Audit 358334

Finding 2024-001: Preparation of Schedule of Expenditures of Federal Awards (SEFA) Program Name: Multiple federal programs Criteria 1. The code of federal regulations – 2 CFR 200.302 Financial management requires that: (a) Each State must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State’s funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. (b) The recipient’s and subrecipient’s financial management system must provide for the following: (1) Identification of all Federal awards received and expended and the Federal programs under which they were received. Federal program and Federal award identification must include, as applicable, the Assistance Listings title and number, Federal award identification number, year the Federal award was issued, and name of the Federal agency or pass-through entity. (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in § 200.328 and § 200.329. When a Federal agency or pass-through entity requires reporting on an accrual basis from a recipient or subrecipient that maintains its records other than on an accrual basis, the recipient or subrecipient must not be required to establish an accrual accounting system. This recipient or subrecipient may develop accrual data for its reports based on an analysis of the documentation on hand. 2. The code of federal regulations – 2 CFR 200.303 Internal controls requires that recipients and subrecipients must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award. (c) Evaluate and monitor the recipient’s or subrecipient’s compliance with statutes, regulations, and the terms and conditions of Federal awards. (d) Take prompt action when instances of noncompliance are identified. Condition The following exceptions to the criteria were observed during the performance of the audit procedures: 1. After the completion of internal review and approval process that Amtrak has established for SEFA preparation and review, we have received multiple updated versions of the schedule with changes to FY24 expenditure amounts for three Assistance Listings included on the SEFA. Total expenditures increased by $80.2 million from version 1 to the final version received. 2. The starting point of the SEFA preparation for the current year was not the audited FY23 SEFA submitted to Federal Audit Clearinghouse, as we have identified that Amtrak subsequently made changes to the FY23 internal SEFA document without reconciling the changes to the audited FY23 SEFA, which resulted in the total cumulative expenditures as of 9/30/2023 to be updated and as such impacting the FY24 expenditures for the respective federal programs. One of the adjustments related to the Hudson Yards Concrete Casing project (HYCC-3) which initially incorrectly recorded $25.0 million of prepaid expenditures. 3. As Assistance Listing #20.314 has been obligated as of 9/27/2024, Amtrak has recorded expenditures related to the HYCC-3 project under this program for the established pre-award period, which dated from January 30, 2023 as part of the FY24 expenditures. Previously, a portion of the total expenditures was included within the FY23 SEFA under Assistance Listing #20.315, for the total amount of $15.6 million. This amount was not adjusted out of the cumulative expenditures for Assistance Listing #20.315 until 2025. Consequently, these expenditures were listed both within the FY23 SEFA under Assistance Listing #20.315 and under the FY24 SEFA as Assistance Listing #20.314 expenditures. 4. As part of SEFA preparation as it relates to allocation of operating expenditures across multiple funding sources, certain projects were incorrectly mapped to annual grants funding source, which resulted in approximately $0.3 million of operating expenses to be included within Assistance Listing #20.315 that were also reported under Assistance Listing #97.075. Cause Amtrak’s control procedures in place as it relates to the preparation of the SEFA were not operating in a manner that would timely identify the conditions noted. Additionally, Amtrak’s controls around allocation of federal funding to project codes were not designed in a manner that would timely identify the conditions noted. In reviewing management’s controls around the SEFA preparation, the design of key controls identified by management does not include an overarching review of the SEFA and reconciliation of what’s been reported on the SEFA from individual projects’ standpoint when such projects have multiple assistance listings as funding sources. We also noted that there was not a specific control that ensures timely updates of Work Breakdown Structure (WBS) funding assignments and allocations when there is a change such as a new grant agreement signed. Effect Amtrak’s control procedures in place as it relates to the preparation of the SEFA were not designed in such a manner that would timely identify the conditions noted, which resulted in several versions of the SEFA that were erroneous and inclusion of expenditures that were double counted within the SEFA. This puts Amtrak at greater risk of non-compliance with its grant agreements with respect to questioned costs and an inaccurate SEFA. Questioned Costs None. Context The SEFA, as originally provided, had exceptions as described in the Condition section above noted for matters 1 and 2 in the Criteria section above, indicating that certain internal controls were not functioning as designed and others were not designed effectively. Identification as a Repeat Finding Not a repeat finding. Recommendation We recommend Amtrak to strengthen the SEFA oversight process to ensure appropriate preparation and review of the SEFA to validate its accuracy, including reconciliation with prior year audited SEFA. This should include having one reviewer take overall responsibility for the completeness and accuracy of the final submitted SEFA. This robust review process should include appropriate procedures to confirm accuracy of the SEFA, which may include a protocol where representatives from various groups (both discretionary and non-discretionary federal programs) work collaboratively to review the SEFA and underlying details of expenditures, to ensure all the adjustments have been properly reflected as well as any projects that might have multiple fund sources are identified timely and reviewed for appropriate inclusion within the SEFA. Additionally, Amtrak should establish a process where any modifications of WBS funding assignments and allocations are updated in a timely manner. Views of Responsible Officials Amtrak recognizes the need to improve the preparation and review of the SEFA. The company has documented the steps for preparing and reviewing the SEFA within its process narrative. The company will update the narrative to address the preparation and review issues that led to the multiple versions of the SEFA being provided during the audit. The company will review and update the Grants Management Compliance Narrative and controls to improve timing of updates for modifications of WBS funding assignments. The company is in the process of updating the SEFA preparation documentation for FY2025, which will be used at the end of the year. The review procedures and controls are being enhanced to include a checklist to improve the review.

