2023-005, Allowable Costs/Cost Principles and Period of Performance, Internal Control Identification of the federal program Assistance listing number and title: COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Agency: U.S. Department of Homeland Security Name of the pass-through entity: Texas Division of Emergency Management (TDEM) Federal award identification number (FAIN): 4485DRTXP0000001 Criteria or specific requirement (including statutory, regulatory or other citation) 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls would be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition For all expenditures selected for testing, sufficient evidence was not provided over the control of review of allowability of costs, and of whether the costs were incurred within the period of performance. Cause The System failed to effectively implement controls over the required criteria on allowability and period of performance. Effect or potential effect Costs charged to Federal awards may be inaccurate, unallowable, and incurred outside of the allowable period. Questioned costs None. Context From the population of expenditures amounting to $12,170,642, EY randomly selected 40 expenditures for testing of internal controls. All (or 100%) of the 40 selections totaling $218,630 did not have evidence of the review and approval performed over the allowability of costs and of whether they were incurred within the period of performance. Identification as a repeat finding, if applicable Not a repeat finding. Recommendation We recommend management implement effective internal controls to ensure expenses are allowable under the awarded and incurred in the period of availability. Management must maintain documentation evidencing the controls. Views of responsible officials Management involved in this project performed the review of costs noting such costs were allowable and incurred in the proper period per the program requirements. No documentation of this review and approval was prepared. Management has implemented formal documentation processes to demonstrate that review and approval was performed.

Finding 2023-005, Allowable Costs/Cost Principles and Period of Performance, Internal Control Identification of the federal program Assistance listing number and title: COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Agency: U.S. Department of Homeland Security Name of the pass-through entity: Texas Division of Emergency Management (TDEM) Federal award identification number (FAIN): 4485DRTXP0000001 Criteria or specific requirement (including statutory, regulatory or other citation) 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls would be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition For all expenditures selected for testing, sufficient evidence was not provided over the control of review of allowability of costs, and of whether the costs were incurred within the period of performance. Cause The System failed to effectively implement controls over the required criteria on allowability and period of performance. Effect or potential effect Costs charged to Federal awards may be inaccurate, unallowable, and incurred outside of the allowable period. Questioned costs None. Context From the population of expenditures amounting to $12,170,642, EY randomly selected 40 expenditures for testing of internal controls. All (or 100%) of the 40 selections totaling $218,630 did not have evidence of the review and approval performed over the allowability of costs and of whether they were incurred within the period of performance. Identification as a repeat finding, if applicable Not a repeat finding. Recommendation We recommend management implement effective internal controls to ensure expenses are allowable under the awarded and incurred in the period of availability. Management must maintain documentation evidencing the controls. Views of responsible officials Management involved in this project performed the review of costs noting such costs were allowable and incurred in the proper period per the program requirements. No documentation of this review and approval was prepared. Management has implemented formal documentation processes to demonstrate that review and approval was performed.

Finding 2023-005, Allowable Costs/Cost Principles and Period of Performance, Internal Control Identification of the federal program Assistance listing number and title: COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Agency: U.S. Department of Homeland Security Name of the pass-through entity: Texas Division of Emergency Management (TDEM) Federal award identification number (FAIN): 4485DRTXP0000001 Criteria or specific requirement (including statutory, regulatory or other citation) 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls would be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition For all expenditures selected for testing, sufficient evidence was not provided over the control of review of allowability of costs, and of whether the costs were incurred within the period of performance. Cause The System failed to effectively implement controls over the required criteria on allowability and period of performance. Effect or potential effect Costs charged to Federal awards may be inaccurate, unallowable, and incurred outside of the allowable period. Questioned costs None. Context From the population of expenditures amounting to $12,170,642, EY randomly selected 40 expenditures for testing of internal controls. All (or 100%) of the 40 selections totaling $218,630 did not have evidence of the review and approval performed over the allowability of costs and of whether they were incurred within the period of performance. Identification as a repeat finding, if applicable Not a repeat finding. Recommendation We recommend management implement effective internal controls to ensure expenses are allowable under the awarded and incurred in the period of availability. Management must maintain documentation evidencing the controls. Views of responsible officials Management involved in this project performed the review of costs noting such costs were allowable and incurred in the proper period per the program requirements. No documentation of this review and approval was prepared. Management has implemented formal documentation processes to demonstrate that review and approval was performed.

