Audit 350283

2024-004 CASH MANAGEMENT Federal agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants – Public Assistance (Presidentially Declared Disasters) - 97.036 Hazard Mitigation Grant Program – 97.039 Emergency Management Performance Grants – 97.042 Homeland Security Grant Program – 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Non-compliance Compliance Areas: Cash Management Questioned Costs: None Condition Management has been unable to provide sufficient appropriate audit evidence relating to the completeness, existence, accuracy, and valuation of the Department’s federal revenue, accounts receivable/payable and related deferred inflows of resources reported as of June 30, 2024. This was included in our basis for qualifying opinion on Governmental Activities and the Federal Grants Fund. The Department lacked effective processes and controls for determining the amount Due From Federal Government as part of its year-end close process. The Department did not consistently apply its process for recording the Due From amount for all federal grants throughout the year. The Federal Grants Fund (Fund 40280) has a deficit fund balance of $24,515,842 and a $31,837,546 balance related to deferred inflows for FEMA grant funds that were not received within the 90-day period of availability after fiscal year-end. Subsequent drawdowns/collections on the June 30, 2024 amount Due From Federal Government of $37,384,520 were poor, with the Department drawing down or receiving $10,160,346 from July 1, 2024 through November 22, 2024. The accounts receivable summary by grant as of June 30, 2024 contained abnormal credit balances in the amount of $328,175, which the Department will need to research to determine if there are any overdrawn amounts. Management’s Progress for Repeated Finding: Management did make progress implementing adequate controls to resolve the finding from the prior years, by billing and receiving amounts from previous fiscal years. However, a material weakness still exists over controls over these account balances. Criteria According to §200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Department, federal reimbursement requests are completed quarterly with the reporting process. According to NMSA 1978 §6.-5-2, the Financial Control Division (the division) shall issue a manual of model accounting practices containing the procedures and policies. State agencies shall comply with the model accounting practices established by the division, and the administrative head of each state agency shall ensure that the model accounting practices are followed. According to FIN 16 General Accounting Practices in the Manual of Model Accounting Practices, all reporting of financial information must be timely, complete, and accurate, to the state agency’s management and to oversight agencies and entities. Effect State agency’s management and other agencies and entities may not be able to rely on the financial information presented by the Department due to untimely, incomplete, and inaccurate financial reporting. The Federal Government may place the Department on controlled draws. Cause While the Department has made improvements from prior year related to the reconciliation and draw down of all federal receivables, the Department continues to lack an effective control environment that allows for timely and accurate drawdowns, financial reporting, and accounting of the Department’s Federal accounts receivable/payable balance and related deferred inflows of resources.

2024-004 CASH MANAGEMENT Federal agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants – Public Assistance (Presidentially Declared Disasters) - 97.036 Hazard Mitigation Grant Program – 97.039 Emergency Management Performance Grants – 97.042 Homeland Security Grant Program – 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Non-compliance Compliance Areas: Cash Management Questioned Costs: None Condition Management has been unable to provide sufficient appropriate audit evidence relating to the completeness, existence, accuracy, and valuation of the Department’s federal revenue, accounts receivable/payable and related deferred inflows of resources reported as of June 30, 2024. This was included in our basis for qualifying opinion on Governmental Activities and the Federal Grants Fund. The Department lacked effective processes and controls for determining the amount Due From Federal Government as part of its year-end close process. The Department did not consistently apply its process for recording the Due From amount for all federal grants throughout the year. The Federal Grants Fund (Fund 40280) has a deficit fund balance of $24,515,842 and a $31,837,546 balance related to deferred inflows for FEMA grant funds that were not received within the 90-day period of availability after fiscal year-end. Subsequent drawdowns/collections on the June 30, 2024 amount Due From Federal Government of $37,384,520 were poor, with the Department drawing down or receiving $10,160,346 from July 1, 2024 through November 22, 2024. The accounts receivable summary by grant as of June 30, 2024 contained abnormal credit balances in the amount of $328,175, which the Department will need to research to determine if there are any overdrawn amounts. Management’s Progress for Repeated Finding: Management did make progress implementing adequate controls to resolve the finding from the prior years, by billing and receiving amounts from previous fiscal years. However, a material weakness still exists over controls over these account balances. Criteria According to §200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Department, federal reimbursement requests are completed quarterly with the reporting process. According to NMSA 1978 §6.-5-2, the Financial Control Division (the division) shall issue a manual of model accounting practices containing the procedures and policies. State agencies shall comply with the model accounting practices established by the division, and the administrative head of each state agency shall ensure that the model accounting practices are followed. According to FIN 16 General Accounting Practices in the Manual of Model Accounting Practices, all reporting of financial information must be timely, complete, and accurate, to the state agency’s management and to oversight agencies and entities. Effect State agency’s management and other agencies and entities may not be able to rely on the financial information presented by the Department due to untimely, incomplete, and inaccurate financial reporting. The Federal Government may place the Department on controlled draws. Cause While the Department has made improvements from prior year related to the reconciliation and draw down of all federal receivables, the Department continues to lack an effective control environment that allows for timely and accurate drawdowns, financial reporting, and accounting of the Department’s Federal accounts receivable/payable balance and related deferred inflows of resources.