Finding 2024-002: Review of Compliance Matrices and Narratives Program Name: 1. Rail and Transit Security Grant Program Assistance Listing No. 97.075 2. Railroad Development Assistance Listing No. 20.314 Federal Award No.: 1. EMW-2022-RA-00032 EMW-2021-RA-00048 EMW-2020-RA-00014 2. 69A36524400010MEGDC Federal Agency: 1. U.S. Department of Homeland Security 2. U.S. Department of Transportation Criteria The code of federal regulations – 2 CFR 200.302 Financial management requires that: (a) Each State must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State’s funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. The code of federal regulations – 2 CFR 200.303 Internal controls requires that recipients and subrecipients: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award. (c) Evaluate and monitor the recipient’s or subrecipient’s compliance with statutes, regulations, and the terms and conditions of Federal awards. Condition The following exceptions to the criteria were observed during the performance of the audit procedures: 1. For the compliance matrix that is maintained for the Assistance Listing #97.075, we have identified that for nine provisions, the wording contained withing the matrix did not match in its entirety to the respective grant agreement. Additionally, we noted that two provisions that were present in the grant agreements were not included in the matrix. 2. For the compliance matrix that is maintained for the Assistance Listing #20.314, we have identified that for nine provisions, the wording contained withing the matrix did not match in its entirety to the respective grant agreement. 3. Specific compliance requirements as it relates to the earmarking provisions of the respective grants of the Assistance Listing #97.075 were not detailed out within the respective compliance matrix, nor within the compliance narrative that is documented by Amtrak to assess the applicability and relevance of individual compliance requirements contained within the Compliance Supplement. Cause In reviewing management’s controls, the key controls identified by management are not designed such that consistent and timely proactive monitoring and/or review occurs to ensure that all the compliance requirements and any changes to the wording of specific provisions are updated and reviewed within the compliance matrices and the compliance narrative. Effect Amtrak is not in compliance with the 2 CFR 200.302 (a) and 2 CFR 200.303. This may also put Amtrak at greater risk of non-compliance with specific provisions in accordance with the federal awards. Questioned Costs None. Context We have reviewed the federal awards in scope and the compliance matrices and compliance narrative maintained by the Company as part of the audit procedures in connection with testing of earmarking and special tests and provisions compliance requirements. Identification as a Repeat Finding Not a repeat finding. However, we have noted similar control deficiencies related to completeness of the compliance matrices in prior years. Recommendation We recommend that Amtrak establishes a more defined timeline for the events that would trigger the update and review of the compliance matrices and compliance narrative, which could include execution of any new federal awards or amendments to existing federal awards. Additionally, Amtrak should establish a process where the modifications to the provisions are assessed for materiality/applicability and include documentation of the respective conclusions as part of the review process. Views of Responsible Officials Amtrak acknowledges the need to augment process documentation around the controls over the preparation and updates to the compliance matrices. The company is in the process of updating these controls now and will incorporate the identified findings in developing more robust controls. The company specifically notes the need to add more documentation on considerations for what provisions are updated in the compliance matrices and the evidence of review. The review procedures and controls are being enhanced to include a checklist to improve the review. This checklist will be completed by both the compliance matrix creator (upon creation) and the compliance matrix reviewer/approver (upon review and final approval).