Finding 2023-005, Allowable Costs/Cost Principles and Period of Performance, Internal Control Identification of the federal program Assistance listing number and title: COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Agency: U.S. Department of Homeland Security Name of the pass-through entity: Texas Division of Emergency Management (TDEM) Federal award identification number (FAIN): 4485DRTXP0000001 Criteria or specific requirement (including statutory, regulatory or other citation) 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls would be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition For all expenditures selected for testing, sufficient evidence was not provided over the control of review of allowability of costs, and of whether the costs were incurred within the period of performance. Cause The System failed to effectively implement controls over the required criteria on allowability and period of performance. Effect or potential effect Costs charged to Federal awards may be inaccurate, unallowable, and incurred outside of the allowable period. Questioned costs None. Context From the population of expenditures amounting to $12,170,642, EY randomly selected 40 expenditures for testing of internal controls. All (or 100%) of the 40 selections totaling $218,630 did not have evidence of the review and approval performed over the allowability of costs and of whether they were incurred within the period of performance. Identification as a repeat finding, if applicable Not a repeat finding. Recommendation We recommend management implement effective internal controls to ensure expenses are allowable under the awarded and incurred in the period of availability. Management must maintain documentation evidencing the controls. Views of responsible officials Management involved in this project performed the review of costs noting such costs were allowable and incurred in the proper period per the program requirements. No documentation of this review and approval was prepared. Management has implemented formal documentation processes to demonstrate that review and approval was performed.

Finding 2023-001 – Allowable Costs/Cost Principles, Internal Control Identification of the federal program Assistance listing number and title: 93.493 Congressional Directives Agency: U.S. Department of Health and Human Services Federal award identification number (FAIN): H79FG000881 Federal award year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation) 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls would be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 2 CFR 200.430(i)(1)(i) states that charges to Federal awards for salaries and wages must be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. 2 CFR 200.430(i)(1)(v) also provides that salaries and wages must comply with the established accounting policies and practices of the non-Federal entity. Condition For four (4) of forty (40) payroll expenditures selected for testing, the System’s management did not perform the internal controls over the required allowability criteria. Cause The System failed to effectively implement controls over the required allowability criteria. Effect or potential effect Costs charged to Federal awards may be inaccurate, unallowable, or improperly allocated. Questioned costs None. Context From the population of payroll expenditures totaling $939,170, EY randomly selected 40 employees from different pay periods in 2023 totaling $94,279. Out of the 40 selections, 4 (or 10%) of employees’ timecards did not have evidence of manager’s review and approval of their time charged to the grant totaling $12,463 prior to processing payroll. Identification as a repeat finding, if applicable Not a repeat finding. Recommendation We recommend management to implement effective internal controls over the allowability of costs charged to the federal program. Management must ensure that costs charged to the federal program are adequately documented and reviewed. Views of responsible officials Management will implement an additional review and approval process. Staff assigned to grant activities will provide a screenshot of their bi-weekly timecard to their manager for review and approval. Upon manager review, the document will be forwarded to the grant program leadership team for approval and documentation.