2024-004 CASH MANAGEMENT Federal agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants – Public Assistance (Presidentially Declared Disasters) - 97.036 Hazard Mitigation Grant Program – 97.039 Emergency Management Performance Grants – 97.042 Homeland Security Grant Program – 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Non-compliance Compliance Areas: Cash Management Questioned Costs: None Condition Management has been unable to provide sufficient appropriate audit evidence relating to the completeness, existence, accuracy, and valuation of the Department’s federal revenue, accounts receivable/payable and related deferred inflows of resources reported as of June 30, 2024. This was included in our basis for qualifying opinion on Governmental Activities and the Federal Grants Fund. The Department lacked effective processes and controls for determining the amount Due From Federal Government as part of its year-end close process. The Department did not consistently apply its process for recording the Due From amount for all federal grants throughout the year. The Federal Grants Fund (Fund 40280) has a deficit fund balance of $24,515,842 and a $31,837,546 balance related to deferred inflows for FEMA grant funds that were not received within the 90-day period of availability after fiscal year-end. Subsequent drawdowns/collections on the June 30, 2024 amount Due From Federal Government of $37,384,520 were poor, with the Department drawing down or receiving $10,160,346 from July 1, 2024 through November 22, 2024. The accounts receivable summary by grant as of June 30, 2024 contained abnormal credit balances in the amount of $328,175, which the Department will need to research to determine if there are any overdrawn amounts. Management’s Progress for Repeated Finding: Management did make progress implementing adequate controls to resolve the finding from the prior years, by billing and receiving amounts from previous fiscal years. However, a material weakness still exists over controls over these account balances. Criteria According to §200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Department, federal reimbursement requests are completed quarterly with the reporting process. According to NMSA 1978 §6.-5-2, the Financial Control Division (the division) shall issue a manual of model accounting practices containing the procedures and policies. State agencies shall comply with the model accounting practices established by the division, and the administrative head of each state agency shall ensure that the model accounting practices are followed. According to FIN 16 General Accounting Practices in the Manual of Model Accounting Practices, all reporting of financial information must be timely, complete, and accurate, to the state agency’s management and to oversight agencies and entities. Effect State agency’s management and other agencies and entities may not be able to rely on the financial information presented by the Department due to untimely, incomplete, and inaccurate financial reporting. The Federal Government may place the Department on controlled draws. Cause While the Department has made improvements from prior year related to the reconciliation and draw down of all federal receivables, the Department continues to lack an effective control environment that allows for timely and accurate drawdowns, financial reporting, and accounting of the Department’s Federal accounts receivable/payable balance and related deferred inflows of resources.

2024-004 CASH MANAGEMENT Federal agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants – Public Assistance (Presidentially Declared Disasters) - 97.036 Hazard Mitigation Grant Program – 97.039 Emergency Management Performance Grants – 97.042 Homeland Security Grant Program – 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Non-compliance Compliance Areas: Cash Management Questioned Costs: None Condition Management has been unable to provide sufficient appropriate audit evidence relating to the completeness, existence, accuracy, and valuation of the Department’s federal revenue, accounts receivable/payable and related deferred inflows of resources reported as of June 30, 2024. This was included in our basis for qualifying opinion on Governmental Activities and the Federal Grants Fund. The Department lacked effective processes and controls for determining the amount Due From Federal Government as part of its year-end close process. The Department did not consistently apply its process for recording the Due From amount for all federal grants throughout the year. The Federal Grants Fund (Fund 40280) has a deficit fund balance of $24,515,842 and a $31,837,546 balance related to deferred inflows for FEMA grant funds that were not received within the 90-day period of availability after fiscal year-end. Subsequent drawdowns/collections on the June 30, 2024 amount Due From Federal Government of $37,384,520 were poor, with the Department drawing down or receiving $10,160,346 from July 1, 2024 through November 22, 2024. The accounts receivable summary by grant as of June 30, 2024 contained abnormal credit balances in the amount of $328,175, which the Department will need to research to determine if there are any overdrawn amounts. Management’s Progress for Repeated Finding: Management did make progress implementing adequate controls to resolve the finding from the prior years, by billing and receiving amounts from previous fiscal years. However, a material weakness still exists over controls over these account balances. Criteria According to §200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Department, federal reimbursement requests are completed quarterly with the reporting process. According to NMSA 1978 §6.-5-2, the Financial Control Division (the division) shall issue a manual of model accounting practices containing the procedures and policies. State agencies shall comply with the model accounting practices established by the division, and the administrative head of each state agency shall ensure that the model accounting practices are followed. According to FIN 16 General Accounting Practices in the Manual of Model Accounting Practices, all reporting of financial information must be timely, complete, and accurate, to the state agency’s management and to oversight agencies and entities. Effect State agency’s management and other agencies and entities may not be able to rely on the financial information presented by the Department due to untimely, incomplete, and inaccurate financial reporting. The Federal Government may place the Department on controlled draws. Cause While the Department has made improvements from prior year related to the reconciliation and draw down of all federal receivables, the Department continues to lack an effective control environment that allows for timely and accurate drawdowns, financial reporting, and accounting of the Department’s Federal accounts receivable/payable balance and related deferred inflows of resources.