Finding 2024-002: Review of Compliance Matrices and Narratives Program Name: 1. Rail and Transit Security Grant Program Assistance Listing No. 97.075 2. Railroad Development Assistance Listing No. 20.314 Federal Award No.: 1. EMW-2022-RA-00032 EMW-2021-RA-00048 EMW-2020-RA-00014 2. 69A36524400010MEGDC Federal Agency: 1. U.S. Department of Homeland Security 2. U.S. Department of Transportation Criteria The code of federal regulations – 2 CFR 200.302 Financial management requires that: (a) Each State must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State’s funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. The code of federal regulations – 2 CFR 200.303 Internal controls requires that recipients and subrecipients: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award. (c) Evaluate and monitor the recipient’s or subrecipient’s compliance with statutes, regulations, and the terms and conditions of Federal awards. Condition The following exceptions to the criteria were observed during the performance of the audit procedures: 1. For the compliance matrix that is maintained for the Assistance Listing #97.075, we have identified that for nine provisions, the wording contained withing the matrix did not match in its entirety to the respective grant agreement. Additionally, we noted that two provisions that were present in the grant agreements were not included in the matrix. 2. For the compliance matrix that is maintained for the Assistance Listing #20.314, we have identified that for nine provisions, the wording contained withing the matrix did not match in its entirety to the respective grant agreement. 3. Specific compliance requirements as it relates to the earmarking provisions of the respective grants of the Assistance Listing #97.075 were not detailed out within the respective compliance matrix, nor within the compliance narrative that is documented by Amtrak to assess the applicability and relevance of individual compliance requirements contained within the Compliance Supplement. Cause In reviewing management’s controls, the key controls identified by management are not designed such that consistent and timely proactive monitoring and/or review occurs to ensure that all the compliance requirements and any changes to the wording of specific provisions are updated and reviewed within the compliance matrices and the compliance narrative. Effect Amtrak is not in compliance with the 2 CFR 200.302 (a) and 2 CFR 200.303. This may also put Amtrak at greater risk of non-compliance with specific provisions in accordance with the federal awards. Questioned Costs None. Context We have reviewed the federal awards in scope and the compliance matrices and compliance narrative maintained by the Company as part of the audit procedures in connection with testing of earmarking and special tests and provisions compliance requirements. Identification as a Repeat Finding Not a repeat finding. However, we have noted similar control deficiencies related to completeness of the compliance matrices in prior years. Recommendation We recommend that Amtrak establishes a more defined timeline for the events that would trigger the update and review of the compliance matrices and compliance narrative, which could include execution of any new federal awards or amendments to existing federal awards. Additionally, Amtrak should establish a process where the modifications to the provisions are assessed for materiality/applicability and include documentation of the respective conclusions as part of the review process. Views of Responsible Officials Amtrak acknowledges the need to augment process documentation around the controls over the preparation and updates to the compliance matrices. The company is in the process of updating these controls now and will incorporate the identified findings in developing more robust controls. The company specifically notes the need to add more documentation on considerations for what provisions are updated in the compliance matrices and the evidence of review. The review procedures and controls are being enhanced to include a checklist to improve the review. This checklist will be completed by both the compliance matrix creator (upon creation) and the compliance matrix reviewer/approver (upon review and final approval).

Finding 2024-003: Unsubstantiated Expense Program Name: Rail and Transit Security Grant Program Assistance Listing No. 97.075 Federal Award No.: EMW-2021-RA-00048 Federal Agency: U.S. Department of Homeland Security Criteria The code of federal regulations – 2 CFR 200.405 Allocable costs requires that: A cost is allocable to a Federal award or other cost objective if the cost is assignable to that Federal award or other cost objective in accordance with the relative benefits received. This standard is met if the cost satisfies any of the following criteria: (1) Is incurred specifically for the Federal award; (2) Benefits both the Federal award and other work of the recipient or subrecipient and can be distributed in proportions that may be approximated using reasonable methods; or (3) Is necessary to the overall operation of the recipient or subrecipient and is assignable in part to the Federal award in accordance with these cost principles. The code of federal regulations – 2 CFR 200.1 Definitions defines Questioned costs as: Questioned cost means an amount, expended or received from a Federal award, that in the auditor’s judgment: (i) Is noncompliant or suspected noncompliant with Federal statutes, regulations, or the terms and conditions of the Federal award; The following exceptions to the criteria were observed during the performance of the audit procedures: 1. As part of our procedures relating to