Finding 2023-002, Level of Effort, Internal Control and Noncompliance Identification of the federal program Assistance listing number and title: 93.493 Congressional Directives Agency: U.S. Department of Health and Human Services Federal award identification number (FAIN): H79FG000881, H79FG000989, H79FG000996 Federal Award Year: 2022, 2023 Criteria or specific requirement (including statutory, regulatory or other citation) 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls would be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Each of the Notices of Award (NOA) lists a specific key personnel (also called a Project Director) at a 25% level of effort. Furthermore, the NOAs state that organizations receiving federal funds may not exceed 100% level of effort for any program staff member across all federally funded sources. Any changes to key personnel including level of effort involving separation from the project for more than three months or a 25% reduction in time dedicated to the project requires prior approval and must be submitted as a post-award amendment in eRA Commons. Condition Sufficient evidence was not provided evidencing that the System complied with the 25% level of effort required for the key personnel and whether there were any changes were approved by the Federal agency. Cause The System failed to implement controls over the level of effort requirement. Management did not retain evidence to properly support the level of effort of key personnel. Effect or potential effect The key personnel level of effort required by the grant was not maintained and any changes in the said level of effort was not approved by the Federal agency. Questioned costs None, as the key personnel’s salaries and benefits were not charged to the Federal grant in 2023. Context EY reviewed the three (3) NOAs under the Federal grant and identified three (3) key personnel with a 25% level of effort. Supporting documentation such as timesheet tracking or level of effort certifications was not provided. As a result, the System was unable to substantiate that the required level of effort was met. Per inquiry, management believed that they did not need to substantiate the level of effort indicated in the NOAs because the Federal agency did not require reporting of such. Identification as a repeat finding, if applicable Not a repeat finding. Recommendation Management should develop and implement internal controls to ensure that any level of effort listed in the grant award documents are documented and substantiated. Management should also obtain written communications from the Federal awarding agency for any clarifications they have on the provisions of the grant award documents. Views of responsible officials Management will implement effort tracking for all staff providing in-kind effort to any grant program. Documentation of time spent will be sent to grant management team bi-weekly for review and approval. Management will maintain electronic documentation of this review and approval in the grant files.

Finding 2023-003, Procurement, Suspension and Debarment, Internal Control and Noncompliance Identification of the federal program Assistance listing number and title: 93.493 Congressional Directives Agency: U.S. Department of Health and Human Services Federal award identification number (FAIN): H79FG000996 Federal Award Year: 2023 Criteria or specific requirement (including statutory, regulatory or other citation) 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls would be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 2 CFR 200.318 states that the non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or services required under a Federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standards identified in 2 CFR 200.318 through 200.327. 2 CFR 200.320 discusses the methods of procurement to be followed for the acquisition of property or services required under a Federal award or sub-award. Part 3-I-1 of the 2023 OMB Compliance Supplement summarizes the regulation as follows: • Use the micro-purchase and small purchase methods only for procurements that meet the applicable criteria under 2 CFR sections 200.320(a) (1) and (2). Under the micro-purchase method, the aggregate dollar amount does not exceed $10,000 ($2,000 in the case of acquisition for construction subject to the Wage Rate Requirements (Davis-Bacon Act)). Small purchase procedures are used for purchases that exceed the micro-purchase amount but do not exceed the simplified acquisition threshold ($250,000). Micro-purchases may be awarded without soliciting competitive quotations if the non-federal entity considers the price to be reasonable (2 CFR section 200.320(a)). If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources (2 CFR section 200.320(b)). Criteria or specific requirement (including statutory, regulatory or other citation), continued • For acquisitions exceeding the simplified acquisition threshold, the non-federal entity must use one of the following procurement methods: the sealed bid method if the acquisition meets the criteria in 2 CFR section 200.320(b); the competitive proposals method under the conditions specified in 2 CFR section 200.320((b) (2); or the noncompetitive proposals method (i.e., solicit a proposal from only one source) but only when one or more of four circumstances are met, in accordance with 2 CFR section 200.320(c)). 2 CFR 200.214 provides that non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. Condition The System’s procurement policies did not conform to applicable federal statutes and the procurement requirements identified in 2 CFR Part 200.320, and the suspension and debarment requirements in 2 CFR Part 180. Cause The System’s procurement policies lack certain elements of federal procurement, suspension and debarment standards. Effect or potential effect Not having policies that are consistent with federal requirements could lead to procurements under federal awards being inappropriate, not adequately documented or entered into with covered entities. Questioned costs None. Context The System’s procurement policies did not conform to applicable federal statutes and the procurement requirements identified in 2 CFR Part 200.320. Specifically, the System’s procurement policies did not include a discussion of the criteria, thresholds and procedures to be followed for formal procurement methods (such as sealed bids and proposals), and for noncompetitive procurement. Further, the System’s vendor credentialing policy that is meant to address suspension and debarment requirements, includes a list of certain entities (such as academic institutions) that are exempted from the screening process. No such exemptions are provided for in 2 CFR Part 180. Identification as a repeat finding, if applicable Not a repeat finding. Recommendation: Management should enhance its procurement policies to ensure that all Federal requirements on procurement, suspension and debarment are incorporated. Management must ensure that the policies are supported by effective internal control activities to ensure compliance with Federal requirements. Views of responsible officials Vendor review for suspension and disbarment was performed monthly for all but one vendor in accordance with current CHST policies and management was informed of any vendors with issues; however, documentation of clean vendors was not provided. Management will coordinate with appropriate departments to review federal provisions for grant procurement and adjust policies and procedures to comply. Management will work with appropriate departments and each grant team to document monthly suspension and disbarment review process. Grant teams will review all current sourcing and provide sole source documentation where applicable.