2024-005 SUBRECIPIENT MONITORING Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants – Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants – 97.042 Homeland Security Grant Program – 97.067 Award Period: Various Type of Finding:Significant Deficiency in Internal Control over Compliance Other Non-compliance Condition: During our testing, we noted the Department did not have adequate internal controls in place to ensure compliance with subrecipient monitoring. . ALN 97.036, ALN 97.042, ALN 97.067 The Department lacked an effective process to timely provide documentation to the auditors which would evidence compliance with the Subrecipient Monitoring compliance requirement. This makes it difficult for management to monitor for compliance or for a third party to test compliance. All requested documentation was ultimate provided. ALN 97.036 o We reviewed files for 5 subrecipients, from which there were 16 ongoing projects during fiscal year 2024. Of these, 1 of 5 subrecipients did not have evidence that a risk assessment was performed. 2 of 5 subrecipients did not have adequate documentation of monitoring activities performed, including the Department's monitoring checklist. Management's Progress for Repeated Finding: Management made some progress in the performing of risk assessments and reviews of audits for non-disaster grants, but still has opportunity to improve controls in the areas described above. Criteria: According to §200.332 Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. In addition, the pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass- through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 Management Decision. Department Policy No. GRA 418 Sub-Grant Recipient Monitoring effective June 30, 2017 establishes and implements policy and procedures for the Department staff engaged in the Department's sub- grant recipient monitoring process. For Mitigation Sub-Grant Monitoring, the Mitigation Specialist shall review the local progress quarterly reports due to the Department. For Non-Disaster Sub-Grant Recipient Monitoring, the Program Manager shall review the local progress quarterly reports due to the Department. Specific to Pre-Monitoring Requirements and Considerations, Department Program Staff shall perform risk-based assessments and apply the assessment to all of the Department's approved sub-recipients for monitoring purposes and risk designation.

2024-005 SUBRECIPIENT MONITORING Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants – Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants – 97.042 Homeland Security Grant Program – 97.067 Award Period: Various Type of Finding:Significant Deficiency in Internal Control over Compliance Other Non-compliance Condition: During our testing, we noted the Department did not have adequate internal controls in place to ensure compliance with subrecipient monitoring. . ALN 97.036, ALN 97.042, ALN 97.067 The Department lacked an effective process to timely provide documentation to the auditors which would evidence compliance with the Subrecipient Monitoring compliance requirement. This makes it difficult for management to monitor for compliance or for a third party to test compliance. All requested documentation was ultimate provided. ALN 97.036 o We reviewed files for 5 subrecipients, from which there were 16 ongoing projects during fiscal year 2024. Of these, 1 of 5 subrecipients did not have evidence that a risk assessment was performed. 2 of 5 subrecipients did not have adequate documentation of monitoring activities performed, including the Department's monitoring checklist. Management's Progress for Repeated Finding: Management made some progress in the performing of risk assessments and reviews of audits for non-disaster grants, but still has opportunity to improve controls in the areas described above. Criteria: According to §200.332 Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. In addition, the pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass- through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 Management Decision. Department Policy No. GRA 418 Sub-Grant Recipient Monitoring effective June 30, 2017 establishes and implements policy and procedures for the Department staff engaged in the Department's sub- grant recipient monitoring process. For Mitigation Sub-Grant Monitoring, the Mitigation Specialist shall review the local progress quarterly reports due to the Department. For Non-Disaster Sub-Grant Recipient Monitoring, the Program Manager shall review the local progress quarterly reports due to the Department. Specific to Pre-Monitoring Requirements and Considerations, Department Program Staff shall perform risk-based assessments and apply the assessment to all of the Department's approved sub-recipients for monitoring purposes and risk designation.