the testing requirement of Sections A and B (Activities Allowed or Unallowed and Allowable Costs/Cost Principles), we identified a transaction erroneously included in the expenditure population that did not represent an expenditure allocable to Assistance Listing #97.075 incurred by Amtrak. The $24,200 amount included on the SEFA and in the underlying population related to a project funded by the Assistance Listing #20.315. Cause Amtrak’s control procedures in place as it relates to the review of manual journal entries related to reclassification of expenses between different projects under different funding sources were not operating effectively. The review process failed to identify the correct project to allocate the reclassification journal entry to. Effect Amtrak is in non-compliance with the related grant agreement. Questioned Costs This finding resulted in a total of $24,200 of questioned costs for Assistance Listing #97.075 – Rail and Transit Security Grant Program for Federal Award # EMW-2021-RA-00048. Context We selected 40 AB expenditure transactions, related to Assistance Listing #97.075, for internal control and compliance testing. One exception as described in the Condition section above was noted for matters 1-3 in the Criteria section above, indicating that internal controls were not functioning. Identification as a Repeat Finding Not a repeat finding. Recommendation We recommend that management strengthen the process to identify and review funding sources of underlying expenditures, that support the amounts of the reclassification journal entries. This could include reviewing approved budgets for the federal award in scope at a necessary level of detail to determine appropriateness of allocations in a timely manner. Views of Responsible Officials The invoice identified in this finding was initially charged to the incorrect project code, due to a manual process that was done incorrectly. The charges on the invoice should have been recorded to Amtrak’s annual grant, not the Rail and Transit Security Grant. The Company has moved the charges to the correct project code. The review and approval controls within the procurement process would have normally prevented the assignment of the incorrect project code, but in this situation, the project code was not set up at the time the services were rendered and an incorrect project code was used. This created the requirement for a manual journal entry to reclassify the expenses and at that time the incorrect code was selected. Amtrak will reinforce the need for proper project set up in advance and proper review of project charges once incurred.

Finding 2024-001: Preparation of Schedule of Expenditures of Federal Awards (SEFA) Program Name: Multiple federal programs Criteria 1. The code of federal regulations – 2 CFR 200.302 Financial management requires that: (a) Each State must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State’s funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. (b) The recipient’s and subrecipient’s financial management system must provide for the following: (1) Identification of all Federal awards received and expended and the Federal programs under which they were received. Federal program and Federal award identification must include, as applicable, the Assistance Listings title and number, Federal award identification number, year the Federal award was issued, and name of the Federal agency or pass-through entity. (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in § 200.328 and § 200.329. When a Federal agency or pass-through entity requires reporting on an accrual basis from a recipient or subrecipient that maintains its records other than on an accrual basis, the recipient or subrecipient must not be required to establish an accrual accounting system. This recipient or subrecipient may develop accrual data for its reports based on an analysis of the documentation on hand. 2. The code of federal regulations – 2 CFR 200.303 Internal controls requires that recipients and subrecipients must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award. (c) Evaluate and monitor the recipient’s or subrecipient’s compliance with statutes, regulations, and the terms and conditions of Federal awards. (d) Take prompt action when instances of noncompliance are identified. Condition The following exceptions to the criteria were observed during the performance of the audit procedures: 1. After the completion of internal review and approval process that Amtrak has established for SEFA preparation and review, we have received multiple updated versions of the schedule with changes to FY24 expenditure amounts for three Assistance Listings included on the SEFA. Total expenditures increased by $80.2 million from version 1 to the final version received. 2. The starting point of the SEFA preparation for the current year was not the audited FY23 SEFA submitted to Federal Audit Clearinghouse, as we have identified that Amtrak subsequently made changes to the FY23 internal SEFA document without reconciling the changes to the audited FY23 SEFA, which resulted in the total cumulative expenditures as of 9/30/2023 to be updated and as such impacting the FY24 expenditures for the respective federal programs. One of the adjustments related to the Hudson Yards Concrete Casing project (HYCC-3) which initially incorrectly recorded $25.0 million of prepaid expenditures. 