Audit 347515

FINDING 2024-003 Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Reporting, Special Tests and Provisions - Nonprofit School Food Service Accounts Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and continual process. The process is based on fundamental principles that operate as a whole. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. INDIANA STATE BOARD OF ACCOUNTS 20 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Risk Assessment - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Reporting The School Corporation's Food Service Director was solely responsible for submitting the Monthly Sponsor Claims for reimbursement. There was no evidence of an oversight, review, or approval process to ensure the accuracy and completeness of the reports prior to submission. Control Activities - Special Tests and Provisions - Nonprofit School Food Service Accounts The Treasurer was solely responsible for posting all revenues and expenditures of the nonprofit school food service program into the School Corporation's accounting software. There was no evidence of an oversight, review, or approval process to ensure that only activity of the nonprofit school food service program was posted to the food service account or to ensure that all reimbursements were correctly credited to the nonprofit school food service account. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Due to the small size of the School Corporation, there was often only one individual involved with various aspects of the federal program with limited opportunity for proper segregation of duties. Additionally, management has not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. INDIANA STATE BOARD OF ACCOUNTS 21 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Finally, reimbursement requests could be inaccurate when submitted and the activity of the school food service account could be incorrectly recorded leading to incorrect requests for reimbursement or other errors in reporting or management of the food service account. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure that reports for reimbursement are complete and accurate, and the activity of the school food service account is properly recorded. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-003 Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Reporting, Special Tests and Provisions - Nonprofit School Food Service Accounts Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and continual process. The process is based on fundamental principles that operate as a whole. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. INDIANA STATE BOARD OF ACCOUNTS 20 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Risk Assessment - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Reporting The School Corporation's Food Service Director was solely responsible for submitting the Monthly Sponsor Claims for reimbursement. There was no evidence of an oversight, review, or approval process to ensure the accuracy and completeness of the reports prior to submission. Control Activities - Special Tests and Provisions - Nonprofit School Food Service Accounts The Treasurer was solely responsible for posting all revenues and expenditures of the nonprofit school food service program into the School Corporation's accounting software. There was no evidence of an oversight, review, or approval process to ensure that only activity of the nonprofit school food service program was posted to the food service account or to ensure that all reimbursements were correctly credited to the nonprofit school food service account. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Due to the small size of the School Corporation, there was often only one individual involved with various aspects of the federal program with limited opportunity for proper segregation of duties. Additionally, management has not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. INDIANA STATE BOARD OF ACCOUNTS 21 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Finally, reimbursement requests could be inaccurate when submitted and the activity of the school food service account could be incorrectly recorded leading to incorrect requests for reimbursement or other errors in reporting or management of the food service account. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure that reports for reimbursement are complete and accurate, and the activity of the school food service account is properly recorded. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-003 Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Reporting, Special Tests and Provisions - Nonprofit School Food Service Accounts Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and continual process. The process is based on fundamental principles that operate as a whole. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. INDIANA STATE BOARD OF ACCOUNTS 20 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Risk Assessment - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Reporting The School Corporation's Food Service Director was solely responsible for submitting the Monthly Sponsor Claims for reimbursement. There was no evidence of an oversight, review, or approval process to ensure the accuracy and completeness of the reports prior to submission. Control Activities - Special Tests and Provisions - Nonprofit School Food Service Accounts The Treasurer was solely responsible for posting all revenues and expenditures of the nonprofit school food service program into the School Corporation's accounting software. There was no evidence of an oversight, review, or approval process to ensure that only activity of the nonprofit school food service program was posted to the food service account or to ensure that all reimbursements were correctly credited to the nonprofit school food service account. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Due to the small size of the School Corporation, there was often only one individual involved with various aspects of the federal program with limited opportunity for proper segregation of duties. Additionally, management has not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. INDIANA STATE BOARD OF ACCOUNTS 21 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Finally, reimbursement requests could be inaccurate when submitted and the activity of the school food service account could be incorrectly recorded leading to incorrect requests for reimbursement or other errors in reporting or management of the food service account. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure that reports for reimbursement are complete and accurate, and the activity of the school food service account is properly recorded. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-003 Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Reporting, Special Tests and Provisions - Nonprofit School Food Service Accounts Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and continual process. The process is based on fundamental principles that operate as a whole. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. INDIANA STATE BOARD OF ACCOUNTS 20 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Risk Assessment - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Reporting The School Corporation's Food Service Director was solely responsible for submitting the Monthly Sponsor Claims for reimbursement. There was no evidence of an oversight, review, or approval process to ensure the accuracy and completeness of the reports prior to submission. Control Activities - Special Tests and Provisions - Nonprofit School Food Service Accounts The Treasurer was solely responsible for posting all revenues and expenditures of the nonprofit school food service program into the School Corporation's accounting software. There was no evidence of an oversight, review, or approval process to ensure that only activity of the nonprofit school food service program was posted to the food service account or to ensure that all reimbursements were correctly credited to the nonprofit school food service account. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Due to the small size of the School Corporation, there was often only one individual involved with various aspects of the federal program with limited opportunity for proper segregation of duties. Additionally, management has not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. INDIANA STATE BOARD OF ACCOUNTS 21 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Finally, reimbursement requests could be inaccurate when submitted and the activity of the school food service account could be incorrectly recorded leading to incorrect requests for reimbursement or other errors in reporting or management of the food service account. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure that reports for reimbursement are complete and accurate, and the activity of the school food service account is properly recorded. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-003 Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Reporting, Special Tests and Provisions - Nonprofit School Food Service Accounts Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and continual process. The process is based on fundamental principles that operate as a whole. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. INDIANA STATE BOARD OF ACCOUNTS 20 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Risk Assessment - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Reporting The School Corporation's Food Service Director was solely responsible for submitting the Monthly Sponsor Claims for reimbursement. There was no evidence of an oversight, review, or approval process to ensure the accuracy and completeness of the reports prior to submission. Control Activities - Special Tests and Provisions - Nonprofit School Food Service Accounts The Treasurer was solely responsible for posting all revenues and expenditures of the nonprofit school food service program into the School Corporation's accounting software. There was no evidence of an oversight, review, or approval process to ensure that only activity of the nonprofit school food service program was posted to the food service account or to ensure that all reimbursements were correctly credited to the nonprofit school food service account. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Due to the small size of the School Corporation, there was often only one individual involved with various aspects of the federal program with limited opportunity for proper segregation of duties. Additionally, management has not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. INDIANA STATE BOARD OF ACCOUNTS 21 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Finally, reimbursement requests could be inaccurate when submitted and the activity of the school food service account could be incorrectly recorded leading to incorrect requests for reimbursement or other errors in reporting or management of the food service account. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure that reports for reimbursement are complete and accurate, and the activity of the school food service account is properly recorded. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-004 Subject: Child Nutrition Cluster - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed and Unallowed, Allowable Costs/Cost Principles Audit Findings: Material Weakness, Other Matters Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 22 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities A sample of 60 claims was selected for testing. Of the 60 claims selected for testing, 43 claims were vendor claims and 17 were payroll claims. Issues were identified with 5 of the vendor claims as noted below:  Three claims, totaling $700, were paid based solely upon summary statements from the vendor. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant.  Two claims, totaling $313, were paid with no supporting documentation. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant. The total amount, $1,013, paid without adequate supporting documentation was considered questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 23 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. . . . (g) Be adequately documented. . . ." 7 CFR 210.14(a) states in part: ". . . Revenues received by the nonprofit school food service are to be used only for the operation or improvement of such food service, except that, such revenues shall not be used to purchase land or buildings, unless otherwise approved by FNS, or to construct buildings. . . ." 7 CFR 220.7(e)(1)(ii) states in part: ". . . use all revenues received by such food service only for the operation or improvement of that food service . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not follow proper recordkeeping procedures. The Treasurer paid claims from federal program funds with no support or based on summary statements. INDIANA STATE BOARD OF ACCOUNTS 24 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, we could not determine if federal program funds were used to pay only for the operation or improvement of the food service. Furthermore, the lack of detailed documentation was not in compliance with the cost principles. Continued payment with no support or only summary statements could lead to payments for unallowable activities and additional questioned costs. Questioned Costs Questioned costs in the amount of $1,013 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards have appropriate supporting documentation to ensure expenditures are allowable per the terms and conditions of the federal award and adhere to the cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-004 Subject: Child Nutrition Cluster - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed and Unallowed, Allowable Costs/Cost Principles Audit Findings: Material Weakness, Other Matters Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 22 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities A sample of 60 claims was selected for testing. Of the 60 claims selected for testing, 43 claims were vendor claims and 17 were payroll claims. Issues were identified with 5 of the vendor claims as noted below:  Three claims, totaling $700, were paid based solely upon summary statements from the vendor. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant.  Two claims, totaling $313, were paid with no supporting documentation. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant. The total amount, $1,013, paid without adequate supporting documentation was considered questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 23 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. . . . (g) Be adequately documented. . . ." 7 CFR 210.14(a) states in part: ". . . Revenues received by the nonprofit school food service are to be used only for the operation or improvement of such food service, except that, such revenues shall not be used to purchase land or buildings, unless otherwise approved by FNS, or to construct buildings. . . ." 7 CFR 220.7(e)(1)(ii) states in part: ". . . use all revenues received by such food service only for the operation or improvement of that food service . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not follow proper recordkeeping procedures. The Treasurer paid claims from federal program funds with no support or based on summary statements. INDIANA STATE BOARD OF ACCOUNTS 24 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, we could not determine if federal program funds were used to pay only for the operation or improvement of the food service. Furthermore, the lack of detailed documentation was not in compliance with the cost principles. Continued payment with no support or only summary statements could lead to payments for unallowable activities and additional questioned costs. Questioned Costs Questioned costs in the amount of $1,013 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards have appropriate supporting documentation to ensure expenditures are allowable per the terms and conditions of the federal award and adhere to the cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-004 Subject: Child Nutrition Cluster - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed and Unallowed, Allowable Costs/Cost Principles Audit Findings: Material Weakness, Other Matters Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 22 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities A sample of 60 claims was selected for testing. Of the 60 claims selected for testing, 43 claims were vendor claims and 17 were payroll claims. Issues were identified with 5 of the vendor claims as noted below:  Three claims, totaling $700, were paid based solely upon summary statements from the vendor. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant.  Two claims, totaling $313, were paid with no supporting documentation. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant. The total amount, $1,013, paid without adequate supporting documentation was considered questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 23 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. . . . (g) Be adequately documented. . . ." 7 CFR 210.14(a) states in part: ". . . Revenues received by the nonprofit school food service are to be used only for the operation or improvement of such food service, except that, such revenues shall not be used to purchase land or buildings, unless otherwise approved by FNS, or to construct buildings. . . ." 7 CFR 220.7(e)(1)(ii) states in part: ". . . use all revenues received by such food service only for the operation or improvement of that food service . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not follow proper recordkeeping procedures. The Treasurer paid claims from federal program funds with no support or based on summary statements. INDIANA STATE BOARD OF ACCOUNTS 24 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, we could not determine if federal program funds were used to pay only for the operation or improvement of the food service. Furthermore, the lack of detailed documentation was not in compliance with the cost principles. Continued payment with no support or only summary statements could lead to payments for unallowable activities and additional questioned costs. Questioned Costs Questioned costs in the amount of $1,013 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards have appropriate supporting documentation to ensure expenditures are allowable per the terms and conditions of the federal award and adhere to the cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-004 Subject: Child Nutrition Cluster - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed and Unallowed, Allowable Costs/Cost Principles Audit Findings: Material Weakness, Other Matters Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 22 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities A sample of 60 claims was selected for testing. Of the 60 claims selected for testing, 43 claims were vendor claims and 17 were payroll claims. Issues were identified with 5 of the vendor claims as noted below:  Three claims, totaling $700, were paid based solely upon summary statements from the vendor. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant.  Two claims, totaling $313, were paid with no supporting documentation. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant. The total amount, $1,013, paid without adequate supporting documentation was considered questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 23 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. . . . (g) Be adequately documented. . . ." 7 CFR 210.14(a) states in part: ". . . Revenues received by the nonprofit school food service are to be used only for the operation or improvement of such food service, except that, such revenues shall not be used to purchase land or buildings, unless otherwise approved by FNS, or to construct buildings. . . ." 7 CFR 220.7(e)(1)(ii) states in part: ". . . use all revenues received by such food service only for the operation or improvement of that food service . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not follow proper recordkeeping procedures. The Treasurer paid claims from federal program funds with no support or based on summary statements. INDIANA STATE BOARD OF ACCOUNTS 24 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, we could not determine if federal program funds were used to pay only for the operation or improvement of the food service. Furthermore, the lack of detailed documentation was not in compliance with the cost principles. Continued payment with no support or only summary statements could lead to payments for unallowable activities and additional questioned costs. Questioned Costs Questioned costs in the amount of $1,013 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards have appropriate supporting documentation to ensure expenditures are allowable per the terms and conditions of the federal award and adhere to the cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-004 Subject: Child Nutrition Cluster - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed and Unallowed, Allowable Costs/Cost Principles Audit Findings: Material Weakness, Other Matters Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 22 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities A sample of 60 claims was selected for testing. Of the 60 claims selected for testing, 43 claims were vendor claims and 17 were payroll claims. Issues were identified with 5 of the vendor claims as noted below:  Three claims, totaling $700, were paid based solely upon summary statements from the vendor. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant.  Two claims, totaling $313, were paid with no supporting documentation. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant. The total amount, $1,013, paid without adequate supporting documentation was considered questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 23 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. . . . (g) Be adequately documented. . . ." 7 CFR 210.14(a) states in part: ". . . Revenues received by the nonprofit school food service are to be used only for the operation or improvement of such food service, except that, such revenues shall not be used to purchase land or buildings, unless otherwise approved by FNS, or to construct buildings. . . ." 7 CFR 220.7(e)(1)(ii) states in part: ". . . use all revenues received by such food service only for the operation or improvement of that food service . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not follow proper recordkeeping procedures. The Treasurer paid claims from federal program funds with no support or based on summary statements. INDIANA STATE BOARD OF ACCOUNTS 24 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, we could not determine if federal program funds were used to pay only for the operation or improvement of the food service. Furthermore, the lack of detailed documentation was not in compliance with the cost principles. Continued payment with no support or only summary statements could lead to payments for unallowable activities and additional questioned costs. Questioned Costs Questioned costs in the amount of $1,013 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards have appropriate supporting documentation to ensure expenditures are allowable per the terms and conditions of the federal award and adhere to the cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-005 Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 25 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Procurement The School Corporation made purchases from two and three vendors during fiscal years 2022- 2023 and 2023-2024, respectively, for which expenditures fell under the small purchase threshold. The School Corporation could not provide any documentation that the procurement method used was appropriate or that the procurements provided full and open competition or rationale to support the determination to limit competition. Additionally, the history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented. The School Corporation made purchases from five and four vendors during 2022-2023 and 2023-2024, respectively, for which expenditures fell under the micro-purchase threshold. The history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented for any of the vendors. Control Activities - Suspension and Debarment The School Corporation utilized two vendors during 2022-2023 and 2023-2024 for which purchases throughout the year exceeded $25,000. The School Corporation was unable to provide any evidence that they verified that the vendors were not suspended or debarred from participation in federal programs. The lack of internal controls and noncompliance were systemic throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 26 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.318(a) states: "The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or service required under a federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standard identified in §§ 200.317 through 200.327." 2 CFR 200.320 states in part: "The non-Federal entity must have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award. (a) Informal procurement methods. When the value of the procurement for property or services under a Federal award does not exceed the simplified acquisition threshold (SAT), as defined in § 200.1, or a lower threshold established by a non-Federal entity, formal procurement methods are not required. The non-Federal entity may use informal procurement methods to expedite the completion of its transactions and minimize the associated administrative burden and cost. The informal methods used for procurement of property or services at or below the SAT include: . . . (1) Micro-purchases — (i) Distribution. The acquisition of supplies or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (See the definition of micro-purchase in § 200.1). To the maximum extent practicable, the non-Federal entity should distribute micro-purchases equitably among qualified suppliers. (ii) Micro-purchase awards. Micro-purchases may be awarded without soliciting competitive price or rate quotations if the non-Federal entity considers the price to be reasonable based on research, experience, purchase history or other information and documents it files accordingly. Purchase cards can be used for micropurchases if procedures are documented and approved by the non-Federal entity. . . . (2) Small purchases — (i) Small purchase procedures. The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. . . ." INDIANA STATE BOARD OF ACCOUNTS 27 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the SAM.gov Exclusions, or (b) Collecting a certification from that person, or (c) Adding a clause or condition to the covered transaction with that person." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the small size and location of the School Corporation were the determining factors when making purchasing decisions as many vendors will not service the School Corporation. Therefore, the School Corporation has used the same vendors for many years. As such, the School Corporation did not follow the proper procurement procedures to document the reason that competition was limited. Accordingly, the School Corporation also did not check the vendors' suspension and debarment status. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Furthermore, by not properly completing the procurement process the School Corporation could have overpaid goods or services. Additionally, the School Corporation could have made payment to a vendor that was suspended or debarred. Payments to a suspended or debarred vendor are unallowable. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards use the appropriate procurement method and retain the documentation to support the procurement methods used in order to ensure compliance with the terms and conditions of the federal award. Additionally, we recommend that the School Corporation's management verify applicable vendors are not suspended or debarred prior to making payment. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-005 Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 25 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Procurement The School Corporation made purchases from two and three vendors during fiscal years 2022- 2023 and 2023-2024, respectively, for which expenditures fell under the small purchase threshold. The School Corporation could not provide any documentation that the procurement method used was appropriate or that the procurements provided full and open competition or rationale to support the determination to limit competition. Additionally, the history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented. The School Corporation made purchases from five and four vendors during 2022-2023 and 2023-2024, respectively, for which expenditures fell under the micro-purchase threshold. The history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented for any of the vendors. Control Activities - Suspension and Debarment The School Corporation utilized two vendors during 2022-2023 and 2023-2024 for which purchases throughout the year exceeded $25,000. The School Corporation was unable to provide any evidence that they verified that the vendors were not suspended or debarred from participation in federal programs. The lack of internal controls and noncompliance were systemic throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 26 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.318(a) states: "The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or service required under a federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standard identified in §§ 200.317 through 200.327." 2 CFR 200.320 states in part: "The non-Federal entity must have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award. (a) Informal procurement methods. When the value of the procurement for property or services under a Federal award does not exceed the simplified acquisition threshold (SAT), as defined in § 200.1, or a lower threshold established by a non-Federal entity, formal procurement methods are not required. The non-Federal entity may use informal procurement methods to expedite the completion of its transactions and minimize the associated administrative burden and cost. The informal methods used for procurement of property or services at or below the SAT include: . . . (1) Micro-purchases — (i) Distribution. The acquisition of supplies or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (See the definition of micro-purchase in § 200.1). To the maximum extent practicable, the non-Federal entity should distribute micro-purchases equitably among qualified suppliers. (ii) Micro-purchase awards. Micro-purchases may be awarded without soliciting competitive price or rate quotations if the non-Federal entity considers the price to be reasonable based on research, experience, purchase history or other information and documents it files accordingly. Purchase cards can be used for micropurchases if procedures are documented and approved by the non-Federal entity. . . . (2) Small purchases — (i) Small purchase procedures. The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. . . ." INDIANA STATE BOARD OF ACCOUNTS 27 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the SAM.gov Exclusions, or (b) Collecting a certification from that person, or (c) Adding a clause or condition to the covered transaction with that person." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the small size and location of the School Corporation were the determining factors when making purchasing decisions as many vendors will not service the School Corporation. Therefore, the School Corporation has used the same vendors for many years. As such, the School Corporation did not follow the proper procurement procedures to document the reason that competition was limited. Accordingly, the School Corporation also did not check the vendors' suspension and debarment status. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Furthermore, by not properly completing the procurement process the School Corporation could have overpaid goods or services. Additionally, the School Corporation could have made payment to a vendor that was suspended or debarred. Payments to a suspended or debarred vendor are unallowable. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards use the appropriate procurement method and retain the documentation to support the procurement methods used in order to ensure compliance with the terms and conditions of the federal award. Additionally, we recommend that the School Corporation's management verify applicable vendors are not suspended or debarred prior to making payment. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-005 Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 25 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Procurement The School Corporation made purchases from two and three vendors during fiscal years 2022- 2023 and 2023-2024, respectively, for which expenditures fell under the small purchase threshold. The School Corporation could not provide any documentation that the procurement method used was appropriate or that the procurements provided full and open competition or rationale to support the determination to limit competition. Additionally, the history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented. The School Corporation made purchases from five and four vendors during 2022-2023 and 2023-2024, respectively, for which expenditures fell under the micro-purchase threshold. The history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented for any of the vendors. Control Activities - Suspension and Debarment The School Corporation utilized two vendors during 2022-2023 and 2023-2024 for which purchases throughout the year exceeded $25,000. The School Corporation was unable to provide any evidence that they verified that the vendors were not suspended or debarred from participation in federal programs. The lack of internal controls and noncompliance were systemic throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 26 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.318(a) states: "The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or service required under a federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standard identified in §§ 200.317 through 200.327." 