2024-005 SUBRECIPIENT MONITORING Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants – Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants – 97.042 Homeland Security Grant Program – 97.067 Award Period: Various Type of Finding:Significant Deficiency in Internal Control over Compliance Other Non-compliance Condition: During our testing, we noted the Department did not have adequate internal controls in place to ensure compliance with subrecipient monitoring. . ALN 97.036, ALN 97.042, ALN 97.067 The Department lacked an effective process to timely provide documentation to the auditors which would evidence compliance with the Subrecipient Monitoring compliance requirement. This makes it difficult for management to monitor for compliance or for a third party to test compliance. All requested documentation was ultimate provided. ALN 97.036 o We reviewed files for 5 subrecipients, from which there were 16 ongoing projects during fiscal year 2024. Of these, 1 of 5 subrecipients did not have evidence that a risk assessment was performed. 2 of 5 subrecipients did not have adequate documentation of monitoring activities performed, including the Department's monitoring checklist. Management's Progress for Repeated Finding: Management made some progress in the performing of risk assessments and reviews of audits for non-disaster grants, but still has opportunity to improve controls in the areas described above. Criteria: According to §200.332 Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. In addition, the pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass- through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 Management Decision. Department Policy No. GRA 418 Sub-Grant Recipient Monitoring effective June 30, 2017 establishes and implements policy and procedures for the Department staff engaged in the Department's sub- grant recipient monitoring process. For Mitigation Sub-Grant Monitoring, the Mitigation Specialist shall review the local progress quarterly reports due to the Department. For Non-Disaster Sub-Grant Recipient Monitoring, the Program Manager shall review the local progress quarterly reports due to the Department. Specific to Pre-Monitoring Requirements and Considerations, Department Program Staff shall perform risk-based assessments and apply the assessment to all of the Department's approved sub-recipients for monitoring purposes and risk designation.

2024-006 REPORTING Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants - Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants - 97.042 Award Period: Various Type of Finding: Significant Deficiency in Internal Control over Compliance Other Non-compliance Questioned Costs: Unknown Condition: We noted the Department was not in compliance with requirements related to the reporting of grants. ALN 97.042 The Department did not complete the recipient share section of the federal financial reports for 4 out of 4 reports tested. ALN 97.036 We reviewed files for 5 subrecipients, from which there were 16 ongoing projects during fiscal year 2024. Of these, 4 of the 16 projects did not have evidence of the required reporting for Federal Funding Accountability and Transparency Act (FFATA). Criteria According to §200.302 Financial management of 2 CFR Part 200, the State's, and the other non- Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. According to §200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effect. The auditor noted instances of noncompliance. Non-compliance may result in delayed reimbursement of eligible federal expenditures or the potential loss of federal funding. Cause The Department lacks established internal controls and procedures over financial grant management to ensure submitted reports are complete, agree to supporting spreadsheets, submitted timely, and properlv maintained in the files of the Department.

2024-006 REPORTING Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants - Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants - 97.042 Award Period: Various Type of Finding: Significant Deficiency in Internal Control over Compliance Other Non-compliance Questioned Costs: Unknown Condition: We noted the Department was not in compliance with requirements related to the reporting of grants. ALN 97.042 The Department did not complete the recipient share section of the federal financial reports for 4 out of 4 reports tested. ALN 97.036 We reviewed files for 5 subrecipients, from which there were 16 ongoing projects during fiscal year 2024. Of these, 4 of the 16 projects did not have evidence of the required reporting for Federal Funding Accountability and Transparency Act (FFATA). Criteria According to §200.302 Financial management of 2 CFR Part 200, the State's, and the other non- Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. According to §200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effect. The auditor noted instances of noncompliance. Non-compliance may result in delayed reimbursement of eligible federal expenditures or the potential loss of federal funding. Cause The Department lacks established internal controls and procedures over financial grant management to ensure submitted reports are complete, agree to supporting spreadsheets, submitted timely, and properlv maintained in the files of the Department.

2024-007 SPECIAL TESTS - DISASTER GRANT PROJECTS Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants - Public Assistance (Presidentially Declared Disasters) - 97.036 Award Period: 2023 Type of Finding: Significant Deficiency in Internal Control over Compliance Other Non-compliance Questioned Costs: Unknown Condition We noted the Department was not in compliance with requirements related to accounting to FEMA of eligible costs for large, completed projects: ALN 97.036 We reviewed cost documentation support for 13 completed projects with $11,269,633 in total expenditures, and noted $4,340 in costs that were unsupported. Criteria For large projects, the subrecipient must make an accounting to the recipient. In submitting the accounting, the entity is required to certify that reported costs were incurred in performance of eligible work, that the approved work was completed, that the project was in compliance with the provisions of FEMA-State agreement, all grant conditions were met, and that payments were made in accordance with the applicable payment provisions. Effect The Department was not in compliance with the requirement to account for total costs as allowable. Cause The Department did not have adequate controls in place to monitor this compliance requirement.