3. As Assistance Listing #20.314 has been obligated as of 9/27/2024, Amtrak has recorded expenditures related to the HYCC-3 project under this program for the established pre-award period, which dated from January 30, 2023 as part of the FY24 expenditures. Previously, a portion of the total expenditures was included within the FY23 SEFA under Assistance Listing #20.315, for the total amount of $15.6 million. This amount was not adjusted out of the cumulative expenditures for Assistance Listing #20.315 until 2025. Consequently, these expenditures were listed both within the FY23 SEFA under Assistance Listing #20.315 and under the FY24 SEFA as Assistance Listing #20.314 expenditures. 4. As part of SEFA preparation as it relates to allocation of operating expenditures across multiple funding sources, certain projects were incorrectly mapped to annual grants funding source, which resulted in approximately $0.3 million of operating expenses to be included within Assistance Listing #20.315 that were also reported under Assistance Listing #97.075. Cause Amtrak’s control procedures in place as it relates to the preparation of the SEFA were not operating in a manner that would timely identify the conditions noted. Additionally, Amtrak’s controls around allocation of federal funding to project codes were not designed in a manner that would timely identify the conditions noted. In reviewing management’s controls around the SEFA preparation, the design of key controls identified by management does not include an overarching review of the SEFA and reconciliation of what’s been reported on the SEFA from individual projects’ standpoint when such projects have multiple assistance listings as funding sources. We also noted that there was not a specific control that ensures timely updates of Work Breakdown Structure (WBS) funding assignments and allocations when there is a change such as a new grant agreement signed. Effect Amtrak’s control procedures in place as it relates to the preparation of the SEFA were not designed in such a manner that would timely identify the conditions noted, which resulted in several versions of the SEFA that were erroneous and inclusion of expenditures that were double counted within the SEFA. This puts Amtrak at greater risk of non-compliance with its grant agreements with respect to questioned costs and an inaccurate SEFA. Questioned Costs None. Context The SEFA, as originally provided, had exceptions as described in the Condition section above noted for matters 1 and 2 in the Criteria section above, indicating that certain internal controls were not functioning as designed and others were not designed effectively. Identification as a Repeat Finding Not a repeat finding. Recommendation We recommend Amtrak to strengthen the SEFA oversight process to ensure appropriate preparation and review of the SEFA to validate its accuracy, including reconciliation with prior year audited SEFA. This should include having one reviewer take overall responsibility for the completeness and accuracy of the final submitted SEFA. This robust review process should include appropriate procedures to confirm accuracy of the SEFA, which may include a protocol where representatives from various groups (both discretionary and non-discretionary federal programs) work collaboratively to review the SEFA and underlying details of expenditures, to ensure all the adjustments have been properly reflected as well as any projects that might have multiple fund sources are identified timely and reviewed for appropriate inclusion within the SEFA. Additionally, Amtrak should establish a process where any modifications of WBS funding assignments and allocations are updated in a timely manner. Views of Responsible Officials Amtrak recognizes the need to improve the preparation and review of the SEFA. The company has documented the steps for preparing and reviewing the SEFA within its process narrative. The company will update the narrative to address the preparation and review issues that led to the multiple versions of the SEFA being provided during the audit. The company will review and update the Grants Management Compliance Narrative and controls to improve timing of updates for modifications of WBS funding assignments. The company is in the process of updating the SEFA preparation documentation for FY2025, which will be used at the end of the year. The review procedures and controls are being enhanced to include a checklist to improve the review.

Finding 2024-001: Preparation of Schedule of Expenditures of Federal Awards (SEFA) Program Name: Multiple federal programs Criteria 1. The code of federal regulations – 2 CFR 200.302 Financial management requires that: (a) Each State must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State’s funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. (b) The recipient’s and subrecipient’s financial management system must provide for the following: (1) Identification of all Federal awards received and expended and the Federal programs under which they were received. Federal program and Federal award identification must include, as applicable, the Assistance Listings title and number, Federal award identification number, year the Federal award was issued, and name of the Federal agency or pass-through entity. (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in § 200.328 and § 200.329. When a Federal agency or pass-through entity requires reporting on an accrual basis from a recipient or subrecipient that maintains its records other than on an accrual basis, the recipient or subrecipient must not be required to establish an accrual accounting system. This recipient or subrecipient may develop accrual data for its reports based on an analysis of the documentation on hand. 2. The code of federal regulations – 2 CFR 200.303 Internal controls requires that recipients and subrecipients must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award. (c) Evaluate and monitor the recipient’s or subrecipient’s compliance with statutes, regulations, and the terms and conditions of Federal awards. (d) Take prompt action when instances of noncompliance are identified. Condition The following exceptions to the criteria were observed during the performance of the audit procedures: 1. After the completion of internal review and approval process that Amtrak has established for SEFA preparation and review, we have received multiple updated versions of the schedule with changes to FY24 expenditure amounts for three Assistance Listings included on the SEFA. Total expenditures increased by $80.2 million from version 1 to the final version received. 