2 CFR 200.320 states in part: "The non-Federal entity must have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award. (a) Informal procurement methods. When the value of the procurement for property or services under a Federal award does not exceed the simplified acquisition threshold (SAT), as defined in § 200.1, or a lower threshold established by a non-Federal entity, formal procurement methods are not required. The non-Federal entity may use informal procurement methods to expedite the completion of its transactions and minimize the associated administrative burden and cost. The informal methods used for procurement of property or services at or below the SAT include: . . . (1) Micro-purchases — (i) Distribution. The acquisition of supplies or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (See the definition of micro-purchase in § 200.1). To the maximum extent practicable, the non-Federal entity should distribute micro-purchases equitably among qualified suppliers. (ii) Micro-purchase awards. Micro-purchases may be awarded without soliciting competitive price or rate quotations if the non-Federal entity considers the price to be reasonable based on research, experience, purchase history or other information and documents it files accordingly. Purchase cards can be used for micropurchases if procedures are documented and approved by the non-Federal entity. . . . (2) Small purchases — (i) Small purchase procedures. The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. . . ." INDIANA STATE BOARD OF ACCOUNTS 27 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the SAM.gov Exclusions, or (b) Collecting a certification from that person, or (c) Adding a clause or condition to the covered transaction with that person." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the small size and location of the School Corporation were the determining factors when making purchasing decisions as many vendors will not service the School Corporation. Therefore, the School Corporation has used the same vendors for many years. As such, the School Corporation did not follow the proper procurement procedures to document the reason that competition was limited. Accordingly, the School Corporation also did not check the vendors' suspension and debarment status. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Furthermore, by not properly completing the procurement process the School Corporation could have overpaid goods or services. Additionally, the School Corporation could have made payment to a vendor that was suspended or debarred. Payments to a suspended or debarred vendor are unallowable. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards use the appropriate procurement method and retain the documentation to support the procurement methods used in order to ensure compliance with the terms and conditions of the federal award. Additionally, we recommend that the School Corporation's management verify applicable vendors are not suspended or debarred prior to making payment. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-005 Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 25 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Procurement The School Corporation made purchases from two and three vendors during fiscal years 2022- 2023 and 2023-2024, respectively, for which expenditures fell under the small purchase threshold. The School Corporation could not provide any documentation that the procurement method used was appropriate or that the procurements provided full and open competition or rationale to support the determination to limit competition. Additionally, the history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented. The School Corporation made purchases from five and four vendors during 2022-2023 and 2023-2024, respectively, for which expenditures fell under the micro-purchase threshold. The history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented for any of the vendors. Control Activities - Suspension and Debarment The School Corporation utilized two vendors during 2022-2023 and 2023-2024 for which purchases throughout the year exceeded $25,000. The School Corporation was unable to provide any evidence that they verified that the vendors were not suspended or debarred from participation in federal programs. The lack of internal controls and noncompliance were systemic throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 26 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.318(a) states: "The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or service required under a federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standard identified in §§ 200.317 through 200.327." 2 CFR 200.320 states in part: "The non-Federal entity must have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award. (a) Informal procurement methods. When the value of the procurement for property or services under a Federal award does not exceed the simplified acquisition threshold (SAT), as defined in § 200.1, or a lower threshold established by a non-Federal entity, formal procurement methods are not required. The non-Federal entity may use informal procurement methods to expedite the completion of its transactions and minimize the associated administrative burden and cost. The informal methods used for procurement of property or services at or below the SAT include: . . . (1) Micro-purchases — (i) Distribution. The acquisition of supplies or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (See the definition of micro-purchase in § 200.1). To the maximum extent practicable, the non-Federal entity should distribute micro-purchases equitably among qualified suppliers. (ii) Micro-purchase awards. Micro-purchases may be awarded without soliciting competitive price or rate quotations if the non-Federal entity considers the price to be reasonable based on research, experience, purchase history or other information and documents it files accordingly. Purchase cards can be used for micropurchases if procedures are documented and approved by the non-Federal entity. . . . (2) Small purchases — (i) Small purchase procedures. The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. . . ." INDIANA STATE BOARD OF ACCOUNTS 27 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the SAM.gov Exclusions, or (b) Collecting a certification from that person, or (c) Adding a clause or condition to the covered transaction with that person." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the small size and location of the School Corporation were the determining factors when making purchasing decisions as many vendors will not service the School Corporation. Therefore, the School Corporation has used the same vendors for many years. As such, the School Corporation did not follow the proper procurement procedures to document the reason that competition was limited. Accordingly, the School Corporation also did not check the vendors' suspension and debarment status. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Furthermore, by not properly completing the procurement process the School Corporation could have overpaid goods or services. Additionally, the School Corporation could have made payment to a vendor that was suspended or debarred. Payments to a suspended or debarred vendor are unallowable. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards use the appropriate procurement method and retain the documentation to support the procurement methods used in order to ensure compliance with the terms and conditions of the federal award. Additionally, we recommend that the School Corporation's management verify applicable vendors are not suspended or debarred prior to making payment. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-005 Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 25 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Procurement The School Corporation made purchases from two and three vendors during fiscal years 2022- 2023 and 2023-2024, respectively, for which expenditures fell under the small purchase threshold. The School Corporation could not provide any documentation that the procurement method used was appropriate or that the procurements provided full and open competition or rationale to support the determination to limit competition. Additionally, the history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented. The School Corporation made purchases from five and four vendors during 2022-2023 and 2023-2024, respectively, for which expenditures fell under the micro-purchase threshold. The history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented for any of the vendors. Control Activities - Suspension and Debarment The School Corporation utilized two vendors during 2022-2023 and 2023-2024 for which purchases throughout the year exceeded $25,000. The School Corporation was unable to provide any evidence that they verified that the vendors were not suspended or debarred from participation in federal programs. The lack of internal controls and noncompliance were systemic throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 26 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.318(a) states: "The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or service required under a federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standard identified in §§ 200.317 through 200.327." 2 CFR 200.320 states in part: "The non-Federal entity must have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award. (a) Informal procurement methods. When the value of the procurement for property or services under a Federal award does not exceed the simplified acquisition threshold (SAT), as defined in § 200.1, or a lower threshold established by a non-Federal entity, formal procurement methods are not required. The non-Federal entity may use informal procurement methods to expedite the completion of its transactions and minimize the associated administrative burden and cost. The informal methods used for procurement of property or services at or below the SAT include: . . . (1) Micro-purchases — (i) Distribution. The acquisition of supplies or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (See the definition of micro-purchase in § 200.1). To the maximum extent practicable, the non-Federal entity should distribute micro-purchases equitably among qualified suppliers. (ii) Micro-purchase awards. Micro-purchases may be awarded without soliciting competitive price or rate quotations if the non-Federal entity considers the price to be reasonable based on research, experience, purchase history or other information and documents it files accordingly. Purchase cards can be used for micropurchases if procedures are documented and approved by the non-Federal entity. . . . (2) Small purchases — (i) Small purchase procedures. The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. . . ." INDIANA STATE BOARD OF ACCOUNTS 27 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the SAM.gov Exclusions, or (b) Collecting a certification from that person, or (c) Adding a clause or condition to the covered transaction with that person." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the small size and location of the School Corporation were the determining factors when making purchasing decisions as many vendors will not service the School Corporation. Therefore, the School Corporation has used the same vendors for many years. As such, the School Corporation did not follow the proper procurement procedures to document the reason that competition was limited. Accordingly, the School Corporation also did not check the vendors' suspension and debarment status. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Furthermore, by not properly completing the procurement process the School Corporation could have overpaid goods or services. Additionally, the School Corporation could have made payment to a vendor that was suspended or debarred. Payments to a suspended or debarred vendor are unallowable. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards use the appropriate procurement method and retain the documentation to support the procurement methods used in order to ensure compliance with the terms and conditions of the federal award. Additionally, we recommend that the School Corporation's management verify applicable vendors are not suspended or debarred prior to making payment. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-007 Subject: COVID-19 - Education Stabilization Fund - Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Allowable Costs/Cost Principles Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 30 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was a participating member in The Exceptional Children's Cooperative (Cooperative) which provided special education services to students on behalf of the School Corporation. The School Corporation utilized $15,672 in program funds to pay for a portion of the School Corporation's required obligations to the Cooperative. This arrangement existed prior to the pandemic, and none of the obligations were related to responding to the pandemic. Additionally, the School Corporation used $12,000 in program funds to pay a retainer fee for information technology services on a contract that existed prior to the COVID-19 pandemic. The School Corporation also used $147,809 in program funds to pay the salary and benefits of a certified staff member who was employed prior to the pandemic and whose job duties were not related to responding to the pandemic. We consider the total of these payments, $175,481, to be questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 31 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) American Rescue Plan Act section 2001(e) states in part: "Uses of Funds. - A local education agency that receives funds under this section - . . . (2) shall use the remaining funds for any of the following: . . . (E) Coordination of preparedness and response efforts of local education agencies with State, local, Tribal, and territorial public health departments, and other relevant agencies, to improve coordinated responses among such entities to prevent, prepare for, and respond to coronavirus. . . . (G) Developing and implementing procedures and systems to improve the preparedness and response efforts of local educational agencies. . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (3) Records that identify adequately the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. . . . (g) be adequately documented. . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation's management had not developed a system of internal controls to ensure that expenditures paid from COVID-19 - Education Stabilization Funds were for costs allowed by the grant terms and conditions and in compliance with the allowable cost principles. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Without a proper system of internal controls in place that operated effectively, material noncompliance that resulted in questioned costs remained undetected. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funds to the School Corporation. INDIANA STATE BOARD OF ACCOUNTS 32 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs Questioned costs in the amount of $175,481 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards are for cost allowed per the terms and conditions of the federal award and in compliance with the allowable cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-007 Subject: COVID-19 - Education Stabilization Fund - Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Allowable Costs/Cost Principles Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 30 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was a participating member in The Exceptional Children's Cooperative (Cooperative) which provided special education services to students on behalf of the School Corporation. The School Corporation utilized $15,672 in program funds to pay for a portion of the School Corporation's required obligations to the Cooperative. This arrangement existed prior to the pandemic, and none of the obligations were related to responding to the pandemic. Additionally, the School Corporation used $12,000 in program funds to pay a retainer fee for information technology services on a contract that existed prior to the COVID-19 pandemic. The School Corporation also used $147,809 in program funds to pay the salary and benefits of a certified staff member who was employed prior to the pandemic and whose job duties were not related to responding to the pandemic. We consider the total of these payments, $175,481, to be questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 31 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) American Rescue Plan Act section 2001(e) states in part: "Uses of Funds. - A local education agency that receives funds under this section - . . . (2) shall use the remaining funds for any of the following: . . . (E) Coordination of preparedness and response efforts of local education agencies with State, local, Tribal, and territorial public health departments, and other relevant agencies, to improve coordinated responses among such entities to prevent, prepare for, and respond to coronavirus. . . . (G) Developing and implementing procedures and systems to improve the preparedness and response efforts of local educational agencies. . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (3) Records that identify adequately the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. . . . (g) be adequately documented. . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation's management had not developed a system of internal controls to ensure that expenditures paid from COVID-19 - Education Stabilization Funds were for costs allowed by the grant terms and conditions and in compliance with the allowable cost principles. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Without a proper system of internal controls in place that operated effectively, material noncompliance that resulted in questioned costs remained undetected. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funds to the School Corporation. INDIANA STATE BOARD OF ACCOUNTS 32 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs Questioned costs in the amount of $175,481 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards are for cost allowed per the terms and conditions of the federal award and in compliance with the allowable cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-007 Subject: COVID-19 - Education Stabilization Fund - Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Allowable Costs/Cost Principles Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 30 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was a participating member in The Exceptional Children's Cooperative (Cooperative) which provided special education services to students on behalf of the School Corporation. The School Corporation utilized $15,672 in program funds to pay for a portion of the School Corporation's required obligations to the Cooperative. This arrangement existed prior to the pandemic, and none of the obligations were related to responding to the pandemic. Additionally, the School Corporation used $12,000 in program funds to pay a retainer fee for information technology services on a contract that existed prior to the COVID-19 pandemic. The School Corporation also used $147,809 in program funds to pay the salary and benefits of a certified staff member who was employed prior to the pandemic and whose job duties were not related to responding to the pandemic. We consider the total of these payments, $175,481, to be questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 31 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) American Rescue Plan Act section 2001(e) states in part: "Uses of Funds. - A local education agency that receives funds under this section - . . . (2) shall use the remaining funds for any of the following: . . . (E) Coordination of preparedness and response efforts of local education agencies with State, local, Tribal, and territorial public health departments, and other relevant agencies, to improve coordinated responses among such entities to prevent, prepare for, and respond to coronavirus. . . . (G) Developing and implementing procedures and systems to improve the preparedness and response efforts of local educational agencies. . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (3) Records that identify adequately the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. . . . (g) be adequately documented. . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation's management had not developed a system of internal controls to ensure that expenditures paid from COVID-19 - Education Stabilization Funds were for costs allowed by the grant terms and conditions and in compliance with the allowable cost principles. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Without a proper system of internal controls in place that operated effectively, material noncompliance that resulted in questioned costs remained undetected. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funds to the School Corporation. INDIANA STATE BOARD OF ACCOUNTS 32 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs Questioned costs in the amount of $175,481 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards are for cost allowed per the terms and conditions of the federal award and in compliance with the allowable cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-007 Subject: COVID-19 - Education Stabilization Fund - Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Allowable Costs/Cost Principles Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 30 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was a participating member in The Exceptional Children's Cooperative (Cooperative) which provided special education services to students on behalf of the School Corporation. The School Corporation utilized $15,672 in program funds to pay for a portion of the School Corporation's required obligations to the Cooperative. This arrangement existed prior to the pandemic, and none of the obligations were related to responding to the pandemic. Additionally, the School Corporation used $12,000 in program funds to pay a retainer fee for information technology services on a contract that existed prior to the COVID-19 pandemic. The School Corporation also used $147,809 in program funds to pay the salary and benefits of a certified staff member who was employed prior to the pandemic and whose job duties were not related to responding to the pandemic. We consider the total of these payments, $175,481, to be questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 31 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) American Rescue Plan Act section 2001(e) states in part: "Uses of Funds. - A local education agency that receives funds under this section - . . . (2) shall use the remaining funds for any of the following: . . . (E) Coordination of preparedness and response efforts of local education agencies with State, local, Tribal, and territorial public health departments, and other relevant agencies, to improve coordinated responses among such entities to prevent, prepare for, and respond to coronavirus. . . . (G) Developing and implementing procedures and systems to improve the preparedness and response efforts of local educational agencies. . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (3) Records that identify adequately the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. . . . (g) be adequately documented. . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation's management had not developed a system of internal controls to ensure that expenditures paid from COVID-19 - Education Stabilization Funds were for costs allowed by the grant terms and conditions and in compliance with the allowable cost principles. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Without a proper system of internal controls in place that operated effectively, material noncompliance that resulted in questioned costs remained undetected. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funds to the School Corporation. INDIANA STATE BOARD OF ACCOUNTS 32 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs Questioned costs in the amount of $175,481 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards are for cost allowed per the terms and conditions of the federal award and in compliance with the allowable cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-009 Subject: COVID-19 - Education Stabilization Fund - Special Tests and Provisions - Wage Rate Requirements Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425U Federal Award Number and Year (or Other Identifying Number): S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Special Tests and Provisions - Wage Rate Requirements Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-005. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 36 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities Construction contracts in excess of $2,000 financed by federal assistance funds must pay wages not less than those established for the locality of the project (prevailing wage rates) by the Department of Labor (DOL) to their laborers and mechanics. Nonfederal entities are to include in their construction contracts subject to the Wage Rate Requirements a provision that the contractor or subcontractor comply with these requirements and the DOL regulations. This would include a requirement to submit a copy of the payroll and statement of compliance to the entity for each week in which contract work was performed. The School Corporation did not have policies and procedures in place to ensure that contractors were paid prevailing wage rates for contracts in excess of $2,000 that were paid from federal grant funds. The one contract tested did not include the required prevailing wage rate clause, and the contractor did not submit the certified payrolls to the School Corporation. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 29 CFR 5.5 states in part: "(a) The Agency head will cause or require the contracting officer to require the contracting officer to insert in full, or (for contracts covered by the Federal Acquisition Regulation (48 CFR chapter 1)) by reference, in any contract in excess of $2,000 which is entered into for the actual construction, alteration and/or repair, including painting and decorating, of a public building or public work, or building or work financed in whole or in part from Federal funds or in accordance with guarantees of a Federal agency or financed from funds obtained by pledge of any contract of a Federal agency to make a loan, grant or annual contribution (except where a different meaning is expressly indicated), and which is subject to the labor standards provisions of any of the laws referenced by § 5.1, the following clauses . . . (1) Minimum wages. INDIANA STATE BOARD OF ACCOUNTS 37 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (i) All laborers and mechanics employed or working upon the site of the work (or otherwise working in construction or development of the project under a development statute), will be paid unconditionally and not less often than once a week, and without subsequent deduction or rebate on any account (except such payroll deductions as are permitted by regulations issued by the Secretary of Labor under the Copeland Act (29 CFR part 3)), the full amount of basic hourly wages and bona fide fringe benefits (or cash equivalents thereof) due at time of payment computed at rates not less than those contained in the wage determination of the Secretary of Labor which is attached hereto and made a part hereof, regardless of any contractual relationship which may be alleged to exist between the contractor and such laborers and mechanics. . . . (3) Payrolls and basic records. . . . (ii) (A) The contractor shall submit weekly for each week in which any contract work is performed a copy of all payrolls to the (write in name of appropriate federal agency) if the agency is a party to the contract, but if the agency is not such a party, the contractor will submit the payrolls to the applicant, sponsor, or owner, as the case may be, for transmission to the (write in name of agency). The payrolls submitted shall set out accurately and completely all of the information required to be maintained under 29 CFR 5.5(a)(3)(i), except that full social security numbers and home addresses shall not be included on weekly transmittals. . . ." 2 CFR 200 Appendix II states in part: "In addition to other provisions required by the Federal agency or non-Federal entity; all contracts made by the non-Federal entity under the Federal award must contain provisions covering the following, as applicable. . . . (D) Davis-Bacon Act, as amended (40 U.S.C. 3141-3148). When required by Federal program legislation, all prime construction contracts in excess of $2,000 awarded by non- Federal entities must include a provision for compliance with the Davis-Bacon Act (40 U.S.C. 3141-3144, and 3146-3148) as supplemented by Department of Labor regulations (29 CFR Part 5, 'Labor Standards Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction'). In accordance with the statute, contractors must be required to pay wages to laborers and mechanics at a rate not less than the prevailing wages specified in a wage determination made by the Secretary of Labor. In addition, contractors must be required to pay wages not less than once a week. . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, management of the School Corporation did not take steps to ensure compliance with the requirement, such as amending the contract and requesting future payroll certifications, after being made aware of noncompliance during the last audit engagement. INDIANA STATE BOARD OF ACCOUNTS 38 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Furthermore, not taking corrective action after the last audit led to additional noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a system of internal controls and include the wage rate requirement clause in construction contracts and obtain certified payrolls as required. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-009 Subject: COVID-19 - Education Stabilization Fund - Special Tests and Provisions - Wage Rate Requirements Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425U Federal Award Number and Year (or Other Identifying Number): S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Special Tests and Provisions - Wage Rate Requirements Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-005. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 36 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities Construction contracts in excess of $2,000 financed by federal assistance funds must pay wages not less than those established for the locality of the project (prevailing wage rates) by the Department of Labor (DOL) to their laborers and mechanics. Nonfederal entities are to include in their construction contracts subject to the Wage Rate Requirements a provision that the contractor or subcontractor comply with these requirements and the DOL regulations. This would include a requirement to submit a copy of the payroll and statement of compliance to the entity for each week in which contract work was performed. The School Corporation did not have policies and procedures in place to ensure that contractors were paid prevailing wage rates for contracts in excess of $2,000 that were paid from federal grant funds. The one contract tested did not include the required prevailing wage rate clause, and the contractor did not submit the certified payrolls to the School Corporation. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 29 CFR 5.5 states in part: "(a) The Agency head will cause or require the contracting officer to require the contracting officer to insert in full, or (for contracts covered by the Federal Acquisition Regulation (48 CFR chapter 1)) by reference, in any contract in excess of $2,000 which is entered into for the actual construction, alteration and/or repair, including painting and decorating, of a public building or public work, or building or work financed in whole or in part from Federal funds or in accordance with guarantees of a Federal agency or financed from funds obtained by pledge of any contract of a Federal agency to make a loan, grant or annual contribution (except where a different meaning is expressly indicated), and which is subject to the labor standards provisions of any of the laws referenced by § 5.1, the following clauses . . . (1) Minimum wages. INDIANA STATE BOARD OF ACCOUNTS 37 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (i) All laborers and mechanics employed or working upon the site of the work (or otherwise working in construction or development of the project under a development statute), will be paid unconditionally and not less often than once a week, and without subsequent deduction or rebate on any account (except such payroll deductions as are permitted by regulations issued by the Secretary of Labor under the Copeland Act (29 CFR part 3)), the full amount of basic hourly wages and bona fide fringe benefits (or cash equivalents thereof) due at time of payment computed at rates not less than those contained in the wage determination of the Secretary of Labor which is attached hereto and made a part hereof, regardless of any contractual relationship which may be alleged to exist between the contractor and such laborers and mechanics. . . . (3) Payrolls and basic records. . . . (ii) (A) The contractor shall submit weekly for each week in which any contract work is performed a copy of all payrolls to the (write in name of appropriate federal agency) if the agency is a party to the contract, but if the agency is not such a party, the contractor will submit the payrolls to the applicant, sponsor, or owner, as the case may be, for transmission to the (write in name of agency). The payrolls submitted shall set out accurately and completely all of the information required to be maintained under 29 CFR 5.5(a)(3)(i), except that full social security numbers and home addresses shall not be included on weekly transmittals. . . ." 2 CFR 200 Appendix II states in part: "In addition to other provisions required by the Federal agency or non-Federal entity; all contracts made by the non-Federal entity under the Federal award must contain provisions covering the following, as applicable. . . . (D) Davis-Bacon Act, as amended (40 U.S.C. 3141-3148). When required by Federal program legislation, all prime construction contracts in excess of $2,000 awarded by non- Federal entities must include a provision for compliance with the Davis-Bacon Act (40 U.S.C. 3141-3144, and 3146-3148) as supplemented by Department of Labor regulations (29 CFR Part 5, 'Labor Standards Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction'). In accordance with the statute, contractors must be required to pay wages to laborers and mechanics at a rate not less than the prevailing wages specified in a wage determination made by the Secretary of Labor. In addition, contractors must be required to pay wages not less than once a week. . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, management of the School Corporation did not take steps to ensure compliance with the requirement, such as amending the contract and requesting future payroll certifications, after being made aware of noncompliance during the last audit engagement. INDIANA STATE BOARD OF ACCOUNTS 38 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Furthermore, not taking corrective action after the last audit led to additional noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a system of internal controls and include the wage rate requirement clause in construction contracts and obtain certified payrolls as required. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-003 Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Reporting, Special Tests and Provisions - Nonprofit School Food Service Accounts Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and continual process. The process is based on fundamental principles that operate as a whole. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. INDIANA STATE BOARD OF ACCOUNTS 20 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Risk Assessment - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Reporting The School Corporation's Food Service Director was solely responsible for submitting the Monthly Sponsor Claims for reimbursement. There was no evidence of an oversight, review, or approval process to ensure the accuracy and completeness of the reports prior to submission. Control Activities - Special Tests and Provisions - Nonprofit School Food Service Accounts The Treasurer was solely responsible for posting all revenues and expenditures of the nonprofit school food service program into the School Corporation's accounting software. There was no evidence of an oversight, review, or approval process to ensure that only activity of the nonprofit school food service program was posted to the food service account or to ensure that all reimbursements were correctly credited to the nonprofit school food service account. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Due to the small size of the School Corporation, there was often only one individual involved with various aspects of the federal program with limited opportunity for proper segregation of duties. Additionally, management has not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. INDIANA STATE BOARD OF ACCOUNTS 21 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Finally, reimbursement requests could be inaccurate when submitted and the activity of the school food service account could be incorrectly recorded leading to incorrect requests for reimbursement or other errors in reporting or management of the food service account. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure that reports for reimbursement are complete and accurate, and the activity of the school food service account is properly recorded. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-003 Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Reporting, Special Tests and Provisions - Nonprofit School Food Service Accounts Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and continual process. The process is based on fundamental principles that operate as a whole. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. INDIANA STATE BOARD OF ACCOUNTS 20 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Risk Assessment - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Reporting The School Corporation's Food Service Director was solely responsible for submitting the Monthly Sponsor Claims for reimbursement. There was no evidence of an oversight, review, or approval process to ensure the accuracy and completeness of the reports prior to submission. Control Activities - Special Tests and Provisions - Nonprofit School Food Service Accounts The Treasurer was solely responsible for posting all revenues and expenditures of the nonprofit school food service program into the School Corporation's accounting software. There was no evidence of an oversight, review, or approval process to ensure that only activity of the nonprofit school food service program was posted to the food service account or to ensure that all reimbursements were correctly credited to the nonprofit school food service account. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Due to the small size of the School Corporation, there was often only one individual involved with various aspects of the federal program with limited opportunity for proper segregation of duties. Additionally, management has not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. INDIANA STATE BOARD OF ACCOUNTS 21 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Finally, reimbursement requests could be inaccurate when submitted and the activity of the school food service account could be incorrectly recorded leading to incorrect requests for reimbursement or other errors in reporting or management of the food service account. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure that reports for reimbursement are complete and accurate, and the activity of the school food service account is properly recorded. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-003 Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Reporting, Special Tests and Provisions - Nonprofit School Food Service Accounts Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and continual process. The process is based on fundamental principles that operate as a whole. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. INDIANA STATE BOARD OF ACCOUNTS 20 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Risk Assessment - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Reporting The School Corporation's Food Service Director was solely responsible for submitting the Monthly Sponsor Claims for reimbursement. There was no evidence of an oversight, review, or approval process to ensure the accuracy and completeness of the reports prior to submission. Control Activities - Special Tests and Provisions - Nonprofit School Food Service Accounts The Treasurer was solely responsible for posting all revenues and expenditures of the nonprofit school food service program into the School Corporation's accounting software. There was no evidence of an oversight, review, or approval process to ensure that only activity of the nonprofit school food service program was posted to the food service account or to ensure that all reimbursements were correctly credited to the nonprofit school food service account. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Due to the small size of the School Corporation, there was often only one individual involved with various aspects of the federal program with limited opportunity for proper segregation of duties. Additionally, management has not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. INDIANA STATE BOARD OF ACCOUNTS 21 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Finally, reimbursement requests could be inaccurate when submitted and the activity of the school food service account could be incorrectly recorded leading to incorrect requests for reimbursement or other errors in reporting or management of the food service account. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure that reports for reimbursement are complete and accurate, and the activity of the school food service account is properly recorded. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-003 Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Reporting, Special Tests and Provisions - Nonprofit School Food Service Accounts Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and continual process. The process is based on fundamental principles that operate as a whole. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. INDIANA STATE BOARD OF ACCOUNTS 20 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Risk Assessment - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Reporting The School Corporation's Food Service Director was solely responsible for submitting the Monthly Sponsor Claims for reimbursement. There was no evidence of an oversight, review, or approval process to ensure the accuracy and completeness of the reports prior to submission. Control Activities - Special Tests and Provisions - Nonprofit School Food Service Accounts The Treasurer was solely responsible for posting all revenues and expenditures of the nonprofit school food service program into the School Corporation's accounting software. There was no evidence of an oversight, review, or approval process to ensure that only activity of the nonprofit school food service program was posted to the food service account or to ensure that all reimbursements were correctly credited to the nonprofit school food service account. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Due to the small size of the School Corporation, there was often only one individual involved with various aspects of the federal program with limited opportunity for proper segregation of duties. Additionally, management has not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. INDIANA STATE BOARD OF ACCOUNTS 21 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Finally, reimbursement requests could be inaccurate when submitted and the activity of the school food service account could be incorrectly recorded leading to incorrect requests for reimbursement or other errors in reporting or management of the food service account. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure that reports for reimbursement are complete and accurate, and the activity of the school food service account is properly recorded. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-003 Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Reporting, Special Tests and Provisions - Nonprofit School Food Service Accounts Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and continual process. The process is based on fundamental principles that operate as a whole. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. INDIANA STATE BOARD OF ACCOUNTS 20 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Risk Assessment - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Reporting The School Corporation's Food Service Director was solely responsible for submitting the Monthly Sponsor Claims for reimbursement. There was no evidence of an oversight, review, or approval process to ensure the accuracy and completeness of the reports prior to submission. Control Activities - Special Tests and Provisions - Nonprofit School Food Service Accounts The Treasurer was solely responsible for posting all revenues and expenditures of the nonprofit school food service program into the School Corporation's accounting software. There was no evidence of an oversight, review, or approval process to ensure that only activity of the nonprofit school food service program was posted to the food service account or to ensure that all reimbursements were correctly credited to the nonprofit school food service account. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Due to the small size of the School Corporation, there was often only one individual involved with various aspects of the federal program with limited opportunity for proper segregation of duties. Additionally, management has not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. INDIANA STATE BOARD OF ACCOUNTS 21 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Finally, reimbursement requests could be inaccurate when submitted and the activity of the school food service account could be incorrectly recorded leading to incorrect requests for reimbursement or other errors in reporting or management of the food service account. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure that reports for reimbursement are complete and accurate, and the activity of the school food service account is properly recorded. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-004 Subject: Child Nutrition Cluster - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed and Unallowed, Allowable Costs/Cost Principles Audit Findings: Material Weakness, Other Matters Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 22 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities A sample of 60 claims was selected for testing. Of the 60 claims selected for testing, 43 claims were vendor claims and 17 were payroll claims. Issues were identified with 5 of the vendor claims as noted below:  Three claims, totaling $700, were paid based solely upon summary statements from the vendor. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant.  Two claims, totaling $313, were paid with no supporting documentation. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant. The total amount, $1,013, paid without adequate supporting documentation was considered questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 23 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. . . . (g) Be adequately documented. . . ." 7 CFR 210.14(a) states in part: ". . . Revenues received by the nonprofit school food service are to be used only for the operation or improvement of such food service, except that, such revenues shall not be used to purchase land or buildings, unless otherwise approved by FNS, or to construct buildings. . . ." 7 CFR 220.7(e)(1)(ii) states in part: ". . . use all revenues received by such food service only for the operation or improvement of that food service . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not follow proper recordkeeping procedures. The Treasurer paid claims from federal program funds with no support or based on summary statements. INDIANA STATE BOARD OF ACCOUNTS 24 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, we could not determine if federal program funds were used to pay only for the operation or improvement of the food service. Furthermore, the lack of detailed documentation was not in compliance with the cost principles. Continued payment with no support or only summary statements could lead to payments for unallowable activities and additional questioned costs. Questioned Costs Questioned costs in the amount of $1,013 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards have appropriate supporting documentation to ensure expenditures are allowable per the terms and conditions of the federal award and adhere to the cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-004 Subject: Child Nutrition Cluster - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed and Unallowed, Allowable Costs/Cost Principles Audit Findings: Material Weakness, Other Matters Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 22 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities A sample of 60 claims was selected for testing. Of the 60 claims selected for testing, 43 claims were vendor claims and 17 were payroll claims. Issues were identified with 5 of the vendor claims as noted below:  Three claims, totaling $700, were paid based solely upon summary statements from the vendor. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant.  Two claims, totaling $313, were paid with no supporting documentation. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant. The total amount, $1,013, paid without adequate supporting documentation was considered questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 23 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. . . . (g) Be adequately documented. . . ." 7 CFR 210.14(a) states in part: ". . . Revenues received by the nonprofit school food service are to be used only for the operation or improvement of such food service, except that, such revenues shall not be used to purchase land or buildings, unless otherwise approved by FNS, or to construct buildings. . . ." 7 CFR 220.7(e)(1)(ii) states in part: ". . . use all revenues received by such food service only for the operation or improvement of that food service . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not follow proper recordkeeping procedures. The Treasurer paid claims from federal program funds with no support or based on summary statements. INDIANA STATE BOARD OF ACCOUNTS 24 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, we could not determine if federal program funds were used to pay only for the operation or improvement of the food service. Furthermore, the lack of detailed documentation was not in compliance with the cost principles. Continued payment with no support or only summary statements could lead to payments for unallowable activities and additional questioned costs. Questioned Costs Questioned costs in the amount of $1,013 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards have appropriate supporting documentation to ensure expenditures are allowable per the terms and conditions of the federal award and adhere to the cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-004 Subject: Child Nutrition Cluster - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed and Unallowed, Allowable Costs/Cost Principles Audit Findings: Material Weakness, Other Matters Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 22 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities A sample of 60 claims was selected for testing. Of the 60 claims selected for testing, 43 claims were vendor claims and 17 were payroll claims. Issues were identified with 5 of the vendor claims as noted below:  Three claims, totaling $700, were paid based solely upon summary statements from the vendor. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant.  Two claims, totaling $313, were paid with no supporting documentation. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant. The total amount, $1,013, paid without adequate supporting documentation was considered questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 23 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. . . . (g) Be adequately documented. . . ." 7 CFR 210.14(a) states in part: ". . . Revenues received by the nonprofit school food service are to be used only for the operation or improvement of such food service, except that, such revenues shall not be used to purchase land or buildings, unless otherwise approved by FNS, or to construct buildings. . . ." 7 CFR 220.7(e)(1)(ii) states in part: ". . . use all revenues received by such food service only for the operation or improvement of that food service . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not follow proper recordkeeping procedures. The Treasurer paid claims from federal program funds with no support or based on summary statements. INDIANA STATE BOARD OF ACCOUNTS 24 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, we could not determine if federal program funds were used to pay only for the operation or improvement of the food service. Furthermore, the lack of detailed documentation was not in compliance with the cost principles. Continued payment with no support or only summary statements could lead to payments for unallowable activities and additional questioned costs. Questioned Costs Questioned costs in the amount of $1,013 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards have appropriate supporting documentation to ensure expenditures are allowable per the terms and conditions of the federal award and adhere to the cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-004 Subject: Child Nutrition Cluster - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed and Unallowed, Allowable Costs/Cost Principles Audit Findings: Material Weakness, Other Matters Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 22 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities A sample of 60 claims was selected for testing. Of the 60 claims selected for testing, 43 claims were vendor claims and 17 were payroll claims. Issues were identified with 5 of the vendor claims as noted below:  Three claims, totaling $700, were paid based solely upon summary statements from the vendor. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant.  Two claims, totaling $313, were paid with no supporting documentation. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant. The total amount, $1,013, paid without adequate supporting documentation was considered questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 23 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. . . . (g) Be adequately documented. . . ." 7 CFR 210.14(a) states in part: ". . . Revenues received by the nonprofit school food service are to be used only for the operation or improvement of such food service, except that, such revenues shall not be used to purchase land or buildings, unless otherwise approved by FNS, or to construct buildings. . . ." 7 CFR 220.7(e)(1)(ii) states in part: ". . . use all revenues received by such food service only for the operation or improvement of that food service . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not follow proper recordkeeping procedures. The Treasurer paid claims from federal program funds with no support or based on summary statements. INDIANA STATE BOARD OF ACCOUNTS 24 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, we could not determine if federal program funds were used to pay only for the operation or improvement of the food service. Furthermore, the lack of detailed documentation was not in compliance with the cost principles. Continued payment with no support or only summary statements could lead to payments for unallowable activities and additional questioned costs. Questioned Costs Questioned costs in the amount of $1,013 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards have appropriate supporting documentation to ensure expenditures are allowable per the terms and conditions of the federal award and adhere to the cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-004 Subject: Child Nutrition Cluster - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed and Unallowed, Allowable Costs/Cost Principles Audit Findings: Material Weakness, Other Matters Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 22 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities A sample of 60 claims was selected for testing. Of the 60 claims selected for testing, 43 claims were vendor claims and 17 were payroll claims. Issues were identified with 5 of the vendor claims as noted below:  Three claims, totaling $700, were paid based solely upon summary statements from the vendor. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant.  Two claims, totaling $313, were paid with no supporting documentation. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant. The total amount, $1,013, paid without adequate supporting documentation was considered questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 23 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. . . . (g) Be adequately documented. . . ." 7 CFR 210.14(a) states in part: ". . . Revenues received by the nonprofit school food service are to be used only for the operation or improvement of such food service, except that, such revenues shall not be used to purchase land or buildings, unless otherwise approved by FNS, or to construct buildings. . . ." 7 CFR 220.7(e)(1)(ii) states in part: ". . . use all revenues received by such food service only for the operation or improvement of that food service . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not follow proper recordkeeping procedures. The Treasurer paid claims from federal program funds with no support or based on summary statements. INDIANA STATE BOARD OF ACCOUNTS 24 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, we could not determine if federal program funds were used to pay only for the operation or improvement of the food service. Furthermore, the lack of detailed documentation was not in compliance with the cost principles. Continued payment with no support or only summary statements could lead to payments for unallowable activities and additional questioned costs. Questioned Costs Questioned costs in the amount of $1,013 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards have appropriate supporting documentation to ensure expenditures are allowable per the terms and conditions of the federal award and adhere to the cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-005 Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 25 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Procurement The School Corporation made purchases from two and three vendors during fiscal years 2022- 2023 and 2023-2024, respectively, for which expenditures fell under the small purchase threshold. The School Corporation could not provide any documentation that the procurement method used was appropriate or that the procurements provided full and open competition or rationale to support the determination to limit competition. Additionally, the history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented. The School Corporation made purchases from five and four vendors during 2022-2023 and 2023-2024, respectively, for which expenditures fell under the micro-purchase threshold. The history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented for any of the vendors. Control Activities - Suspension and Debarment The School Corporation utilized two vendors during 2022-2023 and 2023-2024 for which purchases throughout the year exceeded $25,000. The School Corporation was unable to provide any evidence that they verified that the vendors were not suspended or debarred from participation in federal programs. The lack of internal controls and noncompliance were systemic throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 26 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.318(a) states: "The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or service required under a federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standard identified in §§ 200.317 through 200.327." 2 CFR 200.320 states in part: "The non-Federal entity must have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award. (a) Informal procurement methods. When the value of the procurement for property or services under a Federal award does not exceed the simplified acquisition threshold (SAT), as defined in § 200.1, or a lower threshold established by a non-Federal entity, formal procurement methods are not required. The non-Federal entity may use informal procurement methods to expedite the completion of its transactions and minimize the associated administrative burden and cost. The informal methods used for procurement of property or services at or below the SAT include: . . . (1) Micro-purchases — (i) Distribution. The acquisition of supplies or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (See the definition of micro-purchase in § 200.1). To the maximum extent practicable, the non-Federal entity should distribute micro-purchases equitably among qualified suppliers. (ii) Micro-purchase awards. Micro-purchases may be awarded without soliciting competitive price or rate quotations if the non-Federal entity considers the price to be reasonable based on research, experience, purchase history or other information and documents it files accordingly. Purchase cards can be used for micropurchases if procedures are documented and approved by the non-Federal entity. . . . (2) Small purchases — (i) Small purchase procedures. The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. . . ." INDIANA STATE BOARD OF ACCOUNTS 27 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the SAM.gov Exclusions, or (b) Collecting a certification from that person, or (c) Adding a clause or condition to the covered transaction with that person." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the small size and location of the School Corporation were the determining factors when making purchasing decisions as many vendors will not service the School Corporation. Therefore, the School Corporation has used the same vendors for many years. As such, the School Corporation did not follow the proper procurement procedures to document the reason that competition was limited. Accordingly, the School Corporation also did not check the vendors' suspension and debarment status. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Furthermore, by not properly completing the procurement process the School Corporation could have overpaid goods or services. Additionally, the School Corporation could have made payment to a vendor that was suspended or debarred. Payments to a suspended or debarred vendor are unallowable. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards use the appropriate procurement method and retain the documentation to support the procurement methods used in order to ensure compliance with the terms and conditions of the federal award. Additionally, we recommend that the School Corporation's management verify applicable vendors are not suspended or debarred prior to making payment. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-005 Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 25 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Procurement The School Corporation made purchases from two and three vendors during fiscal years 2022- 2023 and 2023-2024, respectively, for which expenditures fell under the small purchase threshold. The School Corporation could not provide any documentation that the procurement method used was appropriate or that the procurements provided full and open competition or rationale to support the determination to limit competition. Additionally, the history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented. The School Corporation made purchases from five and four vendors during 2022-2023 and 2023-2024, respectively, for which expenditures fell under the micro-purchase threshold. The history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented for any of the vendors. Control Activities - Suspension and Debarment The School Corporation utilized two vendors during 2022-2023 and 2023-2024 for which purchases throughout the year exceeded $25,000. The School Corporation was unable to provide any evidence that they verified that the vendors were not suspended or debarred from participation in federal programs. The lack of internal controls and noncompliance were systemic throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 26 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.318(a) states: "The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or service required under a federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standard identified in §§ 200.317 through 200.327." 2 CFR 200.320 states in part: "The non-Federal entity must have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award. (a) Informal procurement methods. When the value of the procurement for property or services under a Federal award does not exceed the simplified acquisition threshold (SAT), as defined in § 200.1, or a lower threshold established by a non-Federal entity, formal procurement methods are not required. The non-Federal entity may use informal procurement methods to expedite the completion of its transactions and minimize the associated administrative burden and cost. The informal methods used for procurement of property or services at or below the SAT include: . . . (1) Micro-purchases — (i) Distribution. The acquisition of supplies or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (See the definition of micro-purchase in § 200.1). To the maximum extent practicable, the non-Federal entity should distribute micro-purchases equitably among qualified suppliers. (ii) Micro-purchase awards. Micro-purchases may be awarded without soliciting competitive price or rate quotations if the non-Federal entity considers the price to be reasonable based on research, experience, purchase history or other information and documents it files accordingly. Purchase cards can be used for micropurchases if procedures are documented and approved by the non-Federal entity. . . . (2) Small purchases — (i) Small purchase procedures. The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. . . ." INDIANA STATE BOARD OF ACCOUNTS 27 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the SAM.gov Exclusions, or (b) Collecting a certification from that person, or (c) Adding a clause or condition to the covered transaction with that person." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the small size and location of the School Corporation were the determining factors when making purchasing decisions as many vendors will not service the School Corporation. Therefore, the School Corporation has used the same vendors for many years. As such, the School Corporation did not follow the proper procurement procedures to document the reason that competition was limited. Accordingly, the School Corporation also did not check the vendors' suspension and debarment status. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Furthermore, by not properly completing the procurement process the School Corporation could have overpaid goods or services. Additionally, the School Corporation could have made payment to a vendor that was suspended or debarred. Payments to a suspended or debarred vendor are unallowable. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards use the appropriate procurement method and retain the documentation to support the procurement methods used in order to ensure compliance with the terms and conditions of the federal award. Additionally, we recommend that the School Corporation's management verify applicable vendors are not suspended or debarred prior to making payment. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-005 Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 25 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Procurement The School Corporation made purchases from two and three vendors during fiscal years 2022- 2023 and 2023-2024, respectively, for which expenditures fell under the small purchase threshold. The School Corporation could not provide any documentation that the procurement method used was appropriate or that the procurements provided full and open competition or rationale to support the determination to limit competition. Additionally, the history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented. The School Corporation made purchases from five and four vendors during 2022-2023 and 2023-2024, respectively, for which expenditures fell under the micro-purchase threshold. The history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented for any of the vendors. Control Activities - Suspension and Debarment The School Corporation utilized two vendors during 2022-2023 and 2023-2024 for which purchases throughout the year exceeded $25,000. The School Corporation was unable to provide any evidence that they verified that the vendors were not suspended or debarred from participation in federal programs. The lack of internal controls and noncompliance were systemic throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 26 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.318(a) states: "The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or service required under a federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standard identified in §§ 200.317 through 200.327." 