2024-004 CASH MANAGEMENT Federal agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants – Public Assistance (Presidentially Declared Disasters) - 97.036 Hazard Mitigation Grant Program – 97.039 Emergency Management Performance Grants – 97.042 Homeland Security Grant Program – 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Non-compliance Compliance Areas: Cash Management Questioned Costs: None Condition Management has been unable to provide sufficient appropriate audit evidence relating to the completeness, existence, accuracy, and valuation of the Department’s federal revenue, accounts receivable/payable and related deferred inflows of resources reported as of June 30, 2024. This was included in our basis for qualifying opinion on Governmental Activities and the Federal Grants Fund. The Department lacked effective processes and controls for determining the amount Due From Federal Government as part of its year-end close process. The Department did not consistently apply its process for recording the Due From amount for all federal grants throughout the year. The Federal Grants Fund (Fund 40280) has a deficit fund balance of $24,515,842 and a $31,837,546 balance related to deferred inflows for FEMA grant funds that were not received within the 90-day period of availability after fiscal year-end. Subsequent drawdowns/collections on the June 30, 2024 amount Due From Federal Government of $37,384,520 were poor, with the Department drawing down or receiving $10,160,346 from July 1, 2024 through November 22, 2024. The accounts receivable summary by grant as of June 30, 2024 contained abnormal credit balances in the amount of $328,175, which the Department will need to research to determine if there are any overdrawn amounts. Management’s Progress for Repeated Finding: Management did make progress implementing adequate controls to resolve the finding from the prior years, by billing and receiving amounts from previous fiscal years. However, a material weakness still exists over controls over these account balances. Criteria According to §200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Department, federal reimbursement requests are completed quarterly with the reporting process. According to NMSA 1978 §6.-5-2, the Financial Control Division (the division) shall issue a manual of model accounting practices containing the procedures and policies. State agencies shall comply with the model accounting practices established by the division, and the administrative head of each state agency shall ensure that the model accounting practices are followed. According to FIN 16 General Accounting Practices in the Manual of Model Accounting Practices, all reporting of financial information must be timely, complete, and accurate, to the state agency’s management and to oversight agencies and entities. Effect State agency’s management and other agencies and entities may not be able to rely on the financial information presented by the Department due to untimely, incomplete, and inaccurate financial reporting. The Federal Government may place the Department on controlled draws. Cause While the Department has made improvements from prior year related to the reconciliation and draw down of all federal receivables, the Department continues to lack an effective control environment that allows for timely and accurate drawdowns, financial reporting, and accounting of the Department’s Federal accounts receivable/payable balance and related deferred inflows of resources.

2024-004 CASH MANAGEMENT Federal agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants – Public Assistance (Presidentially Declared Disasters) - 97.036 Hazard Mitigation Grant Program – 97.039 Emergency Management Performance Grants – 97.042 Homeland Security Grant Program – 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Non-compliance Compliance Areas: Cash Management Questioned Costs: None Condition Management has been unable to provide sufficient appropriate audit evidence relating to the completeness, existence, accuracy, and valuation of the Department’s federal revenue, accounts receivable/payable and related deferred inflows of resources reported as of June 30, 2024. This was included in our basis for qualifying opinion on Governmental Activities and the Federal Grants Fund. The Department lacked effective processes and controls for determining the amount Due From Federal Government as part of its year-end close process. The Department did not consistently apply its process for recording the Due From amount for all federal grants throughout the year. The Federal Grants Fund (Fund 40280) has a deficit fund balance of $24,515,842 and a $31,837,546 balance related to deferred inflows for FEMA grant funds that were not received within the 90-day period of availability after fiscal year-end. Subsequent drawdowns/collections on the June 30, 2024 amount Due From Federal Government of $37,384,520 were poor, with the Department drawing down or receiving $10,160,346 from July 1, 2024 through November 22, 2024. The accounts receivable summary by grant as of June 30, 2024 contained abnormal credit balances in the amount of $328,175, which the Department will need to research to determine if there are any overdrawn amounts. Management’s Progress for Repeated Finding: Management did make progress implementing adequate controls to resolve the finding from the prior years, by billing and receiving amounts from previous fiscal years. However, a material weakness still exists over controls over these account balances. Criteria According to §200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Department, federal reimbursement requests are completed quarterly with the reporting process. According to NMSA 1978 §6.-5-2, the Financial Control Division (the division) shall issue a manual of model accounting practices containing the procedures and policies. State agencies shall comply with the model accounting practices established by the division, and the administrative head of each state agency shall ensure that the model accounting practices are followed. According to FIN 16 General Accounting Practices in the Manual of Model Accounting Practices, all reporting of financial information must be timely, complete, and accurate, to the state agency’s management and to oversight agencies and entities. Effect State agency’s management and other agencies and entities may not be able to rely on the financial information presented by the Department due to untimely, incomplete, and inaccurate financial reporting. The Federal Government may place the Department on controlled draws. Cause While the Department has made improvements from prior year related to the reconciliation and draw down of all federal receivables, the Department continues to lack an effective control environment that allows for timely and accurate drawdowns, financial reporting, and accounting of the Department’s Federal accounts receivable/payable balance and related deferred inflows of resources.