2. The starting point of the SEFA preparation for the current year was not the audited FY23 SEFA submitted to Federal Audit Clearinghouse, as we have identified that Amtrak subsequently made changes to the FY23 internal SEFA document without reconciling the changes to the audited FY23 SEFA, which resulted in the total cumulative expenditures as of 9/30/2023 to be updated and as such impacting the FY24 expenditures for the respective federal programs. One of the adjustments related to the Hudson Yards Concrete Casing project (HYCC-3) which initially incorrectly recorded $25.0 million of prepaid expenditures. 3. As Assistance Listing #20.314 has been obligated as of 9/27/2024, Amtrak has recorded expenditures related to the HYCC-3 project under this program for the established pre-award period, which dated from January 30, 2023 as part of the FY24 expenditures. Previously, a portion of the total expenditures was included within the FY23 SEFA under Assistance Listing #20.315, for the total amount of $15.6 million. This amount was not adjusted out of the cumulative expenditures for Assistance Listing #20.315 until 2025. Consequently, these expenditures were listed both within the FY23 SEFA under Assistance Listing #20.315 and under the FY24 SEFA as Assistance Listing #20.314 expenditures. 4. As part of SEFA preparation as it relates to allocation of operating expenditures across multiple funding sources, certain projects were incorrectly mapped to annual grants funding source, which resulted in approximately $0.3 million of operating expenses to be included within Assistance Listing #20.315 that were also reported under Assistance Listing #97.075. Cause Amtrak’s control procedures in place as it relates to the preparation of the SEFA were not operating in a manner that would timely identify the conditions noted. Additionally, Amtrak’s controls around allocation of federal funding to project codes were not designed in a manner that would timely identify the conditions noted. In reviewing management’s controls around the SEFA preparation, the design of key controls identified by management does not include an overarching review of the SEFA and reconciliation of what’s been reported on the SEFA from individual projects’ standpoint when such projects have multiple assistance listings as funding sources. We also noted that there was not a specific control that ensures timely updates of Work Breakdown Structure (WBS) funding assignments and allocations when there is a change such as a new grant agreement signed. Effect Amtrak’s control procedures in place as it relates to the preparation of the SEFA were not designed in such a manner that would timely identify the conditions noted, which resulted in several versions of the SEFA that were erroneous and inclusion of expenditures that were double counted within the SEFA. This puts Amtrak at greater risk of non-compliance with its grant agreements with respect to questioned costs and an inaccurate SEFA. Questioned Costs None. Context The SEFA, as originally provided, had exceptions as described in the Condition section above noted for matters 1 and 2 in the Criteria section above, indicating that certain internal controls were not functioning as designed and others were not designed effectively. Identification as a Repeat Finding Not a repeat finding. Recommendation We recommend Amtrak to strengthen the SEFA oversight process to ensure appropriate preparation and review of the SEFA to validate its accuracy, including reconciliation with prior year audited SEFA. This should include having one reviewer take overall responsibility for the completeness and accuracy of the final submitted SEFA. This robust review process should include appropriate procedures to confirm accuracy of the SEFA, which may include a protocol where representatives from various groups (both discretionary and non-discretionary federal programs) work collaboratively to review the SEFA and underlying details of expenditures, to ensure all the adjustments have been properly reflected as well as any projects that might have multiple fund sources are identified timely and reviewed for appropriate inclusion within the SEFA. Additionally, Amtrak should establish a process where any modifications of WBS funding assignments and allocations are updated in a timely manner. Views of Responsible Officials Amtrak recognizes the need to improve the preparation and review of the SEFA. The company has documented the steps for preparing and reviewing the SEFA within its process narrative. The company will update the narrative to address the preparation and review issues that led to the multiple versions of the SEFA being provided during the audit. The company will review and update the Grants Management Compliance Narrative and controls to improve timing of updates for modifications of WBS funding assignments. The company is in the process of updating the SEFA preparation documentation for FY2025, which will be used at the end of the year. The review procedures and controls are being enhanced to include a checklist to improve the review.