Finding 2023-004 – Schedule of Expenditures of Federal Awards (SEFA) Preparation, Internal Control Identification of the federal program Assistance listing number and title: 93.493 Congressional Directives Agency: U.S. Department of Health and Human Services Federal award identification number (FAIN): H79FG000996 Federal award year: 2023 Criteria or specific requirement (including statutory, regulatory or other citation) Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ‘Standards for Internal Control in the Federal Government’ issued by the Comptroller General of the United States or the ‘Internal Control Integrated Framework,’ issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Title 2, Subtitle A Chapter II Part 200 Subpart F Section 200.510(b) Schedule of expenditures of Federal awards. The auditee must prepare a schedule of expenditures of Federal awards for the period covered by the auditee’s financial statements which must include the total federal awards expended as determined in accordance with Section 200.502. Section 200.502(a) states the determination of when a federal award is expended must be based on when the activity related to the federal award occurs. Condition During the audit, significant adjustments were made to the SEFA in order to reconcile to the underlying detail and supporting documentation. Cause Management did not accurately reflect the expenditures related to one grant on the SEFA resulting in a material change to the major program 93.493 Congressional Directives. Management did not have effective internal controls in place to ensure accurate and complete reporting of the federal program on the SEFA. Effect or potential effect This resulted in an overstatement of the expenditures reported in the initial SEFA. Amounts initially included on the initial SEFA have not yet been requested for reimbursement. Questioned costs None. Context The System was unable to provide supporting documentation for two 2 out of 5 samples pertaining to test and conference fees which were initially selected for testing of direct costs. These expenses were initially based upon calculations and due to turnover, management did not have an understanding of the detailed requirements that comprised the expenses. Management did a complete review of the expenditures for this grant and ultimately concluded to remove these expenditures from the SEFA totaling $112,298. These expenditures have not been submitted for reimbursement, and thus not reflected as questioned costs. Identification as a repeat finding, if applicable This is not a repeat finding. Recommendation The System should develop and implement effective internal controls to ensure the SEFA only includes expenditures which are adequately supported, and for which the System has been reimbursed or intends to submit for reimbursement. View of responsible officials Management will institute additional review procedures and levels of review to SEFA preparation process. Grant project team will review allowable expenditures under grant specific and federal grant requirements prior to SEFA preparation. Management and grant project team will review SEFA amounts prior to submission to auditors.

