Audit 350238

SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (Continued) Ref. No. 2024-005 Subrecipient Monitoring - Significant Deficiency Federal agency: Department of Treasury Pass-Through Entity: State of Hawaii Program: ALN No. 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Repeat Finding? Yes; 2023-005 Criteria: Subrecipient monitoring and management requirements for pass-through entities at 2 CFR §200.332 - Requirements for pass-through entities require that the County: • Evaluate each subrecipient’s fraud risk and risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward [2 CFR § 200.332(c)]. • Verify that subrecipients are audited as required by 2 CFR Part 200, Subpart F - Audit Requirements if the entity expended $750,000 or more during the entity’s fiscal year [2 CFR § 200.332(g)]. As part of the County’s policies and procedures to evaluate subrecipient risk and to determine whether or not the subrecipient is subject to an audit as required by 2 CFR Part 200, Subpart F - Audit Requirements, subrecipients are required to complete the “Subrecipient Monitoring and Risk Assessment Form” which is to be submitted along with the subrecipient’s grant application or prior to the execution of the grant agreement, upon award. Condition: During our testing of the subrecipient monitoring compliance requirement, we discovered three (3) out of 3 samples tested where the County did not complete the Subrecipient Monitoring and Risk Assessment Form. Cause: The County did not follow its policies and procedures over subrecipient monitoring throughout the fiscal year. Effect: Completion of the Subrecipient Monitoring and Risk Assessment Form for subrecipients help ensure proper accountability and compliance with program requirements and achievement of performance goals. Questioned Cost: $ -- Recommendation We recommend the County follow its policies and procedures for its subrecipients to ensure proper monitoring activities are performed as required by 2 CFR §200.332 Views of Responsible Officials and Planned Corrective Action The County agrees with the finding and the recommendation. See Part IV Corrective Action Plan.

SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (Continued) Ref. No. 2024-005 Subrecipient Monitoring - Significant Deficiency Federal agency: Department of Treasury Pass-Through Entity: State of Hawaii Program: ALN No. 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Repeat Finding? Yes; 2023-005 Criteria: Subrecipient monitoring and management requirements for pass-through entities at 2 CFR §200.332 - Requirements for pass-through entities require that the County: • Evaluate each subrecipient’s fraud risk and risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward [2 CFR § 200.332(c)]. • Verify that subrecipients are audited as required by 2 CFR Part 200, Subpart F - Audit Requirements if the entity expended $750,000 or more during the entity’s fiscal year [2 CFR § 200.332(g)]. As part of the County’s policies and procedures to evaluate subrecipient risk and to determine whether or not the subrecipient is subject to an audit as required by 2 CFR Part 200, Subpart F - Audit Requirements, subrecipients are required to complete the “Subrecipient Monitoring and Risk Assessment Form” which is to be submitted along with the subrecipient’s grant application or prior to the execution of the grant agreement, upon award. Condition: During our testing of the subrecipient monitoring compliance requirement, we discovered three (3) out of 3 samples tested where the County did not complete the Subrecipient Monitoring and Risk Assessment Form. Cause: The County did not follow its policies and procedures over subrecipient monitoring throughout the fiscal year. Effect: Completion of the Subrecipient Monitoring and Risk Assessment Form for subrecipients help ensure proper accountability and compliance with program requirements and achievement of performance goals. Questioned Cost: $ -- Recommendation We recommend the County follow its policies and procedures for its subrecipients to ensure proper monitoring activities are performed as required by 2 CFR §200.332 Views of Responsible Officials and Planned Corrective Action The County agrees with the finding and the recommendation. See Part IV Corrective Action Plan.

SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (Continued) Ref. No. 2024-005 Subrecipient Monitoring - Significant Deficiency Federal agency: Department of Treasury Pass-Through Entity: State of Hawaii Program: ALN No. 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Repeat Finding? Yes; 2023-005 Criteria: Subrecipient monitoring and management requirements for pass-through entities at 2 CFR §200.332 - Requirements for pass-through entities require that the County: • Evaluate each subrecipient’s fraud risk and risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward [2 CFR § 200.332(c)]. • Verify that subrecipients are audited as required by 2 CFR Part 200, Subpart F - Audit Requirements if the entity expended $750,000 or more during the entity’s fiscal year [2 CFR § 200.332(g)]. As part of the County’s policies and procedures to evaluate subrecipient risk and to determine whether or not the subrecipient is subject to an audit as required by 2 CFR Part 200, Subpart F - Audit Requirements, subrecipients are required to complete the “Subrecipient Monitoring and Risk Assessment Form” which is to be submitted along with the subrecipient’s grant application or prior to the execution of the grant agreement, upon award. Condition: During our testing of the subrecipient monitoring compliance requirement, we discovered three (3) out of 3 samples tested where the County did not complete the Subrecipient Monitoring and Risk Assessment Form. Cause: The County did not follow its policies and procedures over subrecipient monitoring throughout the fiscal year. Effect: Completion of the Subrecipient Monitoring and Risk Assessment Form for subrecipients help ensure proper accountability and compliance with program requirements and achievement of performance goals. Questioned Cost: $ -- Recommendation We recommend the County follow its policies and procedures for its subrecipients to ensure proper monitoring activities are performed as required by 2 CFR §200.332 Views of Responsible Officials and Planned Corrective Action The County agrees with the finding and the recommendation. See Part IV Corrective Action Plan.

SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (Continued) Ref. No. 2024-005 Subrecipient Monitoring - Significant Deficiency Federal agency: Department of Treasury Pass-Through Entity: State of Hawaii Program: ALN No. 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Repeat Finding? Yes; 2023-005 Criteria: Subrecipient monitoring and management requirements for pass-through entities at 2 CFR §200.332 - Requirements for pass-through entities require that the County: • Evaluate each subrecipient’s fraud risk and risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward [2 CFR § 200.332(c)]. • Verify that subrecipients are audited as required by 2 CFR Part 200, Subpart F - Audit Requirements if the entity expended $750,000 or more during the entity’s fiscal year [2 CFR § 200.332(g)]. As part of the County’s policies and procedures to evaluate subrecipient risk and to determine whether or not the subrecipient is subject to an audit as required by 2 CFR Part 200, Subpart F - Audit Requirements, subrecipients are required to complete the “Subrecipient Monitoring and Risk Assessment Form” which is to be submitted along with the subrecipient’s grant application or prior to the execution of the grant agreement, upon award. Condition: During our testing of the subrecipient monitoring compliance requirement, we discovered three (3) out of 3 samples tested where the County did not complete the Subrecipient Monitoring and Risk Assessment Form. Cause: The County did not follow its policies and procedures over subrecipient monitoring throughout the fiscal year. Effect: Completion of the Subrecipient Monitoring and Risk Assessment Form for subrecipients help ensure proper accountability and compliance with program requirements and achievement of performance goals. Questioned Cost: $ -- Recommendation We recommend the County follow its policies and procedures for its subrecipients to ensure proper monitoring activities are performed as required by 2 CFR §200.332 Views of Responsible Officials and Planned Corrective Action The County agrees with the finding and the recommendation. See Part IV Corrective Action Plan.

SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (Continued) Ref. No. 2024-005 Subrecipient Monitoring - Significant Deficiency Federal agency: Department of Treasury Pass-Through Entity: State of Hawaii Program: ALN No. 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Repeat Finding? Yes; 2023-005 Criteria: Subrecipient monitoring and management requirements for pass-through entities at 2 CFR §200.332 - Requirements for pass-through entities require that the County: • Evaluate each subrecipient’s fraud risk and risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward [2 CFR § 200.332(c)]. • Verify that subrecipients are audited as required by 2 CFR Part 200, Subpart F - Audit Requirements if the entity expended $750,000 or more during the entity’s fiscal year [2 CFR § 200.332(g)]. As part of the County’s policies and procedures to evaluate subrecipient risk and to determine whether or not the subrecipient is subject to an audit as required by 2 CFR Part 200, Subpart F - Audit Requirements, subrecipients are required to complete the “Subrecipient Monitoring and Risk Assessment Form” which is to be submitted along with the subrecipient’s grant application or prior to the execution of the grant agreement, upon award. Condition: During our testing of the subrecipient monitoring compliance requirement, we discovered three (3) out of 3 samples tested where the County did not complete the Subrecipient Monitoring and Risk Assessment Form. Cause: The County did not follow its policies and procedures over subrecipient monitoring throughout the fiscal year. Effect: Completion of the Subrecipient Monitoring and Risk Assessment Form for subrecipients help ensure proper accountability and compliance with program requirements and achievement of performance goals. Questioned Cost: $ -- Recommendation We recommend the County follow its policies and procedures for its subrecipients to ensure proper monitoring activities are performed as required by 2 CFR §200.332 Views of Responsible Officials and Planned Corrective Action The County agrees with the finding and the recommendation. See Part IV Corrective Action Plan.

SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (Continued) Ref. No. 2024-005 Subrecipient Monitoring - Significant Deficiency Federal agency: Department of Treasury Pass-Through Entity: State of Hawaii Program: ALN No. 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Repeat Finding? Yes; 2023-005 Criteria: Subrecipient monitoring and management requirements for pass-through entities at 2 CFR §200.332 - Requirements for pass-through entities require that the County: • Evaluate each subrecipient’s fraud risk and risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward [2 CFR § 200.332(c)]. • Verify that subrecipients are audited as required by 2 CFR Part 200, Subpart F - Audit Requirements if the entity expended $750,000 or more during the entity’s fiscal year [2 CFR § 200.332(g)]. As part of the County’s policies and procedures to evaluate subrecipient risk and to determine whether or not the subrecipient is subject to an audit as required by 2 CFR Part 200, Subpart F - Audit Requirements, subrecipients are required to complete the “Subrecipient Monitoring and Risk Assessment Form” which is to be submitted along with the subrecipient’s grant application or prior to the execution of the grant agreement, upon award. Condition: During our testing of the subrecipient monitoring compliance requirement, we discovered three (3) out of 3 samples tested where the County did not complete the Subrecipient Monitoring and Risk Assessment Form. Cause: The County did not follow its policies and procedures over subrecipient monitoring throughout the fiscal year. Effect: Completion of the Subrecipient Monitoring and Risk Assessment Form for subrecipients help ensure proper accountability and compliance with program requirements and achievement of performance goals. Questioned Cost: $ -- Recommendation We recommend the County follow its policies and procedures for its subrecipients to ensure proper monitoring activities are performed as required by 2 CFR §200.332 Views of Responsible Officials and Planned Corrective Action The County agrees with the finding and the recommendation. See Part IV Corrective Action Plan.

SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (Continued) Ref. No. 2024-005 Subrecipient Monitoring - Significant Deficiency Federal agency: Department of Treasury Pass-Through Entity: State of Hawaii Program: ALN No. 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Repeat Finding? Yes; 2023-005 Criteria: Subrecipient monitoring and management requirements for pass-through entities at 2 CFR §200.332 - Requirements for pass-through entities require that the County: • Evaluate each subrecipient’s fraud risk and risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward [2 CFR § 200.332(c)]. • Verify that subrecipients are audited as required by 2 CFR Part 200, Subpart F - Audit Requirements if the entity expended $750,000 or more during the entity’s fiscal year [2 CFR § 200.332(g)]. As part of the County’s policies and procedures to evaluate subrecipient risk and to determine whether or not the subrecipient is subject to an audit as required by 2 CFR Part 200, Subpart F - Audit Requirements, subrecipients are required to complete the “Subrecipient Monitoring and Risk Assessment Form” which is to be submitted along with the subrecipient’s grant application or prior to the execution of the grant agreement, upon award. Condition: During our testing of the subrecipient monitoring compliance requirement, we discovered three (3) out of 3 samples tested where the County did not complete the Subrecipient Monitoring and Risk Assessment Form. Cause: The County did not follow its policies and procedures over subrecipient monitoring throughout the fiscal year. Effect: Completion of the Subrecipient Monitoring and Risk Assessment Form for subrecipients help ensure proper accountability and compliance with program requirements and achievement of performance goals. Questioned Cost: $ -- Recommendation We recommend the County follow its policies and procedures for its subrecipients to ensure proper monitoring activities are performed as required by 2 CFR §200.332 Views of Responsible Officials and Planned Corrective Action The County agrees with the finding and the recommendation. See Part IV Corrective Action Plan.

SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (Continued) Ref. No. 2024-005 Subrecipient Monitoring - Significant Deficiency Federal agency: Department of Treasury Pass-Through Entity: State of Hawaii Program: ALN No. 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Repeat Finding? Yes; 2023-005 Criteria: Subrecipient monitoring and management requirements for pass-through entities at 2 CFR §200.332 - Requirements for pass-through entities require that the County: • Evaluate each subrecipient’s fraud risk and risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward [2 CFR § 200.332(c)]. • Verify that subrecipients are audited as required by 2 CFR Part 200, Subpart F - Audit Requirements if the entity expended $750,000 or more during the entity’s fiscal year [2 CFR § 200.332(g)]. As part of the County’s policies and procedures to evaluate subrecipient risk and to determine whether or not the subrecipient is subject to an audit as required by 2 CFR Part 200, Subpart F - Audit Requirements, subrecipients are required to complete the “Subrecipient Monitoring and Risk Assessment Form” which is to be submitted along with the subrecipient’s grant application or prior to the execution of the grant agreement, upon award. Condition: During our testing of the subrecipient monitoring compliance requirement, we discovered three (3) out of 3 samples tested where the County did not complete the Subrecipient Monitoring and Risk Assessment Form. Cause: The County did not follow its policies and procedures over subrecipient monitoring throughout the fiscal year. Effect: Completion of the Subrecipient Monitoring and Risk Assessment Form for subrecipients help ensure proper accountability and compliance with program requirements and achievement of performance goals. Questioned Cost: $ -- Recommendation We recommend the County follow its policies and procedures for its subrecipients to ensure proper monitoring activities are performed as required by 2 CFR §200.332 Views of Responsible Officials and Planned Corrective Action The County agrees with the finding and the recommendation. See Part IV Corrective Action Plan.

SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (Continued) Ref. No. 2024-005 Subrecipient Monitoring - Significant Deficiency Federal agency: Department of Treasury Pass-Through Entity: State of Hawaii Program: ALN No. 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Repeat Finding? Yes; 2023-005 Criteria: Subrecipient monitoring and management requirements for pass-through entities at 2 CFR §200.332 - Requirements for pass-through entities require that the County: • Evaluate each subrecipient’s fraud risk and risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward [2 CFR § 200.332(c)]. • Verify that subrecipients are audited as required by 2 CFR Part 200, Subpart F - Audit Requirements if the entity expended $750,000 or more during the entity’s fiscal year [2 CFR § 200.332(g)]. As part of the County’s policies and procedures to evaluate subrecipient risk and to determine whether or not the subrecipient is subject to an audit as required by 2 CFR Part 200, Subpart F - Audit Requirements, subrecipients are required to complete the “Subrecipient Monitoring and Risk Assessment Form” which is to be submitted along with the subrecipient’s grant application or prior to the execution of the grant agreement, upon award. Condition: During our testing of the subrecipient monitoring compliance requirement, we discovered three (3) out of 3 samples tested where the County did not complete the Subrecipient Monitoring and Risk Assessment Form. Cause: The County did not follow its policies and procedures over subrecipient monitoring throughout the fiscal year. Effect: Completion of the Subrecipient Monitoring and Risk Assessment Form for subrecipients help ensure proper accountability and compliance with program requirements and achievement of performance goals. Questioned Cost: $ -- Recommendation We recommend the County follow its policies and procedures for its subrecipients to ensure proper monitoring activities are performed as required by 2 CFR §200.332 Views of Responsible Officials and Planned Corrective Action The County agrees with the finding and the recommendation. See Part IV Corrective Action Plan.

SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (Continued) Ref. No. 2024-005 Subrecipient Monitoring - Significant Deficiency Federal agency: Department of Treasury Pass-Through Entity: State of Hawaii Program: ALN No. 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Repeat Finding? Yes; 2023-005 Criteria: Subrecipient monitoring and management requirements for pass-through entities at 2 CFR §200.332 - Requirements for pass-through entities require that the County: • Evaluate each subrecipient’s fraud risk and risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward [2 CFR § 200.332(c)]. • Verify that subrecipients are audited as required by 2 CFR Part 200, Subpart F - Audit Requirements if the entity expended $750,000 or more during the entity’s fiscal year [2 CFR § 200.332(g)]. As part of the County’s policies and procedures to evaluate subrecipient risk and to determine whether or not the subrecipient is subject to an audit as required by 2 CFR Part 200, Subpart F - Audit Requirements, subrecipients are required to complete the “Subrecipient Monitoring and Risk Assessment Form” which is to be submitted along with the subrecipient’s grant application or prior to the execution of the grant agreement, upon award. Condition: During our testing of the subrecipient monitoring compliance requirement, we discovered three (3) out of 3 samples tested where the County did not complete the Subrecipient Monitoring and Risk Assessment Form. Cause: The County did not follow its policies and procedures over subrecipient monitoring throughout the fiscal year. Effect: Completion of the Subrecipient Monitoring and Risk Assessment Form for subrecipients help ensure proper accountability and compliance with program requirements and achievement of performance goals. Questioned Cost: $ -- Recommendation We recommend the County follow its policies and procedures for its subrecipients to ensure proper monitoring activities are performed as required by 2 CFR §200.332 Views of Responsible Officials and Planned Corrective Action The County agrees with the finding and the recommendation. See Part IV Corrective Action Plan.

SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (Continued) Ref. No. 2024-005 Subrecipient Monitoring - Significant Deficiency Federal agency: Department of Treasury Pass-Through Entity: State of Hawaii Program: ALN No. 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Repeat Finding? Yes; 2023-005 Criteria: Subrecipient monitoring and management requirements for pass-through entities at 2 CFR §200.332 - Requirements for pass-through entities require that the County: • Evaluate each subrecipient’s fraud risk and risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward [2 CFR § 200.332(c)]. • Verify that subrecipients are audited as required by 2 CFR Part 200, Subpart F - Audit Requirements if the entity expended $750,000 or more during the entity’s fiscal year [2 CFR § 200.332(g)]. As part of the County’s policies and procedures to evaluate subrecipient risk and to determine whether or not the subrecipient is subject to an audit as required by 2 CFR Part 200, Subpart F - Audit Requirements, subrecipients are required to complete the “Subrecipient Monitoring and Risk Assessment Form” which is to be submitted along with the subrecipient’s grant application or prior to the execution of the grant agreement, upon award. Condition: During our testing of the subrecipient monitoring compliance requirement, we discovered three (3) out of 3 samples tested where the County did not complete the Subrecipient Monitoring and Risk Assessment Form. Cause: The County did not follow its policies and procedures over subrecipient monitoring throughout the fiscal year. Effect: Completion of the Subrecipient Monitoring and Risk Assessment Form for subrecipients help ensure proper accountability and compliance with program requirements and achievement of performance goals. Questioned Cost: $ -- Recommendation We recommend the County follow its policies and procedures for its subrecipients to ensure proper monitoring activities are performed as required by 2 CFR §200.332 Views of Responsible Officials and Planned Corrective Action The County agrees with the finding and the recommendation. See Part IV Corrective Action Plan.

SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (Continued) Ref. No. 2024-005 Subrecipient Monitoring - Significant Deficiency Federal agency: Department of Treasury Pass-Through Entity: State of Hawaii Program: ALN No. 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Repeat Finding? Yes; 2023-005 Criteria: Subrecipient monitoring and management requirements for pass-through entities at 2 CFR §200.332 - Requirements for pass-through entities require that the County: • Evaluate each subrecipient’s fraud risk and risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward [2 CFR § 200.332(c)]. • Verify that subrecipients are audited as required by 2 CFR Part 200, Subpart F - Audit Requirements if the entity expended $750,000 or more during the entity’s fiscal year [2 CFR § 200.332(g)]. As part of the County’s policies and procedures to evaluate subrecipient risk and to determine whether or not the subrecipient is subject to an audit as required by 2 CFR Part 200, Subpart F - Audit Requirements, subrecipients are required to complete the “Subrecipient Monitoring and Risk Assessment Form” which is to be submitted along with the subrecipient’s grant application or prior to the execution of the grant agreement, upon award. Condition: During our testing of the subrecipient monitoring compliance requirement, we discovered three (3) out of 3 samples tested where the County did not complete the Subrecipient Monitoring and Risk Assessment Form. Cause: The County did not follow its policies and procedures over subrecipient monitoring throughout the fiscal year. Effect: Completion of the Subrecipient Monitoring and Risk Assessment Form for subrecipients help ensure proper accountability and compliance with program requirements and achievement of performance goals. Questioned Cost: $ -- Recommendation We recommend the County follow its policies and procedures for its subrecipients to ensure proper monitoring activities are performed as required by 2 CFR §200.332 Views of Responsible Officials and Planned Corrective Action The County agrees with the finding and the recommendation. See Part IV Corrective Action Plan.

SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (Continued) Ref. No. 2024-005 Subrecipient Monitoring - Significant Deficiency Federal agency: Department of Treasury Pass-Through Entity: State of Hawaii Program: ALN No. 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Repeat Finding? Yes; 2023-005 Criteria: Subrecipient monitoring and management requirements for pass-through entities at 2 CFR §200.332 - Requirements for pass-through entities require that the County: • Evaluate each subrecipient’s fraud risk and risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward [2 CFR § 200.332(c)]. • Verify that subrecipients are audited as required by 2 CFR Part 200, Subpart F - Audit Requirements if the entity expended $750,000 or more during the entity’s fiscal year [2 CFR § 200.332(g)]. As part of the County’s policies and procedures to evaluate subrecipient risk and to determine whether or not the subrecipient is subject to an audit as required by 2 CFR Part 200, Subpart F - Audit Requirements, subrecipients are required to complete the “Subrecipient Monitoring and Risk Assessment Form” which is to be submitted along with the subrecipient’s grant application or prior to the execution of the grant agreement, upon award. Condition: During our testing of the subrecipient monitoring compliance requirement, we discovered three (3) out of 3 samples tested where the County did not complete the Subrecipient Monitoring and Risk Assessment Form. Cause: The County did not follow its policies and procedures over subrecipient monitoring throughout the fiscal year. Effect: Completion of the Subrecipient Monitoring and Risk Assessment Form for subrecipients help ensure proper accountability and compliance with program requirements and achievement of performance goals. Questioned Cost: $ -- Recommendation We recommend the County follow its policies and procedures for its subrecipients to ensure proper monitoring activities are performed as required by 2 CFR §200.332 Views of Responsible Officials and Planned Corrective Action The County agrees with the finding and the recommendation. See Part IV Corrective Action Plan.

SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (Continued) Ref. No. 2024-005 Subrecipient Monitoring - Significant Deficiency Federal agency: Department of Treasury Pass-Through Entity: State of Hawaii Program: ALN No. 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Repeat Finding? Yes; 2023-005 Criteria: Subrecipient monitoring and management requirements for pass-through entities at 2 CFR §200.332 - Requirements for pass-through entities require that the County: • Evaluate each subrecipient’s fraud risk and risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward [2 CFR § 200.332(c)]. • Verify that subrecipients are audited as required by 2 CFR Part 200, Subpart F - Audit Requirements if the entity expended $750,000 or more during the entity’s fiscal year [2 CFR § 200.332(g)]. As part of the County’s policies and procedures to evaluate subrecipient risk and to determine whether or not the subrecipient is subject to an audit as required by 2 CFR Part 200, Subpart F - Audit Requirements, subrecipients are required to complete the “Subrecipient Monitoring and Risk Assessment Form” which is to be submitted along with the subrecipient’s grant application or prior to the execution of the grant agreement, upon award. Condition: During our testing of the subrecipient monitoring compliance requirement, we discovered three (3) out of 3 samples tested where the County did not complete the Subrecipient Monitoring and Risk Assessment Form. Cause: The County did not follow its policies and procedures over subrecipient monitoring throughout the fiscal year. Effect: Completion of the Subrecipient Monitoring and Risk Assessment Form for subrecipients help ensure proper accountability and compliance with program requirements and achievement of performance goals. Questioned Cost: $ -- Recommendation We recommend the County follow its policies and procedures for its subrecipients to ensure proper monitoring activities are performed as required by 2 CFR §200.332 Views of Responsible Officials and Planned Corrective Action The County agrees with the finding and the recommendation. See Part IV Corrective Action Plan.

SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (Continued) Ref. No. 2024-005 Subrecipient Monitoring - Significant Deficiency Federal agency: Department of Treasury Pass-Through Entity: State of Hawaii Program: ALN No. 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Repeat Finding? Yes; 2023-005 Criteria: Subrecipient monitoring and management requirements for pass-through entities at 2 CFR §200.332 - Requirements for pass-through entities require that the County: • Evaluate each subrecipient’s fraud risk and risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward [2 CFR § 200.332(c)]. • Verify that subrecipients are audited as required by 2 CFR Part 200, Subpart F - Audit Requirements if the entity expended $750,000 or more during the entity’s fiscal year [2 CFR § 200.332(g)]. As part of the County’s policies and procedures to evaluate subrecipient risk and to determine whether or not the subrecipient is subject to an audit as required by 2 CFR Part 200, Subpart F - Audit Requirements, subrecipients are required to complete the “Subrecipient Monitoring and Risk Assessment Form” which is to be submitted along with the subrecipient’s grant application or prior to the execution of the grant agreement, upon award. Condition: During our testing of the subrecipient monitoring compliance requirement, we discovered three (3) out of 3 samples tested where the County did not complete the Subrecipient Monitoring and Risk Assessment Form. Cause: The County did not follow its policies and procedures over subrecipient monitoring throughout the fiscal year. Effect: Completion of the Subrecipient Monitoring and Risk Assessment Form for subrecipients help ensure proper accountability and compliance with program requirements and achievement of performance goals. Questioned Cost: $ -- Recommendation We recommend the County follow its policies and procedures for its subrecipients to ensure proper monitoring activities are performed as required by 2 CFR §200.332 Views of Responsible Officials and Planned Corrective Action The County agrees with the finding and the recommendation. See Part IV Corrective Action Plan.

SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (Continued) Ref. No. 2024-005 Subrecipient Monitoring - Significant Deficiency Federal agency: Department of Treasury Pass-Through Entity: State of Hawaii Program: ALN No. 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Repeat Finding? Yes; 2023-005 Criteria: Subrecipient monitoring and management requirements for pass-through entities at 2 CFR §200.332 - Requirements for pass-through entities require that the County: • Evaluate each subrecipient’s fraud risk and risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward [2 CFR § 200.332(c)]. • Verify that subrecipients are audited as required by 2 CFR Part 200, Subpart F - Audit Requirements if the entity expended $750,000 or more during the entity’s fiscal year [2 CFR § 200.332(g)]. As part of the County’s policies and procedures to evaluate subrecipient risk and to determine whether or not the subrecipient is subject to an audit as required by 2 CFR Part 200, Subpart F - Audit Requirements, subrecipients are required to complete the “Subrecipient Monitoring and Risk Assessment Form” which is to be submitted along with the subrecipient’s grant application or prior to the execution of the grant agreement, upon award. Condition: During our testing of the subrecipient monitoring compliance requirement, we discovered three (3) out of 3 samples tested where the County did not complete the Subrecipient Monitoring and Risk Assessment Form. Cause: The County did not follow its policies and procedures over subrecipient monitoring throughout the fiscal year. Effect: Completion of the Subrecipient Monitoring and Risk Assessment Form for subrecipients help ensure proper accountability and compliance with program requirements and achievement of performance goals. Questioned Cost: $ -- Recommendation We recommend the County follow its policies and procedures for its subrecipients to ensure proper monitoring activities are performed as required by 2 CFR §200.332 Views of Responsible Officials and Planned Corrective Action The County agrees with the finding and the recommendation. See Part IV Corrective Action Plan.