2 CFR 200.320 states in part: "The non-Federal entity must have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award. (a) Informal procurement methods. When the value of the procurement for property or services under a Federal award does not exceed the simplified acquisition threshold (SAT), as defined in § 200.1, or a lower threshold established by a non-Federal entity, formal procurement methods are not required. The non-Federal entity may use informal procurement methods to expedite the completion of its transactions and minimize the associated administrative burden and cost. The informal methods used for procurement of property or services at or below the SAT include: . . . (1) Micro-purchases — (i) Distribution. The acquisition of supplies or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (See the definition of micro-purchase in § 200.1). To the maximum extent practicable, the non-Federal entity should distribute micro-purchases equitably among qualified suppliers. (ii) Micro-purchase awards. Micro-purchases may be awarded without soliciting competitive price or rate quotations if the non-Federal entity considers the price to be reasonable based on research, experience, purchase history or other information and documents it files accordingly. Purchase cards can be used for micropurchases if procedures are documented and approved by the non-Federal entity. . . . (2) Small purchases — (i) Small purchase procedures. The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. . . ." INDIANA STATE BOARD OF ACCOUNTS 27 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the SAM.gov Exclusions, or (b) Collecting a certification from that person, or (c) Adding a clause or condition to the covered transaction with that person." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the small size and location of the School Corporation were the determining factors when making purchasing decisions as many vendors will not service the School Corporation. Therefore, the School Corporation has used the same vendors for many years. As such, the School Corporation did not follow the proper procurement procedures to document the reason that competition was limited. Accordingly, the School Corporation also did not check the vendors' suspension and debarment status. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Furthermore, by not properly completing the procurement process the School Corporation could have overpaid goods or services. Additionally, the School Corporation could have made payment to a vendor that was suspended or debarred. Payments to a suspended or debarred vendor are unallowable. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards use the appropriate procurement method and retain the documentation to support the procurement methods used in order to ensure compliance with the terms and conditions of the federal award. Additionally, we recommend that the School Corporation's management verify applicable vendors are not suspended or debarred prior to making payment. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-005 Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 25 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Procurement The School Corporation made purchases from two and three vendors during fiscal years 2022- 2023 and 2023-2024, respectively, for which expenditures fell under the small purchase threshold. The School Corporation could not provide any documentation that the procurement method used was appropriate or that the procurements provided full and open competition or rationale to support the determination to limit competition. Additionally, the history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented. The School Corporation made purchases from five and four vendors during 2022-2023 and 2023-2024, respectively, for which expenditures fell under the micro-purchase threshold. The history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented for any of the vendors. Control Activities - Suspension and Debarment The School Corporation utilized two vendors during 2022-2023 and 2023-2024 for which purchases throughout the year exceeded $25,000. The School Corporation was unable to provide any evidence that they verified that the vendors were not suspended or debarred from participation in federal programs. The lack of internal controls and noncompliance were systemic throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 26 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.318(a) states: "The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or service required under a federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standard identified in §§ 200.317 through 200.327." 2 CFR 200.320 states in part: "The non-Federal entity must have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award. (a) Informal procurement methods. When the value of the procurement for property or services under a Federal award does not exceed the simplified acquisition threshold (SAT), as defined in § 200.1, or a lower threshold established by a non-Federal entity, formal procurement methods are not required. The non-Federal entity may use informal procurement methods to expedite the completion of its transactions and minimize the associated administrative burden and cost. The informal methods used for procurement of property or services at or below the SAT include: . . . (1) Micro-purchases — (i) Distribution. The acquisition of supplies or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (See the definition of micro-purchase in § 200.1). To the maximum extent practicable, the non-Federal entity should distribute micro-purchases equitably among qualified suppliers. (ii) Micro-purchase awards. Micro-purchases may be awarded without soliciting competitive price or rate quotations if the non-Federal entity considers the price to be reasonable based on research, experience, purchase history or other information and documents it files accordingly. Purchase cards can be used for micropurchases if procedures are documented and approved by the non-Federal entity. . . . (2) Small purchases — (i) Small purchase procedures. The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. . . ." INDIANA STATE BOARD OF ACCOUNTS 27 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the SAM.gov Exclusions, or (b) Collecting a certification from that person, or (c) Adding a clause or condition to the covered transaction with that person." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the small size and location of the School Corporation were the determining factors when making purchasing decisions as many vendors will not service the School Corporation. Therefore, the School Corporation has used the same vendors for many years. As such, the School Corporation did not follow the proper procurement procedures to document the reason that competition was limited. Accordingly, the School Corporation also did not check the vendors' suspension and debarment status. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Furthermore, by not properly completing the procurement process the School Corporation could have overpaid goods or services. Additionally, the School Corporation could have made payment to a vendor that was suspended or debarred. Payments to a suspended or debarred vendor are unallowable. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards use the appropriate procurement method and retain the documentation to support the procurement methods used in order to ensure compliance with the terms and conditions of the federal award. Additionally, we recommend that the School Corporation's management verify applicable vendors are not suspended or debarred prior to making payment. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-005 Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 25 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Procurement The School Corporation made purchases from two and three vendors during fiscal years 2022- 2023 and 2023-2024, respectively, for which expenditures fell under the small purchase threshold. The School Corporation could not provide any documentation that the procurement method used was appropriate or that the procurements provided full and open competition or rationale to support the determination to limit competition. Additionally, the history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented. The School Corporation made purchases from five and four vendors during 2022-2023 and 2023-2024, respectively, for which expenditures fell under the micro-purchase threshold. The history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented for any of the vendors. Control Activities - Suspension and Debarment The School Corporation utilized two vendors during 2022-2023 and 2023-2024 for which purchases throughout the year exceeded $25,000. The School Corporation was unable to provide any evidence that they verified that the vendors were not suspended or debarred from participation in federal programs. The lack of internal controls and noncompliance were systemic throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 26 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.318(a) states: "The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or service required under a federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standard identified in §§ 200.317 through 200.327." 2 CFR 200.320 states in part: "The non-Federal entity must have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award. (a) Informal procurement methods. When the value of the procurement for property or services under a Federal award does not exceed the simplified acquisition threshold (SAT), as defined in § 200.1, or a lower threshold established by a non-Federal entity, formal procurement methods are not required. The non-Federal entity may use informal procurement methods to expedite the completion of its transactions and minimize the associated administrative burden and cost. The informal methods used for procurement of property or services at or below the SAT include: . . . (1) Micro-purchases — (i) Distribution. The acquisition of supplies or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (See the definition of micro-purchase in § 200.1). To the maximum extent practicable, the non-Federal entity should distribute micro-purchases equitably among qualified suppliers. (ii) Micro-purchase awards. Micro-purchases may be awarded without soliciting competitive price or rate quotations if the non-Federal entity considers the price to be reasonable based on research, experience, purchase history or other information and documents it files accordingly. Purchase cards can be used for micropurchases if procedures are documented and approved by the non-Federal entity. . . . (2) Small purchases — (i) Small purchase procedures. The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. . . ." INDIANA STATE BOARD OF ACCOUNTS 27 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the SAM.gov Exclusions, or (b) Collecting a certification from that person, or (c) Adding a clause or condition to the covered transaction with that person." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the small size and location of the School Corporation were the determining factors when making purchasing decisions as many vendors will not service the School Corporation. Therefore, the School Corporation has used the same vendors for many years. As such, the School Corporation did not follow the proper procurement procedures to document the reason that competition was limited. Accordingly, the School Corporation also did not check the vendors' suspension and debarment status. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Furthermore, by not properly completing the procurement process the School Corporation could have overpaid goods or services. Additionally, the School Corporation could have made payment to a vendor that was suspended or debarred. Payments to a suspended or debarred vendor are unallowable. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards use the appropriate procurement method and retain the documentation to support the procurement methods used in order to ensure compliance with the terms and conditions of the federal award. Additionally, we recommend that the School Corporation's management verify applicable vendors are not suspended or debarred prior to making payment. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-007 Subject: COVID-19 - Education Stabilization Fund - Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Allowable Costs/Cost Principles Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 30 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was a participating member in The Exceptional Children's Cooperative (Cooperative) which provided special education services to students on behalf of the School Corporation. The School Corporation utilized $15,672 in program funds to pay for a portion of the School Corporation's required obligations to the Cooperative. This arrangement existed prior to the pandemic, and none of the obligations were related to responding to the pandemic. Additionally, the School Corporation used $12,000 in program funds to pay a retainer fee for information technology services on a contract that existed prior to the COVID-19 pandemic. The School Corporation also used $147,809 in program funds to pay the salary and benefits of a certified staff member who was employed prior to the pandemic and whose job duties were not related to responding to the pandemic. We consider the total of these payments, $175,481, to be questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 31 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) American Rescue Plan Act section 2001(e) states in part: "Uses of Funds. - A local education agency that receives funds under this section - . . . (2) shall use the remaining funds for any of the following: . . . (E) Coordination of preparedness and response efforts of local education agencies with State, local, Tribal, and territorial public health departments, and other relevant agencies, to improve coordinated responses among such entities to prevent, prepare for, and respond to coronavirus. . . . (G) Developing and implementing procedures and systems to improve the preparedness and response efforts of local educational agencies. . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (3) Records that identify adequately the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. . . . (g) be adequately documented. . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation's management had not developed a system of internal controls to ensure that expenditures paid from COVID-19 - Education Stabilization Funds were for costs allowed by the grant terms and conditions and in compliance with the allowable cost principles. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Without a proper system of internal controls in place that operated effectively, material noncompliance that resulted in questioned costs remained undetected. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funds to the School Corporation. INDIANA STATE BOARD OF ACCOUNTS 32 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs Questioned costs in the amount of $175,481 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards are for cost allowed per the terms and conditions of the federal award and in compliance with the allowable cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-007 Subject: COVID-19 - Education Stabilization Fund - Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Allowable Costs/Cost Principles Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 30 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was a participating member in The Exceptional Children's Cooperative (Cooperative) which provided special education services to students on behalf of the School Corporation. The School Corporation utilized $15,672 in program funds to pay for a portion of the School Corporation's required obligations to the Cooperative. This arrangement existed prior to the pandemic, and none of the obligations were related to responding to the pandemic. Additionally, the School Corporation used $12,000 in program funds to pay a retainer fee for information technology services on a contract that existed prior to the COVID-19 pandemic. The School Corporation also used $147,809 in program funds to pay the salary and benefits of a certified staff member who was employed prior to the pandemic and whose job duties were not related to responding to the pandemic. We consider the total of these payments, $175,481, to be questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 31 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) American Rescue Plan Act section 2001(e) states in part: "Uses of Funds. - A local education agency that receives funds under this section - . . . (2) shall use the remaining funds for any of the following: . . . (E) Coordination of preparedness and response efforts of local education agencies with State, local, Tribal, and territorial public health departments, and other relevant agencies, to improve coordinated responses among such entities to prevent, prepare for, and respond to coronavirus. . . . (G) Developing and implementing procedures and systems to improve the preparedness and response efforts of local educational agencies. . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (3) Records that identify adequately the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. . . . (g) be adequately documented. . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation's management had not developed a system of internal controls to ensure that expenditures paid from COVID-19 - Education Stabilization Funds were for costs allowed by the grant terms and conditions and in compliance with the allowable cost principles. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Without a proper system of internal controls in place that operated effectively, material noncompliance that resulted in questioned costs remained undetected. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funds to the School Corporation. INDIANA STATE BOARD OF ACCOUNTS 32 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs Questioned costs in the amount of $175,481 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards are for cost allowed per the terms and conditions of the federal award and in compliance with the allowable cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-007 Subject: COVID-19 - Education Stabilization Fund - Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Allowable Costs/Cost Principles Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 30 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was a participating member in The Exceptional Children's Cooperative (Cooperative) which provided special education services to students on behalf of the School Corporation. The School Corporation utilized $15,672 in program funds to pay for a portion of the School Corporation's required obligations to the Cooperative. This arrangement existed prior to the pandemic, and none of the obligations were related to responding to the pandemic. Additionally, the School Corporation used $12,000 in program funds to pay a retainer fee for information technology services on a contract that existed prior to the COVID-19 pandemic. The School Corporation also used $147,809 in program funds to pay the salary and benefits of a certified staff member who was employed prior to the pandemic and whose job duties were not related to responding to the pandemic. We consider the total of these payments, $175,481, to be questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 31 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) American Rescue Plan Act section 2001(e) states in part: "Uses of Funds. - A local education agency that receives funds under this section - . . . (2) shall use the remaining funds for any of the following: . . . (E) Coordination of preparedness and response efforts of local education agencies with State, local, Tribal, and territorial public health departments, and other relevant agencies, to improve coordinated responses among such entities to prevent, prepare for, and respond to coronavirus. . . . (G) Developing and implementing procedures and systems to improve the preparedness and response efforts of local educational agencies. . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (3) Records that identify adequately the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. . . . (g) be adequately documented. . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation's management had not developed a system of internal controls to ensure that expenditures paid from COVID-19 - Education Stabilization Funds were for costs allowed by the grant terms and conditions and in compliance with the allowable cost principles. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Without a proper system of internal controls in place that operated effectively, material noncompliance that resulted in questioned costs remained undetected. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funds to the School Corporation. INDIANA STATE BOARD OF ACCOUNTS 32 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs Questioned costs in the amount of $175,481 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards are for cost allowed per the terms and conditions of the federal award and in compliance with the allowable cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-007 Subject: COVID-19 - Education Stabilization Fund - Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Allowable Costs/Cost Principles Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 30 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was a participating member in The Exceptional Children's Cooperative (Cooperative) which provided special education services to students on behalf of the School Corporation. The School Corporation utilized $15,672 in program funds to pay for a portion of the School Corporation's required obligations to the Cooperative. This arrangement existed prior to the pandemic, and none of the obligations were related to responding to the pandemic. Additionally, the School Corporation used $12,000 in program funds to pay a retainer fee for information technology services on a contract that existed prior to the COVID-19 pandemic. The School Corporation also used $147,809 in program funds to pay the salary and benefits of a certified staff member who was employed prior to the pandemic and whose job duties were not related to responding to the pandemic. We consider the total of these payments, $175,481, to be questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 31 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) American Rescue Plan Act section 2001(e) states in part: "Uses of Funds. - A local education agency that receives funds under this section - . . . (2) shall use the remaining funds for any of the following: . . . (E) Coordination of preparedness and response efforts of local education agencies with State, local, Tribal, and territorial public health departments, and other relevant agencies, to improve coordinated responses among such entities to prevent, prepare for, and respond to coronavirus. . . . (G) Developing and implementing procedures and systems to improve the preparedness and response efforts of local educational agencies. . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (3) Records that identify adequately the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. . . . (g) be adequately documented. . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation's management had not developed a system of internal controls to ensure that expenditures paid from COVID-19 - Education Stabilization Funds were for costs allowed by the grant terms and conditions and in compliance with the allowable cost principles. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Without a proper system of internal controls in place that operated effectively, material noncompliance that resulted in questioned costs remained undetected. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funds to the School Corporation. INDIANA STATE BOARD OF ACCOUNTS 32 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs Questioned costs in the amount of $175,481 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards are for cost allowed per the terms and conditions of the federal award and in compliance with the allowable cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-009 Subject: COVID-19 - Education Stabilization Fund - Special Tests and Provisions - Wage Rate Requirements Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425U Federal Award Number and Year (or Other Identifying Number): S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Special Tests and Provisions - Wage Rate Requirements Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-005. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 36 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities Construction contracts in excess of $2,000 financed by federal assistance funds must pay wages not less than those established for the locality of the project (prevailing wage rates) by the Department of Labor (DOL) to their laborers and mechanics. Nonfederal entities are to include in their construction contracts subject to the Wage Rate Requirements a provision that the contractor or subcontractor comply with these requirements and the DOL regulations. This would include a requirement to submit a copy of the payroll and statement of compliance to the entity for each week in which contract work was performed. The School Corporation did not have policies and procedures in place to ensure that contractors were paid prevailing wage rates for contracts in excess of $2,000 that were paid from federal grant funds. The one contract tested did not include the required prevailing wage rate clause, and the contractor did not submit the certified payrolls to the School Corporation. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 29 CFR 5.5 states in part: "(a) The Agency head will cause or require the contracting officer to require the contracting officer to insert in full, or (for contracts covered by the Federal Acquisition Regulation (48 CFR chapter 1)) by reference, in any contract in excess of $2,000 which is entered into for the actual construction, alteration and/or repair, including painting and decorating, of a public building or public work, or building or work financed in whole or in part from Federal funds or in accordance with guarantees of a Federal agency or financed from funds obtained by pledge of any contract of a Federal agency to make a loan, grant or annual contribution (except where a different meaning is expressly indicated), and which is subject to the labor standards provisions of any of the laws referenced by § 5.1, the following clauses . . . (1) Minimum wages. INDIANA STATE BOARD OF ACCOUNTS 37 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (i) All laborers and mechanics employed or working upon the site of the work (or otherwise working in construction or development of the project under a development statute), will be paid unconditionally and not less often than once a week, and without subsequent deduction or rebate on any account (except such payroll deductions as are permitted by regulations issued by the Secretary of Labor under the Copeland Act (29 CFR part 3)), the full amount of basic hourly wages and bona fide fringe benefits (or cash equivalents thereof) due at time of payment computed at rates not less than those contained in the wage determination of the Secretary of Labor which is attached hereto and made a part hereof, regardless of any contractual relationship which may be alleged to exist between the contractor and such laborers and mechanics. . . . (3) Payrolls and basic records. . . . (ii) (A) The contractor shall submit weekly for each week in which any contract work is performed a copy of all payrolls to the (write in name of appropriate federal agency) if the agency is a party to the contract, but if the agency is not such a party, the contractor will submit the payrolls to the applicant, sponsor, or owner, as the case may be, for transmission to the (write in name of agency). The payrolls submitted shall set out accurately and completely all of the information required to be maintained under 29 CFR 5.5(a)(3)(i), except that full social security numbers and home addresses shall not be included on weekly transmittals. . . ." 2 CFR 200 Appendix II states in part: "In addition to other provisions required by the Federal agency or non-Federal entity; all contracts made by the non-Federal entity under the Federal award must contain provisions covering the following, as applicable. . . . (D) Davis-Bacon Act, as amended (40 U.S.C. 3141-3148). When required by Federal program legislation, all prime construction contracts in excess of $2,000 awarded by non- Federal entities must include a provision for compliance with the Davis-Bacon Act (40 U.S.C. 3141-3144, and 3146-3148) as supplemented by Department of Labor regulations (29 CFR Part 5, 'Labor Standards Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction'). In accordance with the statute, contractors must be required to pay wages to laborers and mechanics at a rate not less than the prevailing wages specified in a wage determination made by the Secretary of Labor. In addition, contractors must be required to pay wages not less than once a week. . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, management of the School Corporation did not take steps to ensure compliance with the requirement, such as amending the contract and requesting future payroll certifications, after being made aware of noncompliance during the last audit engagement. INDIANA STATE BOARD OF ACCOUNTS 38 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Furthermore, not taking corrective action after the last audit led to additional noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a system of internal controls and include the wage rate requirement clause in construction contracts and obtain certified payrolls as required. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-009 Subject: COVID-19 - Education Stabilization Fund - Special Tests and Provisions - Wage Rate Requirements Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425U Federal Award Number and Year (or Other Identifying Number): S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Special Tests and Provisions - Wage Rate Requirements Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-005. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 36 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities Construction contracts in excess of $2,000 financed by federal assistance funds must pay wages not less than those established for the locality of the project (prevailing wage rates) by the Department of Labor (DOL) to their laborers and mechanics. Nonfederal entities are to include in their construction contracts subject to the Wage Rate Requirements a provision that the contractor or subcontractor comply with these requirements and the DOL regulations. This would include a requirement to submit a copy of the payroll and statement of compliance to the entity for each week in which contract work was performed. The School Corporation did not have policies and procedures in place to ensure that contractors were paid prevailing wage rates for contracts in excess of $2,000 that were paid from federal grant funds. The one contract tested did not include the required prevailing wage rate clause, and the contractor did not submit the certified payrolls to the School Corporation. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 29 CFR 5.5 states in part: "(a) The Agency head will cause or require the contracting officer to require the contracting officer to insert in full, or (for contracts covered by the Federal Acquisition Regulation (48 CFR chapter 1)) by reference, in any contract in excess of $2,000 which is entered into for the actual construction, alteration and/or repair, including painting and decorating, of a public building or public work, or building or work financed in whole or in part from Federal funds or in accordance with guarantees of a Federal agency or financed from funds obtained by pledge of any contract of a Federal agency to make a loan, grant or annual contribution (except where a different meaning is expressly indicated), and which is subject to the labor standards provisions of any of the laws referenced by § 5.1, the following clauses . . . (1) Minimum wages. INDIANA STATE BOARD OF ACCOUNTS 37 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (i) All laborers and mechanics employed or working upon the site of the work (or otherwise working in construction or development of the project under a development statute), will be paid unconditionally and not less often than once a week, and without subsequent deduction or rebate on any account (except such payroll deductions as are permitted by regulations issued by the Secretary of Labor under the Copeland Act (29 CFR part 3)), the full amount of basic hourly wages and bona fide fringe benefits (or cash equivalents thereof) due at time of payment computed at rates not less than those contained in the wage determination of the Secretary of Labor which is attached hereto and made a part hereof, regardless of any contractual relationship which may be alleged to exist between the contractor and such laborers and mechanics. . . . (3) Payrolls and basic records. . . . (ii) (A) The contractor shall submit weekly for each week in which any contract work is performed a copy of all payrolls to the (write in name of appropriate federal agency) if the agency is a party to the contract, but if the agency is not such a party, the contractor will submit the payrolls to the applicant, sponsor, or owner, as the case may be, for transmission to the (write in name of agency). The payrolls submitted shall set out accurately and completely all of the information required to be maintained under 29 CFR 5.5(a)(3)(i), except that full social security numbers and home addresses shall not be included on weekly transmittals. . . ." 2 CFR 200 Appendix II states in part: "In addition to other provisions required by the Federal agency or non-Federal entity; all contracts made by the non-Federal entity under the Federal award must contain provisions covering the following, as applicable. . . . (D) Davis-Bacon Act, as amended (40 U.S.C. 3141-3148). When required by Federal program legislation, all prime construction contracts in excess of $2,000 awarded by non- Federal entities must include a provision for compliance with the Davis-Bacon Act (40 U.S.C. 3141-3144, and 3146-3148) as supplemented by Department of Labor regulations (29 CFR Part 5, 'Labor Standards Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction'). In accordance with the statute, contractors must be required to pay wages to laborers and mechanics at a rate not less than the prevailing wages specified in a wage determination made by the Secretary of Labor. In addition, contractors must be required to pay wages not less than once a week. . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, management of the School Corporation did not take steps to ensure compliance with the requirement, such as amending the contract and requesting future payroll certifications, after being made aware of noncompliance during the last audit engagement. INDIANA STATE BOARD OF ACCOUNTS 38 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Furthermore, not taking corrective action after the last audit led to additional noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a system of internal controls and include the wage rate requirement clause in construction contracts and obtain certified payrolls as required. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.