Audit 344351

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. The auditor noted CUAHSI incorrectly identified the qualified expenditures related to the federal grant programs. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes. Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2019-006. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-004 REPORTING - DCF Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022 (COVID-19 extension). The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (January 20, 2025) or nine months after CUAHSI’s year end (September 30, 2021) that was extended to March 31, 2022 due to COVID-19. Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG. Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-007. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-005 SUBRECIPIENT MONITORING Criteria The regulations are documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h); (Requirements for Pass-Through Entities). The criteria for monitoring subrecipients of federal awards should be following federal regulations, the terms of the federal contract, and any additional requirements specified by the auditee's policies and procedures. Specifically, the monitoring criteria should include, but not be limited to, the following: • Subrecipient Risk Assessment • Financial Monitoring • Compliance Monitoring • Reporting and Documentation Condition The auditee failed to comply with federal regulations requiring the monitoring of subrecipients for federal awards on a timely basis. Recipients of federal awards are responsible for monitoring the activities of subrecipients to ensure that they comply with applicable laws, regulations, and the terms and conditions of the federal award. CUAHSI did not complete the monitoring of its 2020 subrecipients until 2024. During the year ended December 31, 2020, CUAHSI had $206,636 in amounts paid to subrecipients. Based on our testing of amounts paid to subrecipients, no amounts were identified as unallowable. Cause & Context CUAHSI had a policy and procedure manual in place which outlined the steps for monitoring. There was no audit evidence of CUAHSI following the policy and monitoring that the subrecipient was using the funding as prescribed during the year ended December 31, 2020. Effect CUAHSI’s lack of monitoring creates a significant risk of the possible misuse or improper use of funds. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-002. Recommendation The auditor recommends that management review the requirements documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h);(Requirements for Pass-Through Entities) and develops and implements procedures to adhere to such requirements. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-006 CASH MANAGEMENT Criteria 2 CFR Part 200 states that entities expending federal grants must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and the terms and conditions of the Federal award. To comply with 2 CFR Part 200, CUAHSI was required to submit monthly invoices for the funds received under the federal contract. These invoices will serve as a record of the services or goods provided during the specified period and will facilitate accurate tracking and reporting of the funds. In addition to the invoice, any supporting documentation, such as timesheets, should be maintained with the invoices. The cash management process should also be adjusted for the receipt of program income. These documents validate the services provided and ensure transparency and auditability of the invoiced amount. These amounts should be able to be traced to the general ledger in conjunction with the time in which they are billed. Condition The cash management process requires that cash draws be reviewed and approved to ensure the propriety of draw reimbursement requests. Management was unable to provide the auditor evidence documenting approval of the drawdowns for the year ended December 31, 2020. Cause & Context CUAHSI had no fiscal management team during the year ended December 31, 2020 to ensure compliance with proper policies and procedures. The books and records for the year ended December 31, 2020 were recreated by the current management team during 2023 to 2024. Effect Grant awards and reimbursements may not be recorded correctly and there is a higher risk of error or misappropriation of assets. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-003. Recommendation The auditor recommends CUAHSI develop and implement controls to ensure an adequate review process is in place for review of reimbursement requests submitted to granting agencies to ensure consistent reporting. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-007 PROCUREMENT, SUSPENSION AND DEBARMENT Criteria The requirements for this compliance requirement are contained in 2 CFR sections 200.317- 200.326; 48 CFR parts 03, 15, 44, and the clauses at 48 CRF sections 52.244-2, 52.244-5, 52.203-13, 52.203-16 and 52.215-12; agency FAR supplements; 2 CFR part 180; OMB M-18-18; and the terms and conditions of the federal award. There is a requirement to verify that contractors in covered transactions or any of its vendors are not federally debarred, suspended, or excluded. A covered transaction is a nonprocurement or procurement transaction in excess of $25,000 that is subject to the prohibitions noted in 2 CFR part 180. The covered transaction may be at the primary tier, between a federal agency and a person or a lower tier between a participant in a covered transaction and another person. Condition During the completion of the audit, the auditor noted that CUAHSI failed to maintain and provide the proper records and support to document their review of vendor files for covered transactions. Such failure led to non-compliance with the procurement, suspension and debarment policies in accordance with the UG for the year ended December 31, 2020. CUAHSI did not complete the verification of its 2020 vendors until 2024. Based on our testing, no contractors in covered transactions were deemed to be federally debarred, suspended or excluded. Cause & Context CUAHSI has a policy in place to meet the procurement requirements but there was no evidence of compliance with that policy. Effect As a result of noncompliance, there could be possible repayment of funds, loss of reputation and possible suspension or debarment. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-004. Recommendation It is recommended that CUAHSI strive to prioritize compliance. CUAHSI should ensure that, to the extent practicable, the use of a competitive procurement process in compliance with 2 CFR section 200/317. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-008 CASH MANAGEMENT - FEDERAL DRAWDOWNS IN ADVANCE OF EXPENDITURES Criteria CFR § 200.305 Cash management: This section of the CFR outlines the requirements for the management of cash drawdowns and disbursements of federal funds. Federal funds should be disbursed in a timely manner for allowable costs that have been incurred. Cash advances must meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation. Condition CUAHSI did not meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation which details the requirements for advance fundings. During 2020, CUAHSI had advance drawdowns totaling $3,610,240 from the NSF. Of this amount, CUAHSI incurred $2,521,926 in eligible expenses for the year ended December 31, 2020. This resulted in $1,088,314 in excess federal advances as of year-end. The draw downs in excess of revenue recognized during the year ended December 31, 2020 are reported as part of deferred revenue in the accompanying Statement of Financial Position. Cause & Context In anticipation of a government shut down due to COVID-19, CUAHSI initiated advance drawdowns without following the guidelines set forth by Chapter VIII.C.3 of the grant agreement. Effect Drawing down funds in advance of incurring eligible expenses could lead to non-compliance with federal regulations, such as those outlined in 2 CFR § 200.305. This may result in the need to repay the funds, potential financial penalties, or disqualification from future federal funding. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-009. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.35. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-009 PROGRAM INCOME Criteria Pursuant to 2 CFR 200 for award objectives and the regulations at 2 CFR 200.307, program income is defined as “Gross income earned by the recipient that is directly generated by a supported activity or earned as a result of the federal award during the period of performance” by 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. Condition Program income consists of registration fees collected for training, meetings or workshops and the proceeds from the sale of publications as a result of the federal award during the period of performance. Program income is treated as an additive to the federal funds received by CUAHSI. During a drawdown, program income reduces the amount that is requested to cover reimbursable costs through the Flexible Billing module. This allows program income to be applied to the award before a reimbursement is requested from NSF adding the value of program income received to the awarded amount. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. CUAHSI program income totaled $85,267 for the year ended December 31, 2020. CUAHSI failed to submit the required Program Income Reporting Worksheet by the required deadline of forty five (45) days after the end of the year (February 15, 2021) to ensure with the program income policies in accordance with the UG for the year ended December 31, 2020. Cause & Context Lack of resources and detailed attention to the risks, along with circumvention of controls has resulted in weak internal controls, and conflicting or incomplete policies and procedures. Effect Non-compliance can lead to penalties, fines, or even termination of the contract. It may also damage CUAHSI’s reputation and future eligibility for federal funding and jeopardize CUAHSI’s ability to secure future grants or contracts from other funding agencies. Granting organizations typically prioritize funding recipients with a track record of compliance and accountability. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-011. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.307. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. The auditor noted CUAHSI incorrectly identified the qualified expenditures related to the federal grant programs. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes. Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2019-006. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-004 REPORTING - DCF Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022 (COVID-19 extension). The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (January 20, 2025) or nine months after CUAHSI’s year end (September 30, 2021) that was extended to March 31, 2022 due to COVID-19. Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG. Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-007. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-005 SUBRECIPIENT MONITORING Criteria The regulations are documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h); (Requirements for Pass-Through Entities). The criteria for monitoring subrecipients of federal awards should be following federal regulations, the terms of the federal contract, and any additional requirements specified by the auditee's policies and procedures. Specifically, the monitoring criteria should include, but not be limited to, the following: • Subrecipient Risk Assessment • Financial Monitoring • Compliance Monitoring • Reporting and Documentation Condition The auditee failed to comply with federal regulations requiring the monitoring of subrecipients for federal awards on a timely basis. Recipients of federal awards are responsible for monitoring the activities of subrecipients to ensure that they comply with applicable laws, regulations, and the terms and conditions of the federal award. CUAHSI did not complete the monitoring of its 2020 subrecipients until 2024. During the year ended December 31, 2020, CUAHSI had $206,636 in amounts paid to subrecipients. Based on our testing of amounts paid to subrecipients, no amounts were identified as unallowable. Cause & Context CUAHSI had a policy and procedure manual in place which outlined the steps for monitoring. There was no audit evidence of CUAHSI following the policy and monitoring that the subrecipient was using the funding as prescribed during the year ended December 31, 2020. Effect CUAHSI’s lack of monitoring creates a significant risk of the possible misuse or improper use of funds. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-002. Recommendation The auditor recommends that management review the requirements documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h);(Requirements for Pass-Through Entities) and develops and implements procedures to adhere to such requirements. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-006 CASH MANAGEMENT Criteria 2 CFR Part 200 states that entities expending federal grants must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and the terms and conditions of the Federal award. To comply with 2 CFR Part 200, CUAHSI was required to submit monthly invoices for the funds received under the federal contract. These invoices will serve as a record of the services or goods provided during the specified period and will facilitate accurate tracking and reporting of the funds. In addition to the invoice, any supporting documentation, such as timesheets, should be maintained with the invoices. The cash management process should also be adjusted for the receipt of program income. These documents validate the services provided and ensure transparency and auditability of the invoiced amount. These amounts should be able to be traced to the general ledger in conjunction with the time in which they are billed. Condition The cash management process requires that cash draws be reviewed and approved to ensure the propriety of draw reimbursement requests. Management was unable to provide the auditor evidence documenting approval of the drawdowns for the year ended December 31, 2020. Cause & Context CUAHSI had no fiscal management team during the year ended December 31, 2020 to ensure compliance with proper policies and procedures. The books and records for the year ended December 31, 2020 were recreated by the current management team during 2023 to 2024. Effect Grant awards and reimbursements may not be recorded correctly and there is a higher risk of error or misappropriation of assets. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-003. Recommendation The auditor recommends CUAHSI develop and implement controls to ensure an adequate review process is in place for review of reimbursement requests submitted to granting agencies to ensure consistent reporting. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-007 PROCUREMENT, SUSPENSION AND DEBARMENT Criteria The requirements for this compliance requirement are contained in 2 CFR sections 200.317- 200.326; 48 CFR parts 03, 15, 44, and the clauses at 48 CRF sections 52.244-2, 52.244-5, 52.203-13, 52.203-16 and 52.215-12; agency FAR supplements; 2 CFR part 180; OMB M-18-18; and the terms and conditions of the federal award. There is a requirement to verify that contractors in covered transactions or any of its vendors are not federally debarred, suspended, or excluded. A covered transaction is a nonprocurement or procurement transaction in excess of $25,000 that is subject to the prohibitions noted in 2 CFR part 180. The covered transaction may be at the primary tier, between a federal agency and a person or a lower tier between a participant in a covered transaction and another person. Condition During the completion of the audit, the auditor noted that CUAHSI failed to maintain and provide the proper records and support to document their review of vendor files for covered transactions. Such failure led to non-compliance with the procurement, suspension and debarment policies in accordance with the UG for the year ended December 31, 2020. CUAHSI did not complete the verification of its 2020 vendors until 2024. Based on our testing, no contractors in covered transactions were deemed to be federally debarred, suspended or excluded. Cause & Context CUAHSI has a policy in place to meet the procurement requirements but there was no evidence of compliance with that policy. Effect As a result of noncompliance, there could be possible repayment of funds, loss of reputation and possible suspension or debarment. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-004. Recommendation It is recommended that CUAHSI strive to prioritize compliance. CUAHSI should ensure that, to the extent practicable, the use of a competitive procurement process in compliance with 2 CFR section 200/317. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-008 CASH MANAGEMENT - FEDERAL DRAWDOWNS IN ADVANCE OF EXPENDITURES Criteria CFR § 200.305 Cash management: This section of the CFR outlines the requirements for the management of cash drawdowns and disbursements of federal funds. Federal funds should be disbursed in a timely manner for allowable costs that have been incurred. Cash advances must meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation. Condition CUAHSI did not meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation which details the requirements for advance fundings. During 2020, CUAHSI had advance drawdowns totaling $3,610,240 from the NSF. Of this amount, CUAHSI incurred $2,521,926 in eligible expenses for the year ended December 31, 2020. This resulted in $1,088,314 in excess federal advances as of year-end. The draw downs in excess of revenue recognized during the year ended December 31, 2020 are reported as part of deferred revenue in the accompanying Statement of Financial Position. Cause & Context In anticipation of a government shut down due to COVID-19, CUAHSI initiated advance drawdowns without following the guidelines set forth by Chapter VIII.C.3 of the grant agreement. Effect Drawing down funds in advance of incurring eligible expenses could lead to non-compliance with federal regulations, such as those outlined in 2 CFR § 200.305. This may result in the need to repay the funds, potential financial penalties, or disqualification from future federal funding. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-009. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.35. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-009 PROGRAM INCOME Criteria Pursuant to 2 CFR 200 for award objectives and the regulations at 2 CFR 200.307, program income is defined as “Gross income earned by the recipient that is directly generated by a supported activity or earned as a result of the federal award during the period of performance” by 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. Condition Program income consists of registration fees collected for training, meetings or workshops and the proceeds from the sale of publications as a result of the federal award during the period of performance. Program income is treated as an additive to the federal funds received by CUAHSI. During a drawdown, program income reduces the amount that is requested to cover reimbursable costs through the Flexible Billing module. This allows program income to be applied to the award before a reimbursement is requested from NSF adding the value of program income received to the awarded amount. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. CUAHSI program income totaled $85,267 for the year ended December 31, 2020. CUAHSI failed to submit the required Program Income Reporting Worksheet by the required deadline of forty five (45) days after the end of the year (February 15, 2021) to ensure with the program income policies in accordance with the UG for the year ended December 31, 2020. Cause & Context Lack of resources and detailed attention to the risks, along with circumvention of controls has resulted in weak internal controls, and conflicting or incomplete policies and procedures. Effect Non-compliance can lead to penalties, fines, or even termination of the contract. It may also damage CUAHSI’s reputation and future eligibility for federal funding and jeopardize CUAHSI’s ability to secure future grants or contracts from other funding agencies. Granting organizations typically prioritize funding recipients with a track record of compliance and accountability. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-011. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.307. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. The auditor noted CUAHSI incorrectly identified the qualified expenditures related to the federal grant programs. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes. Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2019-006. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-004 REPORTING - DCF Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022 (COVID-19 extension). The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (January 20, 2025) or nine months after CUAHSI’s year end (September 30, 2021) that was extended to March 31, 2022 due to COVID-19. Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG. Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-007. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-005 SUBRECIPIENT MONITORING Criteria The regulations are documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h); (Requirements for Pass-Through Entities). The criteria for monitoring subrecipients of federal awards should be following federal regulations, the terms of the federal contract, and any additional requirements specified by the auditee's policies and procedures. Specifically, the monitoring criteria should include, but not be limited to, the following: • Subrecipient Risk Assessment • Financial Monitoring • Compliance Monitoring • Reporting and Documentation Condition The auditee failed to comply with federal regulations requiring the monitoring of subrecipients for federal awards on a timely basis. Recipients of federal awards are responsible for monitoring the activities of subrecipients to ensure that they comply with applicable laws, regulations, and the terms and conditions of the federal award. CUAHSI did not complete the monitoring of its 2020 subrecipients until 2024. During the year ended December 31, 2020, CUAHSI had $206,636 in amounts paid to subrecipients. Based on our testing of amounts paid to subrecipients, no amounts were identified as unallowable. Cause & Context CUAHSI had a policy and procedure manual in place which outlined the steps for monitoring. There was no audit evidence of CUAHSI following the policy and monitoring that the subrecipient was using the funding as prescribed during the year ended December 31, 2020. Effect CUAHSI’s lack of monitoring creates a significant risk of the possible misuse or improper use of funds. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-002. Recommendation The auditor recommends that management review the requirements documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h);(Requirements for Pass-Through Entities) and develops and implements procedures to adhere to such requirements. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-006 CASH MANAGEMENT Criteria 2 CFR Part 200 states that entities expending federal grants must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and the terms and conditions of the Federal award. To comply with 2 CFR Part 200, CUAHSI was required to submit monthly invoices for the funds received under the federal contract. These invoices will serve as a record of the services or goods provided during the specified period and will facilitate accurate tracking and reporting of the funds. In addition to the invoice, any supporting documentation, such as timesheets, should be maintained with the invoices. The cash management process should also be adjusted for the receipt of program income. These documents validate the services provided and ensure transparency and auditability of the invoiced amount. These amounts should be able to be traced to the general ledger in conjunction with the time in which they are billed. Condition The cash management process requires that cash draws be reviewed and approved to ensure the propriety of draw reimbursement requests. Management was unable to provide the auditor evidence documenting approval of the drawdowns for the year ended December 31, 2020. Cause & Context CUAHSI had no fiscal management team during the year ended December 31, 2020 to ensure compliance with proper policies and procedures. The books and records for the year ended December 31, 2020 were recreated by the current management team during 2023 to 2024. Effect Grant awards and reimbursements may not be recorded correctly and there is a higher risk of error or misappropriation of assets. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-003. Recommendation The auditor recommends CUAHSI develop and implement controls to ensure an adequate review process is in place for review of reimbursement requests submitted to granting agencies to ensure consistent reporting. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-007 PROCUREMENT, SUSPENSION AND DEBARMENT Criteria The requirements for this compliance requirement are contained in 2 CFR sections 200.317- 200.326; 48 CFR parts 03, 15, 44, and the clauses at 48 CRF sections 52.244-2, 52.244-5, 52.203-13, 52.203-16 and 52.215-12; agency FAR supplements; 2 CFR part 180; OMB M-18-18; and the terms and conditions of the federal award. There is a requirement to verify that contractors in covered transactions or any of its vendors are not federally debarred, suspended, or excluded. A covered transaction is a nonprocurement or procurement transaction in excess of $25,000 that is subject to the prohibitions noted in 2 CFR part 180. The covered transaction may be at the primary tier, between a federal agency and a person or a lower tier between a participant in a covered transaction and another person. Condition During the completion of the audit, the auditor noted that CUAHSI failed to maintain and provide the proper records and support to document their review of vendor files for covered transactions. Such failure led to non-compliance with the procurement, suspension and debarment policies in accordance with the UG for the year ended December 31, 2020. CUAHSI did not complete the verification of its 2020 vendors until 2024. Based on our testing, no contractors in covered transactions were deemed to be federally debarred, suspended or excluded. Cause & Context CUAHSI has a policy in place to meet the procurement requirements but there was no evidence of compliance with that policy. Effect As a result of noncompliance, there could be possible repayment of funds, loss of reputation and possible suspension or debarment. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-004. Recommendation It is recommended that CUAHSI strive to prioritize compliance. CUAHSI should ensure that, to the extent practicable, the use of a competitive procurement process in compliance with 2 CFR section 200/317. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-008 CASH MANAGEMENT - FEDERAL DRAWDOWNS IN ADVANCE OF EXPENDITURES Criteria CFR § 200.305 Cash management: This section of the CFR outlines the requirements for the management of cash drawdowns and disbursements of federal funds. Federal funds should be disbursed in a timely manner for allowable costs that have been incurred. Cash advances must meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation. Condition CUAHSI did not meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation which details the requirements for advance fundings. During 2020, CUAHSI had advance drawdowns totaling $3,610,240 from the NSF. Of this amount, CUAHSI incurred $2,521,926 in eligible expenses for the year ended December 31, 2020. This resulted in $1,088,314 in excess federal advances as of year-end. The draw downs in excess of revenue recognized during the year ended December 31, 2020 are reported as part of deferred revenue in the accompanying Statement of Financial Position. Cause & Context In anticipation of a government shut down due to COVID-19, CUAHSI initiated advance drawdowns without following the guidelines set forth by Chapter VIII.C.3 of the grant agreement. Effect Drawing down funds in advance of incurring eligible expenses could lead to non-compliance with federal regulations, such as those outlined in 2 CFR § 200.305. This may result in the need to repay the funds, potential financial penalties, or disqualification from future federal funding. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-009. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.35. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-009 PROGRAM INCOME Criteria Pursuant to 2 CFR 200 for award objectives and the regulations at 2 CFR 200.307, program income is defined as “Gross income earned by the recipient that is directly generated by a supported activity or earned as a result of the federal award during the period of performance” by 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. Condition Program income consists of registration fees collected for training, meetings or workshops and the proceeds from the sale of publications as a result of the federal award during the period of performance. Program income is treated as an additive to the federal funds received by CUAHSI. During a drawdown, program income reduces the amount that is requested to cover reimbursable costs through the Flexible Billing module. This allows program income to be applied to the award before a reimbursement is requested from NSF adding the value of program income received to the awarded amount. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. CUAHSI program income totaled $85,267 for the year ended December 31, 2020. CUAHSI failed to submit the required Program Income Reporting Worksheet by the required deadline of forty five (45) days after the end of the year (February 15, 2021) to ensure with the program income policies in accordance with the UG for the year ended December 31, 2020. Cause & Context Lack of resources and detailed attention to the risks, along with circumvention of controls has resulted in weak internal controls, and conflicting or incomplete policies and procedures. Effect Non-compliance can lead to penalties, fines, or even termination of the contract. It may also damage CUAHSI’s reputation and future eligibility for federal funding and jeopardize CUAHSI’s ability to secure future grants or contracts from other funding agencies. Granting organizations typically prioritize funding recipients with a track record of compliance and accountability. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-011. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.307. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. The auditor noted CUAHSI incorrectly identified the qualified expenditures related to the federal grant programs. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes. Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2019-006. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-004 REPORTING - DCF Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022 (COVID-19 extension). The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (January 20, 2025) or nine months after CUAHSI’s year end (September 30, 2021) that was extended to March 31, 2022 due to COVID-19. Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG. Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-007. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-005 SUBRECIPIENT MONITORING Criteria The regulations are documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h); (Requirements for Pass-Through Entities). The criteria for monitoring subrecipients of federal awards should be following federal regulations, the terms of the federal contract, and any additional requirements specified by the auditee's policies and procedures. Specifically, the monitoring criteria should include, but not be limited to, the following: • Subrecipient Risk Assessment • Financial Monitoring • Compliance Monitoring • Reporting and Documentation Condition The auditee failed to comply with federal regulations requiring the monitoring of subrecipients for federal awards on a timely basis. Recipients of federal awards are responsible for monitoring the activities of subrecipients to ensure that they comply with applicable laws, regulations, and the terms and conditions of the federal award. CUAHSI did not complete the monitoring of its 2020 subrecipients until 2024. During the year ended December 31, 2020, CUAHSI had $206,636 in amounts paid to subrecipients. Based on our testing of amounts paid to subrecipients, no amounts were identified as unallowable. Cause & Context CUAHSI had a policy and procedure manual in place which outlined the steps for monitoring. There was no audit evidence of CUAHSI following the policy and monitoring that the subrecipient was using the funding as prescribed during the year ended December 31, 2020. Effect CUAHSI’s lack of monitoring creates a significant risk of the possible misuse or improper use of funds. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-002. Recommendation The auditor recommends that management review the requirements documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h);(Requirements for Pass-Through Entities) and develops and implements procedures to adhere to such requirements. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-006 CASH MANAGEMENT Criteria 2 CFR Part 200 states that entities expending federal grants must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and the terms and conditions of the Federal award. To comply with 2 CFR Part 200, CUAHSI was required to submit monthly invoices for the funds received under the federal contract. These invoices will serve as a record of the services or goods provided during the specified period and will facilitate accurate tracking and reporting of the funds. In addition to the invoice, any supporting documentation, such as timesheets, should be maintained with the invoices. The cash management process should also be adjusted for the receipt of program income. These documents validate the services provided and ensure transparency and auditability of the invoiced amount. These amounts should be able to be traced to the general ledger in conjunction with the time in which they are billed. Condition The cash management process requires that cash draws be reviewed and approved to ensure the propriety of draw reimbursement requests. Management was unable to provide the auditor evidence documenting approval of the drawdowns for the year ended December 31, 2020. Cause & Context CUAHSI had no fiscal management team during the year ended December 31, 2020 to ensure compliance with proper policies and procedures. The books and records for the year ended December 31, 2020 were recreated by the current management team during 2023 to 2024. Effect Grant awards and reimbursements may not be recorded correctly and there is a higher risk of error or misappropriation of assets. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-003. Recommendation The auditor recommends CUAHSI develop and implement controls to ensure an adequate review process is in place for review of reimbursement requests submitted to granting agencies to ensure consistent reporting. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-007 PROCUREMENT, SUSPENSION AND DEBARMENT Criteria The requirements for this compliance requirement are contained in 2 CFR sections 200.317- 200.326; 48 CFR parts 03, 15, 44, and the clauses at 48 CRF sections 52.244-2, 52.244-5, 52.203-13, 52.203-16 and 52.215-12; agency FAR supplements; 2 CFR part 180; OMB M-18-18; and the terms and conditions of the federal award. There is a requirement to verify that contractors in covered transactions or any of its vendors are not federally debarred, suspended, or excluded. A covered transaction is a nonprocurement or procurement transaction in excess of $25,000 that is subject to the prohibitions noted in 2 CFR part 180. The covered transaction may be at the primary tier, between a federal agency and a person or a lower tier between a participant in a covered transaction and another person. Condition During the completion of the audit, the auditor noted that CUAHSI failed to maintain and provide the proper records and support to document their review of vendor files for covered transactions. Such failure led to non-compliance with the procurement, suspension and debarment policies in accordance with the UG for the year ended December 31, 2020. CUAHSI did not complete the verification of its 2020 vendors until 2024. Based on our testing, no contractors in covered transactions were deemed to be federally debarred, suspended or excluded. Cause & Context CUAHSI has a policy in place to meet the procurement requirements but there was no evidence of compliance with that policy. Effect As a result of noncompliance, there could be possible repayment of funds, loss of reputation and possible suspension or debarment. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-004. Recommendation It is recommended that CUAHSI strive to prioritize compliance. CUAHSI should ensure that, to the extent practicable, the use of a competitive procurement process in compliance with 2 CFR section 200/317. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-008 CASH MANAGEMENT - FEDERAL DRAWDOWNS IN ADVANCE OF EXPENDITURES Criteria CFR § 200.305 Cash management: This section of the CFR outlines the requirements for the management of cash drawdowns and disbursements of federal funds. Federal funds should be disbursed in a timely manner for allowable costs that have been incurred. Cash advances must meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation. Condition CUAHSI did not meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation which details the requirements for advance fundings. During 2020, CUAHSI had advance drawdowns totaling $3,610,240 from the NSF. Of this amount, CUAHSI incurred $2,521,926 in eligible expenses for the year ended December 31, 2020. This resulted in $1,088,314 in excess federal advances as of year-end. The draw downs in excess of revenue recognized during the year ended December 31, 2020 are reported as part of deferred revenue in the accompanying Statement of Financial Position. Cause & Context In anticipation of a government shut down due to COVID-19, CUAHSI initiated advance drawdowns without following the guidelines set forth by Chapter VIII.C.3 of the grant agreement. Effect Drawing down funds in advance of incurring eligible expenses could lead to non-compliance with federal regulations, such as those outlined in 2 CFR § 200.305. This may result in the need to repay the funds, potential financial penalties, or disqualification from future federal funding. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-009. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.35. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-009 PROGRAM INCOME Criteria Pursuant to 2 CFR 200 for award objectives and the regulations at 2 CFR 200.307, program income is defined as “Gross income earned by the recipient that is directly generated by a supported activity or earned as a result of the federal award during the period of performance” by 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. Condition Program income consists of registration fees collected for training, meetings or workshops and the proceeds from the sale of publications as a result of the federal award during the period of performance. Program income is treated as an additive to the federal funds received by CUAHSI. During a drawdown, program income reduces the amount that is requested to cover reimbursable costs through the Flexible Billing module. This allows program income to be applied to the award before a reimbursement is requested from NSF adding the value of program income received to the awarded amount. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. CUAHSI program income totaled $85,267 for the year ended December 31, 2020. CUAHSI failed to submit the required Program Income Reporting Worksheet by the required deadline of forty five (45) days after the end of the year (February 15, 2021) to ensure with the program income policies in accordance with the UG for the year ended December 31, 2020. Cause & Context Lack of resources and detailed attention to the risks, along with circumvention of controls has resulted in weak internal controls, and conflicting or incomplete policies and procedures. Effect Non-compliance can lead to penalties, fines, or even termination of the contract. It may also damage CUAHSI’s reputation and future eligibility for federal funding and jeopardize CUAHSI’s ability to secure future grants or contracts from other funding agencies. Granting organizations typically prioritize funding recipients with a track record of compliance and accountability. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-011. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.307. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. The auditor noted CUAHSI incorrectly identified the qualified expenditures related to the federal grant programs. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes. Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2019-006. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-004 REPORTING - DCF Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022 (COVID-19 extension). The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (January 20, 2025) or nine months after CUAHSI’s year end (September 30, 2021) that was extended to March 31, 2022 due to COVID-19. Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG. Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-007. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-005 SUBRECIPIENT MONITORING Criteria The regulations are documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h); (Requirements for Pass-Through Entities). The criteria for monitoring subrecipients of federal awards should be following federal regulations, the terms of the federal contract, and any additional requirements specified by the auditee's policies and procedures. Specifically, the monitoring criteria should include, but not be limited to, the following: • Subrecipient Risk Assessment • Financial Monitoring • Compliance Monitoring • Reporting and Documentation Condition The auditee failed to comply with federal regulations requiring the monitoring of subrecipients for federal awards on a timely basis. Recipients of federal awards are responsible for monitoring the activities of subrecipients to ensure that they comply with applicable laws, regulations, and the terms and conditions of the federal award. CUAHSI did not complete the monitoring of its 2020 subrecipients until 2024. During the year ended December 31, 2020, CUAHSI had $206,636 in amounts paid to subrecipients. Based on our testing of amounts paid to subrecipients, no amounts were identified as unallowable. Cause & Context CUAHSI had a policy and procedure manual in place which outlined the steps for monitoring. There was no audit evidence of CUAHSI following the policy and monitoring that the subrecipient was using the funding as prescribed during the year ended December 31, 2020. Effect CUAHSI’s lack of monitoring creates a significant risk of the possible misuse or improper use of funds. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-002. Recommendation The auditor recommends that management review the requirements documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h);(Requirements for Pass-Through Entities) and develops and implements procedures to adhere to such requirements. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-006 CASH MANAGEMENT Criteria 2 CFR Part 200 states that entities expending federal grants must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and the terms and conditions of the Federal award. To comply with 2 CFR Part 200, CUAHSI was required to submit monthly invoices for the funds received under the federal contract. These invoices will serve as a record of the services or goods provided during the specified period and will facilitate accurate tracking and reporting of the funds. In addition to the invoice, any supporting documentation, such as timesheets, should be maintained with the invoices. The cash management process should also be adjusted for the receipt of program income. These documents validate the services provided and ensure transparency and auditability of the invoiced amount. These amounts should be able to be traced to the general ledger in conjunction with the time in which they are billed. Condition The cash management process requires that cash draws be reviewed and approved to ensure the propriety of draw reimbursement requests. Management was unable to provide the auditor evidence documenting approval of the drawdowns for the year ended December 31, 2020. Cause & Context CUAHSI had no fiscal management team during the year ended December 31, 2020 to ensure compliance with proper policies and procedures. The books and records for the year ended December 31, 2020 were recreated by the current management team during 2023 to 2024. Effect Grant awards and reimbursements may not be recorded correctly and there is a higher risk of error or misappropriation of assets. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-003. Recommendation The auditor recommends CUAHSI develop and implement controls to ensure an adequate review process is in place for review of reimbursement requests submitted to granting agencies to ensure consistent reporting. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-007 PROCUREMENT, SUSPENSION AND DEBARMENT Criteria The requirements for this compliance requirement are contained in 2 CFR sections 200.317- 200.326; 48 CFR parts 03, 15, 44, and the clauses at 48 CRF sections 52.244-2, 52.244-5, 52.203-13, 52.203-16 and 52.215-12; agency FAR supplements; 2 CFR part 180; OMB M-18-18; and the terms and conditions of the federal award. There is a requirement to verify that contractors in covered transactions or any of its vendors are not federally debarred, suspended, or excluded. A covered transaction is a nonprocurement or procurement transaction in excess of $25,000 that is subject to the prohibitions noted in 2 CFR part 180. The covered transaction may be at the primary tier, between a federal agency and a person or a lower tier between a participant in a covered transaction and another person. Condition During the completion of the audit, the auditor noted that CUAHSI failed to maintain and provide the proper records and support to document their review of vendor files for covered transactions. Such failure led to non-compliance with the procurement, suspension and debarment policies in accordance with the UG for the year ended December 31, 2020. CUAHSI did not complete the verification of its 2020 vendors until 2024. Based on our testing, no contractors in covered transactions were deemed to be federally debarred, suspended or excluded. Cause & Context CUAHSI has a policy in place to meet the procurement requirements but there was no evidence of compliance with that policy. Effect As a result of noncompliance, there could be possible repayment of funds, loss of reputation and possible suspension or debarment. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-004. Recommendation It is recommended that CUAHSI strive to prioritize compliance. CUAHSI should ensure that, to the extent practicable, the use of a competitive procurement process in compliance with 2 CFR section 200/317. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-008 CASH MANAGEMENT - FEDERAL DRAWDOWNS IN ADVANCE OF EXPENDITURES Criteria CFR § 200.305 Cash management: This section of the CFR outlines the requirements for the management of cash drawdowns and disbursements of federal funds. Federal funds should be disbursed in a timely manner for allowable costs that have been incurred. Cash advances must meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation. Condition CUAHSI did not meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation which details the requirements for advance fundings. During 2020, CUAHSI had advance drawdowns totaling $3,610,240 from the NSF. Of this amount, CUAHSI incurred $2,521,926 in eligible expenses for the year ended December 31, 2020. This resulted in $1,088,314 in excess federal advances as of year-end. The draw downs in excess of revenue recognized during the year ended December 31, 2020 are reported as part of deferred revenue in the accompanying Statement of Financial Position. Cause & Context In anticipation of a government shut down due to COVID-19, CUAHSI initiated advance drawdowns without following the guidelines set forth by Chapter VIII.C.3 of the grant agreement. Effect Drawing down funds in advance of incurring eligible expenses could lead to non-compliance with federal regulations, such as those outlined in 2 CFR § 200.305. This may result in the need to repay the funds, potential financial penalties, or disqualification from future federal funding. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-009. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.35. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-009 PROGRAM INCOME Criteria Pursuant to 2 CFR 200 for award objectives and the regulations at 2 CFR 200.307, program income is defined as “Gross income earned by the recipient that is directly generated by a supported activity or earned as a result of the federal award during the period of performance” by 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. Condition Program income consists of registration fees collected for training, meetings or workshops and the proceeds from the sale of publications as a result of the federal award during the period of performance. Program income is treated as an additive to the federal funds received by CUAHSI. During a drawdown, program income reduces the amount that is requested to cover reimbursable costs through the Flexible Billing module. This allows program income to be applied to the award before a reimbursement is requested from NSF adding the value of program income received to the awarded amount. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. CUAHSI program income totaled $85,267 for the year ended December 31, 2020. CUAHSI failed to submit the required Program Income Reporting Worksheet by the required deadline of forty five (45) days after the end of the year (February 15, 2021) to ensure with the program income policies in accordance with the UG for the year ended December 31, 2020. Cause & Context Lack of resources and detailed attention to the risks, along with circumvention of controls has resulted in weak internal controls, and conflicting or incomplete policies and procedures. Effect Non-compliance can lead to penalties, fines, or even termination of the contract. It may also damage CUAHSI’s reputation and future eligibility for federal funding and jeopardize CUAHSI’s ability to secure future grants or contracts from other funding agencies. Granting organizations typically prioritize funding recipients with a track record of compliance and accountability. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-011. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.307. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. The auditor noted CUAHSI incorrectly identified the qualified expenditures related to the federal grant programs. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes. Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2019-006. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-004 REPORTING - DCF Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022 (COVID-19 extension). The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (January 20, 2025) or nine months after CUAHSI’s year end (September 30, 2021) that was extended to March 31, 2022 due to COVID-19. Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG. Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-007. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. The auditor noted CUAHSI incorrectly identified the qualified expenditures related to the federal grant programs. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes. Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2019-006. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-004 REPORTING - DCF Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022 (COVID-19 extension). The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (January 20, 2025) or nine months after CUAHSI’s year end (September 30, 2021) that was extended to March 31, 2022 due to COVID-19. Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG. Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-007. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-005 SUBRECIPIENT MONITORING Criteria The regulations are documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h); (Requirements for Pass-Through Entities). The criteria for monitoring subrecipients of federal awards should be following federal regulations, the terms of the federal contract, and any additional requirements specified by the auditee's policies and procedures. Specifically, the monitoring criteria should include, but not be limited to, the following: • Subrecipient Risk Assessment • Financial Monitoring • Compliance Monitoring • Reporting and Documentation Condition The auditee failed to comply with federal regulations requiring the monitoring of subrecipients for federal awards on a timely basis. Recipients of federal awards are responsible for monitoring the activities of subrecipients to ensure that they comply with applicable laws, regulations, and the terms and conditions of the federal award. CUAHSI did not complete the monitoring of its 2020 subrecipients until 2024. During the year ended December 31, 2020, CUAHSI had $206,636 in amounts paid to subrecipients. Based on our testing of amounts paid to subrecipients, no amounts were identified as unallowable. Cause & Context CUAHSI had a policy and procedure manual in place which outlined the steps for monitoring. There was no audit evidence of CUAHSI following the policy and monitoring that the subrecipient was using the funding as prescribed during the year ended December 31, 2020. Effect CUAHSI’s lack of monitoring creates a significant risk of the possible misuse or improper use of funds. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-002. Recommendation The auditor recommends that management review the requirements documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h);(Requirements for Pass-Through Entities) and develops and implements procedures to adhere to such requirements. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-006 CASH MANAGEMENT Criteria 2 CFR Part 200 states that entities expending federal grants must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and the terms and conditions of the Federal award. To comply with 2 CFR Part 200, CUAHSI was required to submit monthly invoices for the funds received under the federal contract. These invoices will serve as a record of the services or goods provided during the specified period and will facilitate accurate tracking and reporting of the funds. In addition to the invoice, any supporting documentation, such as timesheets, should be maintained with the invoices. The cash management process should also be adjusted for the receipt of program income. These documents validate the services provided and ensure transparency and auditability of the invoiced amount. These amounts should be able to be traced to the general ledger in conjunction with the time in which they are billed. Condition The cash management process requires that cash draws be reviewed and approved to ensure the propriety of draw reimbursement requests. Management was unable to provide the auditor evidence documenting approval of the drawdowns for the year ended December 31, 2020. Cause & Context CUAHSI had no fiscal management team during the year ended December 31, 2020 to ensure compliance with proper policies and procedures. The books and records for the year ended December 31, 2020 were recreated by the current management team during 2023 to 2024. Effect Grant awards and reimbursements may not be recorded correctly and there is a higher risk of error or misappropriation of assets. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-003. Recommendation The auditor recommends CUAHSI develop and implement controls to ensure an adequate review process is in place for review of reimbursement requests submitted to granting agencies to ensure consistent reporting. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-007 PROCUREMENT, SUSPENSION AND DEBARMENT Criteria The requirements for this compliance requirement are contained in 2 CFR sections 200.317- 200.326; 48 CFR parts 03, 15, 44, and the clauses at 48 CRF sections 52.244-2, 52.244-5, 52.203-13, 52.203-16 and 52.215-12; agency FAR supplements; 2 CFR part 180; OMB M-18-18; and the terms and conditions of the federal award. There is a requirement to verify that contractors in covered transactions or any of its vendors are not federally debarred, suspended, or excluded. A covered transaction is a nonprocurement or procurement transaction in excess of $25,000 that is subject to the prohibitions noted in 2 CFR part 180. The covered transaction may be at the primary tier, between a federal agency and a person or a lower tier between a participant in a covered transaction and another person. Condition During the completion of the audit, the auditor noted that CUAHSI failed to maintain and provide the proper records and support to document their review of vendor files for covered transactions. Such failure led to non-compliance with the procurement, suspension and debarment policies in accordance with the UG for the year ended December 31, 2020. CUAHSI did not complete the verification of its 2020 vendors until 2024. Based on our testing, no contractors in covered transactions were deemed to be federally debarred, suspended or excluded. Cause & Context CUAHSI has a policy in place to meet the procurement requirements but there was no evidence of compliance with that policy. Effect As a result of noncompliance, there could be possible repayment of funds, loss of reputation and possible suspension or debarment. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-004. Recommendation It is recommended that CUAHSI strive to prioritize compliance. CUAHSI should ensure that, to the extent practicable, the use of a competitive procurement process in compliance with 2 CFR section 200/317. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-008 CASH MANAGEMENT - FEDERAL DRAWDOWNS IN ADVANCE OF EXPENDITURES Criteria CFR § 200.305 Cash management: This section of the CFR outlines the requirements for the management of cash drawdowns and disbursements of federal funds. Federal funds should be disbursed in a timely manner for allowable costs that have been incurred. Cash advances must meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation. Condition CUAHSI did not meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation which details the requirements for advance fundings. During 2020, CUAHSI had advance drawdowns totaling $3,610,240 from the NSF. Of this amount, CUAHSI incurred $2,521,926 in eligible expenses for the year ended December 31, 2020. This resulted in $1,088,314 in excess federal advances as of year-end. The draw downs in excess of revenue recognized during the year ended December 31, 2020 are reported as part of deferred revenue in the accompanying Statement of Financial Position. Cause & Context In anticipation of a government shut down due to COVID-19, CUAHSI initiated advance drawdowns without following the guidelines set forth by Chapter VIII.C.3 of the grant agreement. Effect Drawing down funds in advance of incurring eligible expenses could lead to non-compliance with federal regulations, such as those outlined in 2 CFR § 200.305. This may result in the need to repay the funds, potential financial penalties, or disqualification from future federal funding. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-009. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.35. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-009 PROGRAM INCOME Criteria Pursuant to 2 CFR 200 for award objectives and the regulations at 2 CFR 200.307, program income is defined as “Gross income earned by the recipient that is directly generated by a supported activity or earned as a result of the federal award during the period of performance” by 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. Condition Program income consists of registration fees collected for training, meetings or workshops and the proceeds from the sale of publications as a result of the federal award during the period of performance. Program income is treated as an additive to the federal funds received by CUAHSI. During a drawdown, program income reduces the amount that is requested to cover reimbursable costs through the Flexible Billing module. This allows program income to be applied to the award before a reimbursement is requested from NSF adding the value of program income received to the awarded amount. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. CUAHSI program income totaled $85,267 for the year ended December 31, 2020. CUAHSI failed to submit the required Program Income Reporting Worksheet by the required deadline of forty five (45) days after the end of the year (February 15, 2021) to ensure with the program income policies in accordance with the UG for the year ended December 31, 2020. Cause & Context Lack of resources and detailed attention to the risks, along with circumvention of controls has resulted in weak internal controls, and conflicting or incomplete policies and procedures. Effect Non-compliance can lead to penalties, fines, or even termination of the contract. It may also damage CUAHSI’s reputation and future eligibility for federal funding and jeopardize CUAHSI’s ability to secure future grants or contracts from other funding agencies. Granting organizations typically prioritize funding recipients with a track record of compliance and accountability. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-011. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.307. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. The auditor noted CUAHSI incorrectly identified the qualified expenditures related to the federal grant programs. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes. Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2019-006. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-004 REPORTING - DCF Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022 (COVID-19 extension). The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (January 20, 2025) or nine months after CUAHSI’s year end (September 30, 2021) that was extended to March 31, 2022 due to COVID-19. Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG. Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-007. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-005 SUBRECIPIENT MONITORING Criteria The regulations are documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h); (Requirements for Pass-Through Entities). The criteria for monitoring subrecipients of federal awards should be following federal regulations, the terms of the federal contract, and any additional requirements specified by the auditee's policies and procedures. Specifically, the monitoring criteria should include, but not be limited to, the following: • Subrecipient Risk Assessment • Financial Monitoring • Compliance Monitoring • Reporting and Documentation Condition The auditee failed to comply with federal regulations requiring the monitoring of subrecipients for federal awards on a timely basis. Recipients of federal awards are responsible for monitoring the activities of subrecipients to ensure that they comply with applicable laws, regulations, and the terms and conditions of the federal award. CUAHSI did not complete the monitoring of its 2020 subrecipients until 2024. During the year ended December 31, 2020, CUAHSI had $206,636 in amounts paid to subrecipients. Based on our testing of amounts paid to subrecipients, no amounts were identified as unallowable. Cause & Context CUAHSI had a policy and procedure manual in place which outlined the steps for monitoring. There was no audit evidence of CUAHSI following the policy and monitoring that the subrecipient was using the funding as prescribed during the year ended December 31, 2020. Effect CUAHSI’s lack of monitoring creates a significant risk of the possible misuse or improper use of funds. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-002. Recommendation The auditor recommends that management review the requirements documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h);(Requirements for Pass-Through Entities) and develops and implements procedures to adhere to such requirements. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-006 CASH MANAGEMENT Criteria 2 CFR Part 200 states that entities expending federal grants must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and the terms and conditions of the Federal award. To comply with 2 CFR Part 200, CUAHSI was required to submit monthly invoices for the funds received under the federal contract. These invoices will serve as a record of the services or goods provided during the specified period and will facilitate accurate tracking and reporting of the funds. In addition to the invoice, any supporting documentation, such as timesheets, should be maintained with the invoices. The cash management process should also be adjusted for the receipt of program income. These documents validate the services provided and ensure transparency and auditability of the invoiced amount. These amounts should be able to be traced to the general ledger in conjunction with the time in which they are billed. Condition The cash management process requires that cash draws be reviewed and approved to ensure the propriety of draw reimbursement requests. Management was unable to provide the auditor evidence documenting approval of the drawdowns for the year ended December 31, 2020. Cause & Context CUAHSI had no fiscal management team during the year ended December 31, 2020 to ensure compliance with proper policies and procedures. The books and records for the year ended December 31, 2020 were recreated by the current management team during 2023 to 2024. Effect Grant awards and reimbursements may not be recorded correctly and there is a higher risk of error or misappropriation of assets. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-003. Recommendation The auditor recommends CUAHSI develop and implement controls to ensure an adequate review process is in place for review of reimbursement requests submitted to granting agencies to ensure consistent reporting. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-007 PROCUREMENT, SUSPENSION AND DEBARMENT Criteria The requirements for this compliance requirement are contained in 2 CFR sections 200.317- 200.326; 48 CFR parts 03, 15, 44, and the clauses at 48 CRF sections 52.244-2, 52.244-5, 52.203-13, 52.203-16 and 52.215-12; agency FAR supplements; 2 CFR part 180; OMB M-18-18; and the terms and conditions of the federal award. There is a requirement to verify that contractors in covered transactions or any of its vendors are not federally debarred, suspended, or excluded. A covered transaction is a nonprocurement or procurement transaction in excess of $25,000 that is subject to the prohibitions noted in 2 CFR part 180. The covered transaction may be at the primary tier, between a federal agency and a person or a lower tier between a participant in a covered transaction and another person. Condition During the completion of the audit, the auditor noted that CUAHSI failed to maintain and provide the proper records and support to document their review of vendor files for covered transactions. Such failure led to non-compliance with the procurement, suspension and debarment policies in accordance with the UG for the year ended December 31, 2020. CUAHSI did not complete the verification of its 2020 vendors until 2024. Based on our testing, no contractors in covered transactions were deemed to be federally debarred, suspended or excluded. Cause & Context CUAHSI has a policy in place to meet the procurement requirements but there was no evidence of compliance with that policy. Effect As a result of noncompliance, there could be possible repayment of funds, loss of reputation and possible suspension or debarment. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-004. Recommendation It is recommended that CUAHSI strive to prioritize compliance. CUAHSI should ensure that, to the extent practicable, the use of a competitive procurement process in compliance with 2 CFR section 200/317. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-008 CASH MANAGEMENT - FEDERAL DRAWDOWNS IN ADVANCE OF EXPENDITURES Criteria CFR § 200.305 Cash management: This section of the CFR outlines the requirements for the management of cash drawdowns and disbursements of federal funds. Federal funds should be disbursed in a timely manner for allowable costs that have been incurred. Cash advances must meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation. Condition CUAHSI did not meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation which details the requirements for advance fundings. During 2020, CUAHSI had advance drawdowns totaling $3,610,240 from the NSF. Of this amount, CUAHSI incurred $2,521,926 in eligible expenses for the year ended December 31, 2020. This resulted in $1,088,314 in excess federal advances as of year-end. The draw downs in excess of revenue recognized during the year ended December 31, 2020 are reported as part of deferred revenue in the accompanying Statement of Financial Position. Cause & Context In anticipation of a government shut down due to COVID-19, CUAHSI initiated advance drawdowns without following the guidelines set forth by Chapter VIII.C.3 of the grant agreement. Effect Drawing down funds in advance of incurring eligible expenses could lead to non-compliance with federal regulations, such as those outlined in 2 CFR § 200.305. This may result in the need to repay the funds, potential financial penalties, or disqualification from future federal funding. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-009. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.35. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-009 PROGRAM INCOME Criteria Pursuant to 2 CFR 200 for award objectives and the regulations at 2 CFR 200.307, program income is defined as “Gross income earned by the recipient that is directly generated by a supported activity or earned as a result of the federal award during the period of performance” by 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. Condition Program income consists of registration fees collected for training, meetings or workshops and the proceeds from the sale of publications as a result of the federal award during the period of performance. Program income is treated as an additive to the federal funds received by CUAHSI. During a drawdown, program income reduces the amount that is requested to cover reimbursable costs through the Flexible Billing module. This allows program income to be applied to the award before a reimbursement is requested from NSF adding the value of program income received to the awarded amount. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. CUAHSI program income totaled $85,267 for the year ended December 31, 2020. CUAHSI failed to submit the required Program Income Reporting Worksheet by the required deadline of forty five (45) days after the end of the year (February 15, 2021) to ensure with the program income policies in accordance with the UG for the year ended December 31, 2020. Cause & Context Lack of resources and detailed attention to the risks, along with circumvention of controls has resulted in weak internal controls, and conflicting or incomplete policies and procedures. Effect Non-compliance can lead to penalties, fines, or even termination of the contract. It may also damage CUAHSI’s reputation and future eligibility for federal funding and jeopardize CUAHSI’s ability to secure future grants or contracts from other funding agencies. Granting organizations typically prioritize funding recipients with a track record of compliance and accountability. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-011. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.307. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. The auditor noted CUAHSI incorrectly identified the qualified expenditures related to the federal grant programs. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes. Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2019-006. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-004 REPORTING - DCF Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022 (COVID-19 extension). The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (January 20, 2025) or nine months after CUAHSI’s year end (September 30, 2021) that was extended to March 31, 2022 due to COVID-19. Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG. Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-007. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-005 SUBRECIPIENT MONITORING Criteria The regulations are documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h); (Requirements for Pass-Through Entities). The criteria for monitoring subrecipients of federal awards should be following federal regulations, the terms of the federal contract, and any additional requirements specified by the auditee's policies and procedures. Specifically, the monitoring criteria should include, but not be limited to, the following: • Subrecipient Risk Assessment • Financial Monitoring • Compliance Monitoring • Reporting and Documentation Condition The auditee failed to comply with federal regulations requiring the monitoring of subrecipients for federal awards on a timely basis. Recipients of federal awards are responsible for monitoring the activities of subrecipients to ensure that they comply with applicable laws, regulations, and the terms and conditions of the federal award. CUAHSI did not complete the monitoring of its 2020 subrecipients until 2024. During the year ended December 31, 2020, CUAHSI had $206,636 in amounts paid to subrecipients. Based on our testing of amounts paid to subrecipients, no amounts were identified as unallowable. Cause & Context CUAHSI had a policy and procedure manual in place which outlined the steps for monitoring. There was no audit evidence of CUAHSI following the policy and monitoring that the subrecipient was using the funding as prescribed during the year ended December 31, 2020. Effect CUAHSI’s lack of monitoring creates a significant risk of the possible misuse or improper use of funds. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-002. Recommendation The auditor recommends that management review the requirements documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h);(Requirements for Pass-Through Entities) and develops and implements procedures to adhere to such requirements. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-006 CASH MANAGEMENT Criteria 2 CFR Part 200 states that entities expending federal grants must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and the terms and conditions of the Federal award. To comply with 2 CFR Part 200, CUAHSI was required to submit monthly invoices for the funds received under the federal contract. These invoices will serve as a record of the services or goods provided during the specified period and will facilitate accurate tracking and reporting of the funds. In addition to the invoice, any supporting documentation, such as timesheets, should be maintained with the invoices. The cash management process should also be adjusted for the receipt of program income. These documents validate the services provided and ensure transparency and auditability of the invoiced amount. These amounts should be able to be traced to the general ledger in conjunction with the time in which they are billed. Condition The cash management process requires that cash draws be reviewed and approved to ensure the propriety of draw reimbursement requests. Management was unable to provide the auditor evidence documenting approval of the drawdowns for the year ended December 31, 2020. Cause & Context CUAHSI had no fiscal management team during the year ended December 31, 2020 to ensure compliance with proper policies and procedures. The books and records for the year ended December 31, 2020 were recreated by the current management team during 2023 to 2024. Effect Grant awards and reimbursements may not be recorded correctly and there is a higher risk of error or misappropriation of assets. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-003. Recommendation The auditor recommends CUAHSI develop and implement controls to ensure an adequate review process is in place for review of reimbursement requests submitted to granting agencies to ensure consistent reporting. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-007 PROCUREMENT, SUSPENSION AND DEBARMENT Criteria The requirements for this compliance requirement are contained in 2 CFR sections 200.317- 200.326; 48 CFR parts 03, 15, 44, and the clauses at 48 CRF sections 52.244-2, 52.244-5, 52.203-13, 52.203-16 and 52.215-12; agency FAR supplements; 2 CFR part 180; OMB M-18-18; and the terms and conditions of the federal award. There is a requirement to verify that contractors in covered transactions or any of its vendors are not federally debarred, suspended, or excluded. A covered transaction is a nonprocurement or procurement transaction in excess of $25,000 that is subject to the prohibitions noted in 2 CFR part 180. The covered transaction may be at the primary tier, between a federal agency and a person or a lower tier between a participant in a covered transaction and another person. Condition During the completion of the audit, the auditor noted that CUAHSI failed to maintain and provide the proper records and support to document their review of vendor files for covered transactions. Such failure led to non-compliance with the procurement, suspension and debarment policies in accordance with the UG for the year ended December 31, 2020. CUAHSI did not complete the verification of its 2020 vendors until 2024. Based on our testing, no contractors in covered transactions were deemed to be federally debarred, suspended or excluded. Cause & Context CUAHSI has a policy in place to meet the procurement requirements but there was no evidence of compliance with that policy. Effect As a result of noncompliance, there could be possible repayment of funds, loss of reputation and possible suspension or debarment. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-004. Recommendation It is recommended that CUAHSI strive to prioritize compliance. CUAHSI should ensure that, to the extent practicable, the use of a competitive procurement process in compliance with 2 CFR section 200/317. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-008 CASH MANAGEMENT - FEDERAL DRAWDOWNS IN ADVANCE OF EXPENDITURES Criteria CFR § 200.305 Cash management: This section of the CFR outlines the requirements for the management of cash drawdowns and disbursements of federal funds. Federal funds should be disbursed in a timely manner for allowable costs that have been incurred. Cash advances must meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation. Condition CUAHSI did not meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation which details the requirements for advance fundings. During 2020, CUAHSI had advance drawdowns totaling $3,610,240 from the NSF. Of this amount, CUAHSI incurred $2,521,926 in eligible expenses for the year ended December 31, 2020. This resulted in $1,088,314 in excess federal advances as of year-end. The draw downs in excess of revenue recognized during the year ended December 31, 2020 are reported as part of deferred revenue in the accompanying Statement of Financial Position. Cause & Context In anticipation of a government shut down due to COVID-19, CUAHSI initiated advance drawdowns without following the guidelines set forth by Chapter VIII.C.3 of the grant agreement. Effect Drawing down funds in advance of incurring eligible expenses could lead to non-compliance with federal regulations, such as those outlined in 2 CFR § 200.305. This may result in the need to repay the funds, potential financial penalties, or disqualification from future federal funding. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-009. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.35. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-009 PROGRAM INCOME Criteria Pursuant to 2 CFR 200 for award objectives and the regulations at 2 CFR 200.307, program income is defined as “Gross income earned by the recipient that is directly generated by a supported activity or earned as a result of the federal award during the period of performance” by 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. Condition Program income consists of registration fees collected for training, meetings or workshops and the proceeds from the sale of publications as a result of the federal award during the period of performance. Program income is treated as an additive to the federal funds received by CUAHSI. During a drawdown, program income reduces the amount that is requested to cover reimbursable costs through the Flexible Billing module. This allows program income to be applied to the award before a reimbursement is requested from NSF adding the value of program income received to the awarded amount. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. CUAHSI program income totaled $85,267 for the year ended December 31, 2020. CUAHSI failed to submit the required Program Income Reporting Worksheet by the required deadline of forty five (45) days after the end of the year (February 15, 2021) to ensure with the program income policies in accordance with the UG for the year ended December 31, 2020. Cause & Context Lack of resources and detailed attention to the risks, along with circumvention of controls has resulted in weak internal controls, and conflicting or incomplete policies and procedures. Effect Non-compliance can lead to penalties, fines, or even termination of the contract. It may also damage CUAHSI’s reputation and future eligibility for federal funding and jeopardize CUAHSI’s ability to secure future grants or contracts from other funding agencies. Granting organizations typically prioritize funding recipients with a track record of compliance and accountability. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-011. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.307. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. The auditor noted CUAHSI incorrectly identified the qualified expenditures related to the federal grant programs. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes. Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2019-006. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-004 REPORTING - DCF Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022 (COVID-19 extension). The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (January 20, 2025) or nine months after CUAHSI’s year end (September 30, 2021) that was extended to March 31, 2022 due to COVID-19. Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG. Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-007. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-005 SUBRECIPIENT MONITORING Criteria The regulations are documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h); (Requirements for Pass-Through Entities). The criteria for monitoring subrecipients of federal awards should be following federal regulations, the terms of the federal contract, and any additional requirements specified by the auditee's policies and procedures. Specifically, the monitoring criteria should include, but not be limited to, the following: • Subrecipient Risk Assessment • Financial Monitoring • Compliance Monitoring • Reporting and Documentation Condition The auditee failed to comply with federal regulations requiring the monitoring of subrecipients for federal awards on a timely basis. Recipients of federal awards are responsible for monitoring the activities of subrecipients to ensure that they comply with applicable laws, regulations, and the terms and conditions of the federal award. CUAHSI did not complete the monitoring of its 2020 subrecipients until 2024. During the year ended December 31, 2020, CUAHSI had $206,636 in amounts paid to subrecipients. Based on our testing of amounts paid to subrecipients, no amounts were identified as unallowable. Cause & Context CUAHSI had a policy and procedure manual in place which outlined the steps for monitoring. There was no audit evidence of CUAHSI following the policy and monitoring that the subrecipient was using the funding as prescribed during the year ended December 31, 2020. Effect CUAHSI’s lack of monitoring creates a significant risk of the possible misuse or improper use of funds. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-002. Recommendation The auditor recommends that management review the requirements documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h);(Requirements for Pass-Through Entities) and develops and implements procedures to adhere to such requirements. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-006 CASH MANAGEMENT Criteria 2 CFR Part 200 states that entities expending federal grants must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and the terms and conditions of the Federal award. To comply with 2 CFR Part 200, CUAHSI was required to submit monthly invoices for the funds received under the federal contract. These invoices will serve as a record of the services or goods provided during the specified period and will facilitate accurate tracking and reporting of the funds. In addition to the invoice, any supporting documentation, such as timesheets, should be maintained with the invoices. The cash management process should also be adjusted for the receipt of program income. These documents validate the services provided and ensure transparency and auditability of the invoiced amount. These amounts should be able to be traced to the general ledger in conjunction with the time in which they are billed. Condition The cash management process requires that cash draws be reviewed and approved to ensure the propriety of draw reimbursement requests. Management was unable to provide the auditor evidence documenting approval of the drawdowns for the year ended December 31, 2020. Cause & Context CUAHSI had no fiscal management team during the year ended December 31, 2020 to ensure compliance with proper policies and procedures. The books and records for the year ended December 31, 2020 were recreated by the current management team during 2023 to 2024. Effect Grant awards and reimbursements may not be recorded correctly and there is a higher risk of error or misappropriation of assets. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-003. Recommendation The auditor recommends CUAHSI develop and implement controls to ensure an adequate review process is in place for review of reimbursement requests submitted to granting agencies to ensure consistent reporting. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-007 PROCUREMENT, SUSPENSION AND DEBARMENT Criteria The requirements for this compliance requirement are contained in 2 CFR sections 200.317- 200.326; 48 CFR parts 03, 15, 44, and the clauses at 48 CRF sections 52.244-2, 52.244-5, 52.203-13, 52.203-16 and 52.215-12; agency FAR supplements; 2 CFR part 180; OMB M-18-18; and the terms and conditions of the federal award. There is a requirement to verify that contractors in covered transactions or any of its vendors are not federally debarred, suspended, or excluded. A covered transaction is a nonprocurement or procurement transaction in excess of $25,000 that is subject to the prohibitions noted in 2 CFR part 180. The covered transaction may be at the primary tier, between a federal agency and a person or a lower tier between a participant in a covered transaction and another person. Condition During the completion of the audit, the auditor noted that CUAHSI failed to maintain and provide the proper records and support to document their review of vendor files for covered transactions. Such failure led to non-compliance with the procurement, suspension and debarment policies in accordance with the UG for the year ended December 31, 2020. CUAHSI did not complete the verification of its 2020 vendors until 2024. Based on our testing, no contractors in covered transactions were deemed to be federally debarred, suspended or excluded. Cause & Context CUAHSI has a policy in place to meet the procurement requirements but there was no evidence of compliance with that policy. Effect As a result of noncompliance, there could be possible repayment of funds, loss of reputation and possible suspension or debarment. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-004. Recommendation It is recommended that CUAHSI strive to prioritize compliance. CUAHSI should ensure that, to the extent practicable, the use of a competitive procurement process in compliance with 2 CFR section 200/317. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-008 CASH MANAGEMENT - FEDERAL DRAWDOWNS IN ADVANCE OF EXPENDITURES Criteria CFR § 200.305 Cash management: This section of the CFR outlines the requirements for the management of cash drawdowns and disbursements of federal funds. Federal funds should be disbursed in a timely manner for allowable costs that have been incurred. Cash advances must meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation. Condition CUAHSI did not meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation which details the requirements for advance fundings. During 2020, CUAHSI had advance drawdowns totaling $3,610,240 from the NSF. Of this amount, CUAHSI incurred $2,521,926 in eligible expenses for the year ended December 31, 2020. This resulted in $1,088,314 in excess federal advances as of year-end. The draw downs in excess of revenue recognized during the year ended December 31, 2020 are reported as part of deferred revenue in the accompanying Statement of Financial Position. Cause & Context In anticipation of a government shut down due to COVID-19, CUAHSI initiated advance drawdowns without following the guidelines set forth by Chapter VIII.C.3 of the grant agreement. Effect Drawing down funds in advance of incurring eligible expenses could lead to non-compliance with federal regulations, such as those outlined in 2 CFR § 200.305. This may result in the need to repay the funds, potential financial penalties, or disqualification from future federal funding. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-009. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.35. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-009 PROGRAM INCOME Criteria Pursuant to 2 CFR 200 for award objectives and the regulations at 2 CFR 200.307, program income is defined as “Gross income earned by the recipient that is directly generated by a supported activity or earned as a result of the federal award during the period of performance” by 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. Condition Program income consists of registration fees collected for training, meetings or workshops and the proceeds from the sale of publications as a result of the federal award during the period of performance. Program income is treated as an additive to the federal funds received by CUAHSI. During a drawdown, program income reduces the amount that is requested to cover reimbursable costs through the Flexible Billing module. This allows program income to be applied to the award before a reimbursement is requested from NSF adding the value of program income received to the awarded amount. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. CUAHSI program income totaled $85,267 for the year ended December 31, 2020. CUAHSI failed to submit the required Program Income Reporting Worksheet by the required deadline of forty five (45) days after the end of the year (February 15, 2021) to ensure with the program income policies in accordance with the UG for the year ended December 31, 2020. Cause & Context Lack of resources and detailed attention to the risks, along with circumvention of controls has resulted in weak internal controls, and conflicting or incomplete policies and procedures. Effect Non-compliance can lead to penalties, fines, or even termination of the contract. It may also damage CUAHSI’s reputation and future eligibility for federal funding and jeopardize CUAHSI’s ability to secure future grants or contracts from other funding agencies. Granting organizations typically prioritize funding recipients with a track record of compliance and accountability. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-011. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.307. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. The auditor noted CUAHSI incorrectly identified the qualified expenditures related to the federal grant programs. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes. Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2019-006. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-004 REPORTING - DCF Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022 (COVID-19 extension). The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (January 20, 2025) or nine months after CUAHSI’s year end (September 30, 2021) that was extended to March 31, 2022 due to COVID-19. Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG. Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-007. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-005 SUBRECIPIENT MONITORING Criteria The regulations are documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h); (Requirements for Pass-Through Entities). The criteria for monitoring subrecipients of federal awards should be following federal regulations, the terms of the federal contract, and any additional requirements specified by the auditee's policies and procedures. Specifically, the monitoring criteria should include, but not be limited to, the following: • Subrecipient Risk Assessment • Financial Monitoring • Compliance Monitoring • Reporting and Documentation Condition The auditee failed to comply with federal regulations requiring the monitoring of subrecipients for federal awards on a timely basis. Recipients of federal awards are responsible for monitoring the activities of subrecipients to ensure that they comply with applicable laws, regulations, and the terms and conditions of the federal award. CUAHSI did not complete the monitoring of its 2020 subrecipients until 2024. During the year ended December 31, 2020, CUAHSI had $206,636 in amounts paid to subrecipients. Based on our testing of amounts paid to subrecipients, no amounts were identified as unallowable. Cause & Context CUAHSI had a policy and procedure manual in place which outlined the steps for monitoring. There was no audit evidence of CUAHSI following the policy and monitoring that the subrecipient was using the funding as prescribed during the year ended December 31, 2020. Effect CUAHSI’s lack of monitoring creates a significant risk of the possible misuse or improper use of funds. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-002. Recommendation The auditor recommends that management review the requirements documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h);(Requirements for Pass-Through Entities) and develops and implements procedures to adhere to such requirements. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-006 CASH MANAGEMENT Criteria 2 CFR Part 200 states that entities expending federal grants must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and the terms and conditions of the Federal award. To comply with 2 CFR Part 200, CUAHSI was required to submit monthly invoices for the funds received under the federal contract. These invoices will serve as a record of the services or goods provided during the specified period and will facilitate accurate tracking and reporting of the funds. In addition to the invoice, any supporting documentation, such as timesheets, should be maintained with the invoices. The cash management process should also be adjusted for the receipt of program income. These documents validate the services provided and ensure transparency and auditability of the invoiced amount. These amounts should be able to be traced to the general ledger in conjunction with the time in which they are billed. Condition The cash management process requires that cash draws be reviewed and approved to ensure the propriety of draw reimbursement requests. Management was unable to provide the auditor evidence documenting approval of the drawdowns for the year ended December 31, 2020. Cause & Context CUAHSI had no fiscal management team during the year ended December 31, 2020 to ensure compliance with proper policies and procedures. The books and records for the year ended December 31, 2020 were recreated by the current management team during 2023 to 2024. Effect Grant awards and reimbursements may not be recorded correctly and there is a higher risk of error or misappropriation of assets. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-003. Recommendation The auditor recommends CUAHSI develop and implement controls to ensure an adequate review process is in place for review of reimbursement requests submitted to granting agencies to ensure consistent reporting. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-007 PROCUREMENT, SUSPENSION AND DEBARMENT Criteria The requirements for this compliance requirement are contained in 2 CFR sections 200.317- 200.326; 48 CFR parts 03, 15, 44, and the clauses at 48 CRF sections 52.244-2, 52.244-5, 52.203-13, 52.203-16 and 52.215-12; agency FAR supplements; 2 CFR part 180; OMB M-18-18; and the terms and conditions of the federal award. There is a requirement to verify that contractors in covered transactions or any of its vendors are not federally debarred, suspended, or excluded. A covered transaction is a nonprocurement or procurement transaction in excess of $25,000 that is subject to the prohibitions noted in 2 CFR part 180. The covered transaction may be at the primary tier, between a federal agency and a person or a lower tier between a participant in a covered transaction and another person. Condition During the completion of the audit, the auditor noted that CUAHSI failed to maintain and provide the proper records and support to document their review of vendor files for covered transactions. Such failure led to non-compliance with the procurement, suspension and debarment policies in accordance with the UG for the year ended December 31, 2020. CUAHSI did not complete the verification of its 2020 vendors until 2024. Based on our testing, no contractors in covered transactions were deemed to be federally debarred, suspended or excluded. Cause & Context CUAHSI has a policy in place to meet the procurement requirements but there was no evidence of compliance with that policy. Effect As a result of noncompliance, there could be possible repayment of funds, loss of reputation and possible suspension or debarment. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-004. Recommendation It is recommended that CUAHSI strive to prioritize compliance. CUAHSI should ensure that, to the extent practicable, the use of a competitive procurement process in compliance with 2 CFR section 200/317. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-008 CASH MANAGEMENT - FEDERAL DRAWDOWNS IN ADVANCE OF EXPENDITURES Criteria CFR § 200.305 Cash management: This section of the CFR outlines the requirements for the management of cash drawdowns and disbursements of federal funds. Federal funds should be disbursed in a timely manner for allowable costs that have been incurred. Cash advances must meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation. Condition CUAHSI did not meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation which details the requirements for advance fundings. During 2020, CUAHSI had advance drawdowns totaling $3,610,240 from the NSF. Of this amount, CUAHSI incurred $2,521,926 in eligible expenses for the year ended December 31, 2020. This resulted in $1,088,314 in excess federal advances as of year-end. The draw downs in excess of revenue recognized during the year ended December 31, 2020 are reported as part of deferred revenue in the accompanying Statement of Financial Position. Cause & Context In anticipation of a government shut down due to COVID-19, CUAHSI initiated advance drawdowns without following the guidelines set forth by Chapter VIII.C.3 of the grant agreement. Effect Drawing down funds in advance of incurring eligible expenses could lead to non-compliance with federal regulations, such as those outlined in 2 CFR § 200.305. This may result in the need to repay the funds, potential financial penalties, or disqualification from future federal funding. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-009. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.35. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & Integrative Activities AL No.: 47.050, 47.070, 47.079, 47.080 & 47.083 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & OIA-1937099 (09/01/2020 – 08/31/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-009 PROGRAM INCOME Criteria Pursuant to 2 CFR 200 for award objectives and the regulations at 2 CFR 200.307, program income is defined as “Gross income earned by the recipient that is directly generated by a supported activity or earned as a result of the federal award during the period of performance” by 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. Condition Program income consists of registration fees collected for training, meetings or workshops and the proceeds from the sale of publications as a result of the federal award during the period of performance. Program income is treated as an additive to the federal funds received by CUAHSI. During a drawdown, program income reduces the amount that is requested to cover reimbursable costs through the Flexible Billing module. This allows program income to be applied to the award before a reimbursement is requested from NSF adding the value of program income received to the awarded amount. Program income reporting is due forty five (45) days after the end of the year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. CUAHSI program income totaled $85,267 for the year ended December 31, 2020. CUAHSI failed to submit the required Program Income Reporting Worksheet by the required deadline of forty five (45) days after the end of the year (February 15, 2021) to ensure with the program income policies in accordance with the UG for the year ended December 31, 2020. Cause & Context Lack of resources and detailed attention to the risks, along with circumvention of controls has resulted in weak internal controls, and conflicting or incomplete policies and procedures. Effect Non-compliance can lead to penalties, fines, or even termination of the contract. It may also damage CUAHSI’s reputation and future eligibility for federal funding and jeopardize CUAHSI’s ability to secure future grants or contracts from other funding agencies. Granting organizations typically prioritize funding recipients with a track record of compliance and accountability. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-011. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.307. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. The auditor noted CUAHSI incorrectly identified the qualified expenditures related to the federal grant programs. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes. Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2019-006. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Agriculture Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure, Integrative Activities & Forestry Research AL No.: 47.050, 47.070, 47.079, 47.080, 47.083 & 10.652 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019-05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), EAR-2028793 (05/15/2020 – 04/30/2021), OAC-1931278 (10/1/2019 – 09/30/2022), OAC-1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022), OIA-1937099 (09/01/2020 – 08/31/2021) & 19-DG11330140-083 (09/26/2019 – 09/30/2021) Pass Through Entity: Utah State University & University of Cincinnati MW2020-004 REPORTING - DCF Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2020 was not performed in a timely manner and the DCF was not submitted by its due date of March 31, 2022 (COVID-19 extension). The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (January 20, 2025) or nine months after CUAHSI’s year end (September 30, 2021) that was extended to March 31, 2022 due to COVID-19. Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG. Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2019-007. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.