2024-004 CASH MANAGEMENT Federal agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants – Public Assistance (Presidentially Declared Disasters) - 97.036 Hazard Mitigation Grant Program – 97.039 Emergency Management Performance Grants – 97.042 Homeland Security Grant Program – 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Non-compliance Compliance Areas: Cash Management Questioned Costs: None Condition Management has been unable to provide sufficient appropriate audit evidence relating to the completeness, existence, accuracy, and valuation of the Department’s federal revenue, accounts receivable/payable and related deferred inflows of resources reported as of June 30, 2024. This was included in our basis for qualifying opinion on Governmental Activities and the Federal Grants Fund. The Department lacked effective processes and controls for determining the amount Due From Federal Government as part of its year-end close process. The Department did not consistently apply its process for recording the Due From amount for all federal grants throughout the year. The Federal Grants Fund (Fund 40280) has a deficit fund balance of $24,515,842 and a $31,837,546 balance related to deferred inflows for FEMA grant funds that were not received within the 90-day period of availability after fiscal year-end. Subsequent drawdowns/collections on the June 30, 2024 amount Due From Federal Government of $37,384,520 were poor, with the Department drawing down or receiving $10,160,346 from July 1, 2024 through November 22, 2024. The accounts receivable summary by grant as of June 30, 2024 contained abnormal credit balances in the amount of $328,175, which the Department will need to research to determine if there are any overdrawn amounts. Management’s Progress for Repeated Finding: Management did make progress implementing adequate controls to resolve the finding from the prior years, by billing and receiving amounts from previous fiscal years. However, a material weakness still exists over controls over these account balances. Criteria According to §200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Department, federal reimbursement requests are completed quarterly with the reporting process. According to NMSA 1978 §6.-5-2, the Financial Control Division (the division) shall issue a manual of model accounting practices containing the procedures and policies. State agencies shall comply with the model accounting practices established by the division, and the administrative head of each state agency shall ensure that the model accounting practices are followed. According to FIN 16 General Accounting Practices in the Manual of Model Accounting Practices, all reporting of financial information must be timely, complete, and accurate, to the state agency’s management and to oversight agencies and entities. Effect State agency’s management and other agencies and entities may not be able to rely on the financial information presented by the Department due to untimely, incomplete, and inaccurate financial reporting. The Federal Government may place the Department on controlled draws. Cause While the Department has made improvements from prior year related to the reconciliation and draw down of all federal receivables, the Department continues to lack an effective control environment that allows for timely and accurate drawdowns, financial reporting, and accounting of the Department’s Federal accounts receivable/payable balance and related deferred inflows of resources.

2024-004 CASH MANAGEMENT Federal agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants – Public Assistance (Presidentially Declared Disasters) - 97.036 Hazard Mitigation Grant Program – 97.039 Emergency Management Performance Grants – 97.042 Homeland Security Grant Program – 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Non-compliance Compliance Areas: Cash Management Questioned Costs: None Condition Management has been unable to provide sufficient appropriate audit evidence relating to the completeness, existence, accuracy, and valuation of the Department’s federal revenue, accounts receivable/payable and related deferred inflows of resources reported as of June 30, 2024. This was included in our basis for qualifying opinion on Governmental Activities and the Federal Grants Fund. The Department lacked effective processes and controls for determining the amount Due From Federal Government as part of its year-end close process. The Department did not consistently apply its process for recording the Due From amount for all federal grants throughout the year. The Federal Grants Fund (Fund 40280) has a deficit fund balance of $24,515,842 and a $31,837,546 balance related to deferred inflows for FEMA grant funds that were not received within the 90-day period of availability after fiscal year-end. Subsequent drawdowns/collections on the June 30, 2024 amount Due From Federal Government of $37,384,520 were poor, with the Department drawing down or receiving $10,160,346 from July 1, 2024 through November 22, 2024. The accounts receivable summary by grant as of June 30, 2024 contained abnormal credit balances in the amount of $328,175, which the Department will need to research to determine if there are any overdrawn amounts. Management’s Progress for Repeated Finding: Management did make progress implementing adequate controls to resolve the finding from the prior years, by billing and receiving amounts from previous fiscal years. However, a material weakness still exists over controls over these account balances. Criteria According to §200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Department, federal reimbursement requests are completed quarterly with the reporting process. According to NMSA 1978 §6.-5-2, the Financial Control Division (the division) shall issue a manual of model accounting practices containing the procedures and policies. State agencies shall comply with the model accounting practices established by the division, and the administrative head of each state agency shall ensure that the model accounting practices are followed. According to FIN 16 General Accounting Practices in the Manual of Model Accounting Practices, all reporting of financial information must be timely, complete, and accurate, to the state agency’s management and to oversight agencies and entities. Effect State agency’s management and other agencies and entities may not be able to rely on the financial information presented by the Department due to untimely, incomplete, and inaccurate financial reporting. The Federal Government may place the Department on controlled draws. Cause While the Department has made improvements from prior year related to the reconciliation and draw down of all federal receivables, the Department continues to lack an effective control environment that allows for timely and accurate drawdowns, financial reporting, and accounting of the Department’s Federal accounts receivable/payable balance and related deferred inflows of resources.