Finding 2024-002: Review of Compliance Matrices and Narratives Program Name: 1. Rail and Transit Security Grant Program Assistance Listing No. 97.075 2. Railroad Development Assistance Listing No. 20.314 Federal Award No.: 1. EMW-2022-RA-00032 EMW-2021-RA-00048 EMW-2020-RA-00014 2. 69A36524400010MEGDC Federal Agency: 1. U.S. Department of Homeland Security 2. U.S. Department of Transportation Criteria The code of federal regulations – 2 CFR 200.302 Financial management requires that: (a) Each State must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State’s funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. The code of federal regulations – 2 CFR 200.303 Internal controls requires that recipients and subrecipients: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award. (c) Evaluate and monitor the recipient’s or subrecipient’s compliance with statutes, regulations, and the terms and conditions of Federal awards. Condition The following exceptions to the criteria were observed during the performance of the audit procedures: 1. For the compliance matrix that is maintained for the Assistance Listing #97.075, we have identified that for nine provisions, the wording contained withing the matrix did not match in its entirety to the respective grant agreement. Additionally, we noted that two provisions that were present in the grant agreements were not included in the matrix. 2. For the compliance matrix that is maintained for the Assistance Listing #20.314, we have identified that for nine provisions, the wording contained withing the matrix did not match in its entirety to the respective grant agreement. 3. Specific compliance requirements as it relates to the earmarking provisions of the respective grants of the Assistance Listing #97.075 were not detailed out within the respective compliance matrix, nor within the compliance narrative that is documented by Amtrak to assess the applicability and relevance of individual compliance requirements contained within the Compliance Supplement. Cause In reviewing management’s controls, the key controls identified by management are not designed such that consistent and timely proactive monitoring and/or review occurs to ensure that all the compliance requirements and any changes to the wording of specific provisions are updated and reviewed within the compliance matrices and the compliance narrative. Effect Amtrak is not in compliance with the 2 CFR 200.302 (a) and 2 CFR 200.303. This may also put Amtrak at greater risk of non-compliance with specific provisions in accordance with the federal awards. Questioned Costs None. Context We have reviewed the federal awards in scope and the compliance matrices and compliance narrative maintained by the Company as part of the audit procedures in connection with testing of earmarking and special tests and provisions compliance requirements. Identification as a Repeat Finding Not a repeat finding. However, we have noted similar control deficiencies related to completeness of the compliance matrices in prior years. Recommendation We recommend that Amtrak establishes a more defined timeline for the events that would trigger the update and review of the compliance matrices and compliance narrative, which could include execution of any new federal awards or amendments to existing federal awards. Additionally, Amtrak should establish a process where the modifications to the provisions are assessed for materiality/applicability and include documentation of the respective conclusions as part of the review process. Views of Responsible Officials Amtrak acknowledges the need to augment process documentation around the controls over the preparation and updates to the compliance matrices. The company is in the process of updating these controls now and will incorporate the identified findings in developing more robust controls. The company specifically notes the need to add more documentation on considerations for what provisions are updated in the compliance matrices and the evidence of review. The review procedures and controls are being enhanced to include a checklist to improve the review. This checklist will be completed by both the compliance matrix creator (upon creation) and the compliance matrix reviewer/approver (upon review and final approval).

Finding 2024-002: Review of Compliance Matrices and Narratives Program Name: 1. Rail and Transit Security Grant Program Assistance Listing No. 97.075 2. Railroad Development Assistance Listing No. 20.314 Federal Award No.: 1. EMW-2022-RA-00032 EMW-2021-RA-00048 EMW-2020-RA-00014 2. 69A36524400010MEGDC Federal Agency: 1. U.S. Department of Homeland Security 2. U.S. Department of Transportation Criteria The code of federal regulations – 2 CFR 200.302 Financial management requires that: (a) Each State must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State’s funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. The code of federal regulations – 2 CFR 200.303 Internal controls requires that recipients and subrecipients: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award. (c) Evaluate and monitor the recipient’s or subrecipient’s compliance with statutes, regulations, and the terms and conditions of Federal awards. Condition The following exceptions to the criteria were observed during the performance of the audit procedures: 1. For the compliance matrix that is maintained for the Assistance Listing #97.075, we have identified that for nine provisions, the wording contained withing the matrix did not match in its entirety to the respective grant agreement. Additionally, we noted that two provisions that were present in the grant agreements were not included in the matrix. 2. For the compliance matrix that is maintained for the Assistance Listing #20.314, we have identified that for nine provisions, the wording contained withing the matrix did not match in its entirety to the respective grant agreement. 3. Specific compliance requirements as it relates to the earmarking provisions of the respective grants of the Assistance Listing #97.075 were not detailed out within the respective compliance matrix, nor within the compliance narrative that is documented by Amtrak to assess the applicability and relevance of individual compliance requirements contained within the Compliance Supplement. Cause In reviewing management’s controls, the key controls identified by management are not designed such that consistent and timely proactive monitoring and/or review occurs to ensure that all the compliance requirements and any changes to the wording of specific provisions are updated and reviewed within the compliance matrices and the compliance narrative. Effect Amtrak is not in compliance with the 2 CFR 200.302 (a) and 2 CFR 200.303. This may also put Amtrak at greater risk of non-compliance with specific provisions in accordance with the federal awards. Questioned Costs None. Context We have reviewed the federal awards in scope and the compliance matrices and compliance narrative maintained by the Company as part of the audit procedures in connection with testing of earmarking and special tests and provisions compliance requirements. Identification as a Repeat Finding Not a repeat finding. However, we have noted similar control deficiencies related to completeness of the compliance matrices in prior years. Recommendation We recommend that Amtrak establishes a more defined timeline for the events that would trigger the update and review of the compliance matrices and compliance narrative, which could include execution of any new federal awards or amendments to existing federal awards. Additionally, Amtrak should establish a process where the modifications to the provisions are assessed for materiality/applicability and include documentation of the respective conclusions as part of the review process. Views of Responsible Officials Amtrak acknowledges the need to augment process documentation around the controls over the preparation and updates to the compliance matrices. The company is in the process of updating these controls now and will incorporate the identified findings in developing more robust controls. The company specifically notes the need to add more documentation on considerations for what provisions are updated in the compliance matrices and the evidence of review. The review procedures and controls are being enhanced to include a checklist to improve the review. This checklist will be completed by both the compliance matrix creator (upon creation) and the compliance matrix reviewer/approver (upon review and final approval).