Finding 2023-005, Allowable Costs/Cost Principles and Period of Performance, Internal Control Identification of the federal program Assistance listing number and title: COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Agency: U.S. Department of Homeland Security Name of the pass-through entity: Texas Division of Emergency Management (TDEM) Federal award identification number (FAIN): 4485DRTXP0000001 Criteria or specific requirement (including statutory, regulatory or other citation) 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls would be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition For all expenditures selected for testing, sufficient evidence was not provided over the control of review of allowability of costs, and of whether the costs were incurred within the period of performance. Cause The System failed to effectively implement controls over the required criteria on allowability and period of performance. Effect or potential effect Costs charged to Federal awards may be inaccurate, unallowable, and incurred outside of the allowable period. Questioned costs None. Context From the population of expenditures amounting to $12,170,642, EY randomly selected 40 expenditures for testing of internal controls. All (or 100%) of the 40 selections totaling $218,630 did not have evidence of the review and approval performed over the allowability of costs and of whether they were incurred within the period of performance. Identification as a repeat finding, if applicable Not a repeat finding. Recommendation We recommend management implement effective internal controls to ensure expenses are allowable under the awarded and incurred in the period of availability. Management must maintain documentation evidencing the controls. Views of responsible officials Management involved in this project performed the review of costs noting such costs were allowable and incurred in the proper period per the program requirements. No documentation of this review and approval was prepared. Management has implemented formal documentation processes to demonstrate that review and approval was performed.

Finding 2023-005, Allowable Costs/Cost Principles and Period of Performance, Internal Control Identification of the federal program Assistance listing number and title: COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Agency: U.S. Department of Homeland Security Name of the pass-through entity: Texas Division of Emergency Management (TDEM) Federal award identification number (FAIN): 4485DRTXP0000001 Criteria or specific requirement (including statutory, regulatory or other citation) 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls would be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition For all expenditures selected for testing, sufficient evidence was not provided over the control of review of allowability of costs, and of whether the costs were incurred within the period of performance. Cause The System failed to effectively implement controls over the required criteria on allowability and period of performance. Effect or potential effect Costs charged to Federal awards may be inaccurate, unallowable, and incurred outside of the allowable period. Questioned costs None. Context From the population of expenditures amounting to $12,170,642, EY randomly selected 40 expenditures for testing of internal controls. All (or 100%) of the 40 selections totaling $218,630 did not have evidence of the review and approval performed over the allowability of costs and of whether they were incurred within the period of performance. Identification as a repeat finding, if applicable Not a repeat finding. Recommendation We recommend management implement effective internal controls to ensure expenses are allowable under the awarded and incurred in the period of availability. Management must maintain documentation evidencing the controls. Views of responsible officials Management involved in this project performed the review of costs noting such costs were allowable and incurred in the proper period per the program requirements. No documentation of this review and approval was prepared. Management has implemented formal documentation processes to demonstrate that review and approval was performed.

Finding 2023-005, Allowable Costs/Cost Principles and Period of Performance, Internal Control Identification of the federal program Assistance listing number and title: COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Agency: U.S. Department of Homeland Security Name of the pass-through entity: Texas Division of Emergency Management (TDEM) Federal award identification number (FAIN): 4485DRTXP0000001 Criteria or specific requirement (including statutory, regulatory or other citation) 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls would be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition For all expenditures selected for testing, sufficient evidence was not provided over the control of review of allowability of costs, and of whether the costs were incurred within the period of performance. Cause The System failed to effectively implement controls over the required criteria on allowability and period of performance. Effect or potential effect Costs charged to Federal awards may be inaccurate, unallowable, and incurred outside of the allowable period. Questioned costs None. Context From the population of expenditures amounting to $12,170,642, EY randomly selected 40 expenditures for testing of internal controls. All (or 100%) of the 40 selections totaling $218,630 did not have evidence of the review and approval performed over the allowability of costs and of whether they were incurred within the period of performance. Identification as a repeat finding, if applicable Not a repeat finding. Recommendation We recommend management implement effective internal controls to ensure expenses are allowable under the awarded and incurred in the period of availability. Management must maintain documentation evidencing the controls. Views of responsible officials Management involved in this project performed the review of costs noting such costs were allowable and incurred in the proper period per the program requirements. No documentation of this review and approval was prepared. Management has implemented formal documentation processes to demonstrate that review and approval was performed.