2024-005 SUBRECIPIENT MONITORING Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants – Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants – 97.042 Homeland Security Grant Program – 97.067 Award Period: Various Type of Finding:Significant Deficiency in Internal Control over Compliance Other Non-compliance Condition: During our testing, we noted the Department did not have adequate internal controls in place to ensure compliance with subrecipient monitoring. . ALN 97.036, ALN 97.042, ALN 97.067 The Department lacked an effective process to timely provide documentation to the auditors which would evidence compliance with the Subrecipient Monitoring compliance requirement. This makes it difficult for management to monitor for compliance or for a third party to test compliance. All requested documentation was ultimate provided. ALN 97.036 o We reviewed files for 5 subrecipients, from which there were 16 ongoing projects during fiscal year 2024. Of these, 1 of 5 subrecipients did not have evidence that a risk assessment was performed. 2 of 5 subrecipients did not have adequate documentation of monitoring activities performed, including the Department's monitoring checklist. Management's Progress for Repeated Finding: Management made some progress in the performing of risk assessments and reviews of audits for non-disaster grants, but still has opportunity to improve controls in the areas described above. Criteria: According to §200.332 Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. In addition, the pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass- through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 Management Decision. Department Policy No. GRA 418 Sub-Grant Recipient Monitoring effective June 30, 2017 establishes and implements policy and procedures for the Department staff engaged in the Department's sub- grant recipient monitoring process. For Mitigation Sub-Grant Monitoring, the Mitigation Specialist shall review the local progress quarterly reports due to the Department. For Non-Disaster Sub-Grant Recipient Monitoring, the Program Manager shall review the local progress quarterly reports due to the Department. Specific to Pre-Monitoring Requirements and Considerations, Department Program Staff shall perform risk-based assessments and apply the assessment to all of the Department's approved sub-recipients for monitoring purposes and risk designation.

2024-005 SUBRECIPIENT MONITORING Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants – Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants – 97.042 Homeland Security Grant Program – 97.067 Award Period: Various Type of Finding:Significant Deficiency in Internal Control over Compliance Other Non-compliance Condition: During our testing, we noted the Department did not have adequate internal controls in place to ensure compliance with subrecipient monitoring. . ALN 97.036, ALN 97.042, ALN 97.067 The Department lacked an effective process to timely provide documentation to the auditors which would evidence compliance with the Subrecipient Monitoring compliance requirement. This makes it difficult for management to monitor for compliance or for a third party to test compliance. All requested documentation was ultimate provided. ALN 97.036 o We reviewed files for 5 subrecipients, from which there were 16 ongoing projects during fiscal year 2024. Of these, 1 of 5 subrecipients did not have evidence that a risk assessment was performed. 2 of 5 subrecipients did not have adequate documentation of monitoring activities performed, including the Department's monitoring checklist. Management's Progress for Repeated Finding: Management made some progress in the performing of risk assessments and reviews of audits for non-disaster grants, but still has opportunity to improve controls in the areas described above. Criteria: According to §200.332 Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. In addition, the pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass- through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 Management Decision. Department Policy No. GRA 418 Sub-Grant Recipient Monitoring effective June 30, 2017 establishes and implements policy and procedures for the Department staff engaged in the Department's sub- grant recipient monitoring process. For Mitigation Sub-Grant Monitoring, the Mitigation Specialist shall review the local progress quarterly reports due to the Department. For Non-Disaster Sub-Grant Recipient Monitoring, the Program Manager shall review the local progress quarterly reports due to the Department. Specific to Pre-Monitoring Requirements and Considerations, Department Program Staff shall perform risk-based assessments and apply the assessment to all of the Department's approved sub-recipients for monitoring purposes and risk designation.

2024-005 SUBRECIPIENT MONITORING Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants – Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants – 97.042 Homeland Security Grant Program – 97.067 Award Period: Various Type of Finding:Significant Deficiency in Internal Control over Compliance Other Non-compliance Condition: During our testing, we noted the Department did not have adequate internal controls in place to ensure compliance with subrecipient monitoring. . ALN 97.036, ALN 97.042, ALN 97.067 The Department lacked an effective process to timely provide documentation to the auditors which would evidence compliance with the Subrecipient Monitoring compliance requirement. This makes it difficult for management to monitor for compliance or for a third party to test compliance. All requested documentation was ultimate provided. ALN 97.036 o We reviewed files for 5 subrecipients, from which there were 16 ongoing projects during fiscal year 2024. Of these, 1 of 5 subrecipients did not have evidence that a risk assessment was performed. 2 of 5 subrecipients did not have adequate documentation of monitoring activities performed, including the Department's monitoring checklist. Management's Progress for Repeated Finding: Management made some progress in the performing of risk assessments and reviews of audits for non-disaster grants, but still has opportunity to improve controls in the areas described above. Criteria: According to §200.332 Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. In addition, the pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass- through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 Management Decision. Department Policy No. GRA 418 Sub-Grant Recipient Monitoring effective June 30, 2017 establishes and implements policy and procedures for the Department staff engaged in the Department's sub- grant recipient monitoring process. For Mitigation Sub-Grant Monitoring, the Mitigation Specialist shall review the local progress quarterly reports due to the Department. For Non-Disaster Sub-Grant Recipient Monitoring, the Program Manager shall review the local progress quarterly reports due to the Department. Specific to Pre-Monitoring Requirements and Considerations, Department Program Staff shall perform risk-based assessments and apply the assessment to all of the Department's approved sub-recipients for monitoring purposes and risk designation.

2024-006 REPORTING Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants - Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants - 97.042 Award Period: Various Type of Finding: Significant Deficiency in Internal Control over Compliance Other Non-compliance Questioned Costs: Unknown Condition: We noted the Department was not in compliance with requirements related to the reporting of grants. ALN 97.042 The Department did not complete the recipient share section of the federal financial reports for 4 out of 4 reports tested. ALN 97.036 We reviewed files for 5 subrecipients, from which there were 16 ongoing projects during fiscal year 2024. Of these, 4 of the 16 projects did not have evidence of the required reporting for Federal Funding Accountability and Transparency Act (FFATA). Criteria According to §200.302 Financial management of 2 CFR Part 200, the State's, and the other non- Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. According to §200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effect. The auditor noted instances of noncompliance. Non-compliance may result in delayed reimbursement of eligible federal expenditures or the potential loss of federal funding. Cause The Department lacks established internal controls and procedures over financial grant management to ensure submitted reports are complete, agree to supporting spreadsheets, submitted timely, and properlv maintained in the files of the Department.

2024-006 REPORTING Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants - Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants - 97.042 Award Period: Various Type of Finding: Significant Deficiency in Internal Control over Compliance Other Non-compliance Questioned Costs: Unknown Condition: We noted the Department was not in compliance with requirements related to the reporting of grants. ALN 97.042 The Department did not complete the recipient share section of the federal financial reports for 4 out of 4 reports tested. ALN 97.036 We reviewed files for 5 subrecipients, from which there were 16 ongoing projects during fiscal year 2024. Of these, 4 of the 16 projects did not have evidence of the required reporting for Federal Funding Accountability and Transparency Act (FFATA). Criteria According to §200.302 Financial management of 2 CFR Part 200, the State's, and the other non- Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. According to §200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effect. The auditor noted instances of noncompliance. Non-compliance may result in delayed reimbursement of eligible federal expenditures or the potential loss of federal funding. Cause The Department lacks established internal controls and procedures over financial grant management to ensure submitted reports are complete, agree to supporting spreadsheets, submitted timely, and properlv maintained in the files of the Department.

2024-007 SPECIAL TESTS - DISASTER GRANT PROJECTS Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants - Public Assistance (Presidentially Declared Disasters) - 97.036 Award Period: 2023 Type of Finding: Significant Deficiency in Internal Control over Compliance Other Non-compliance Questioned Costs: Unknown Condition We noted the Department was not in compliance with requirements related to accounting to FEMA of eligible costs for large, completed projects: ALN 97.036 We reviewed cost documentation support for 13 completed projects with $11,269,633 in total expenditures, and noted $4,340 in costs that were unsupported. Criteria For large projects, the subrecipient must make an accounting to the recipient. In submitting the accounting, the entity is required to certify that reported costs were incurred in performance of eligible work, that the approved work was completed, that the project was in compliance with the provisions of FEMA-State agreement, all grant conditions were met, and that payments were made in accordance with the applicable payment provisions. Effect The Department was not in compliance with the requirement to account for total costs as allowable. Cause The Department did not have adequate controls in place to monitor this compliance requirement.