Finding 2023-005, Allowable Costs/Cost Principles and Period of Performance, Internal Control Identification of the federal program Assistance listing number and title: COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Agency: U.S. Department of Homeland Security Name of the pass-through entity: Texas Division of Emergency Management (TDEM) Federal award identification number (FAIN): 4485DRTXP0000001 Criteria or specific requirement (including statutory, regulatory or other citation) 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls would be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition For all expenditures selected for testing, sufficient evidence was not provided over the control of review of allowability of costs, and of whether the costs were incurred within the period of performance. Cause The System failed to effectively implement controls over the required criteria on allowability and period of performance. Effect or potential effect Costs charged to Federal awards may be inaccurate, unallowable, and incurred outside of the allowable period. Questioned costs None. Context From the population of expenditures amounting to $12,170,642, EY randomly selected 40 expenditures for testing of internal controls. All (or 100%) of the 40 selections totaling $218,630 did not have evidence of the review and approval performed over the allowability of costs and of whether they were incurred within the period of performance. Identification as a repeat finding, if applicable Not a repeat finding. Recommendation We recommend management implement effective internal controls to ensure expenses are allowable under the awarded and incurred in the period of availability. Management must maintain documentation evidencing the controls. Views of responsible officials Management involved in this project performed the review of costs noting such costs were allowable and incurred in the proper period per the program requirements. No documentation of this review and approval was prepared. Management has implemented formal documentation processes to demonstrate that review and approval was performed.

Finding 2023-005, Allowable Costs/Cost Principles and Period of Performance, Internal Control Identification of the federal program Assistance listing number and title: COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Agency: U.S. Department of Homeland Security Name of the pass-through entity: Texas Division of Emergency Management (TDEM) Federal award identification number (FAIN): 4485DRTXP0000001 Criteria or specific requirement (including statutory, regulatory or other citation) 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls would be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition For all expenditures selected for testing, sufficient evidence was not provided over the control of review of allowability of costs, and of whether the costs were incurred within the period of performance. Cause The System failed to effectively implement controls over the required criteria on allowability and period of performance. Effect or potential effect Costs charged to Federal awards may be inaccurate, unallowable, and incurred outside of the allowable period. Questioned costs None. Context From the population of expenditures amounting to $12,170,642, EY randomly selected 40 expenditures for testing of internal controls. All (or 100%) of the 40 selections totaling $218,630 did not have evidence of the review and approval performed over the allowability of costs and of whether they were incurred within the period of performance. Identification as a repeat finding, if applicable Not a repeat finding. Recommendation We recommend management implement effective internal controls to ensure expenses are allowable under the awarded and incurred in the period of availability. Management must maintain documentation evidencing the controls. Views of responsible officials Management involved in this project performed the review of costs noting such costs were allowable and incurred in the proper period per the program requirements. No documentation of this review and approval was prepared. Management has implemented formal documentation processes to demonstrate that review and approval was performed.

Finding 2023-005, Allowable Costs/Cost Principles and Period of Performance, Internal Control Identification of the federal program Assistance listing number and title: COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Agency: U.S. Department of Homeland Security Name of the pass-through entity: Texas Division of Emergency Management (TDEM) Federal award identification number (FAIN): 4485DRTXP0000001 Criteria or specific requirement (including statutory, regulatory or other citation) 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls would be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition For all expenditures selected for testing, sufficient evidence was not provided over the control of review of allowability of costs, and of whether the costs were incurred within the period of performance. Cause The System failed to effectively implement controls over the required criteria on allowability and period of performance. Effect or potential effect Costs charged to Federal awards may be inaccurate, unallowable, and incurred outside of the allowable period. Questioned costs None. Context From the population of expenditures amounting to $12,170,642, EY randomly selected 40 expenditures for testing of internal controls. All (or 100%) of the 40 selections totaling $218,630 did not have evidence of the review and approval performed over the allowability of costs and of whether they were incurred within the period of performance. Identification as a repeat finding, if applicable Not a repeat finding. Recommendation We recommend management implement effective internal controls to ensure expenses are allowable under the awarded and incurred in the period of availability. Management must maintain documentation evidencing the controls. Views of responsible officials Management involved in this project performed the review of costs noting such costs were allowable and incurred in the proper period per the program requirements. No documentation of this review and approval was prepared. Management has implemented formal documentation processes to demonstrate that review and approval was performed.