Finding 2024-003: Unsubstantiated Expense Program Name: Rail and Transit Security Grant Program Assistance Listing No. 97.075 Federal Award No.: EMW-2021-RA-00048 Federal Agency: U.S. Department of Homeland Security Criteria The code of federal regulations – 2 CFR 200.405 Allocable costs requires that: A cost is allocable to a Federal award or other cost objective if the cost is assignable to that Federal award or other cost objective in accordance with the relative benefits received. This standard is met if the cost satisfies any of the following criteria: (1) Is incurred specifically for the Federal award; (2) Benefits both the Federal award and other work of the recipient or subrecipient and can be distributed in proportions that may be approximated using reasonable methods; or (3) Is necessary to the overall operation of the recipient or subrecipient and is assignable in part to the Federal award in accordance with these cost principles. The code of federal regulations – 2 CFR 200.1 Definitions defines Questioned costs as: Questioned cost means an amount, expended or received from a Federal award, that in the auditor’s judgment: (i) Is noncompliant or suspected noncompliant with Federal statutes, regulations, or the terms and conditions of the Federal award; The following exceptions to the criteria were observed during the performance of the audit procedures: 1. As part of our procedures relating to the testing requirement of Sections A and B (Activities Allowed or Unallowed and Allowable Costs/Cost Principles), we identified a transaction erroneously included in the expenditure population that did not represent an expenditure allocable to Assistance Listing #97.075 incurred by Amtrak. The $24,200 amount included on the SEFA and in the underlying population related to a project funded by the Assistance Listing #20.315. Cause Amtrak’s control procedures in place as it relates to the review of manual journal entries related to reclassification of expenses between different projects under different funding sources were not operating effectively. The review process failed to identify the correct project to allocate the reclassification journal entry to. Effect Amtrak is in non-compliance with the related grant agreement. Questioned Costs This finding resulted in a total of $24,200 of questioned costs for Assistance Listing #97.075 – Rail and Transit Security Grant Program for Federal Award # EMW-2021-RA-00048. Context We selected 40 AB expenditure transactions, related to Assistance Listing #97.075, for internal control and compliance testing. One exception as described in the Condition section above was noted for matters 1-3 in the Criteria section above, indicating that internal controls were not functioning. Identification as a Repeat Finding Not a repeat finding. Recommendation We recommend that management strengthen the process to identify and review funding sources of underlying expenditures, that support the amounts of the reclassification journal entries. This could include reviewing approved budgets for the federal award in scope at a necessary level of detail to determine appropriateness of allocations in a timely manner. Views of Responsible Officials The invoice identified in this finding was initially charged to the incorrect project code, due to a manual process that was done incorrectly. The charges on the invoice should have been recorded to Amtrak’s annual grant, not the Rail and Transit Security Grant. The Company has moved the charges to the correct project code. The review and approval controls within the procurement process would have normally prevented the assignment of the incorrect project code, but in this situation, the project code was not set up at the time the services were rendered and an incorrect project code was used. This created the requirement for a manual journal entry to reclassify the expenses and at that time the incorrect code was selected. Amtrak will reinforce the need for proper project set up in advance and proper review of project charges once incurred.

Finding 2024-001: Preparation of Schedule of Expenditures of Federal Awards (SEFA) Program Name: Multiple federal programs Criteria 1. The code of federal regulations – 2 CFR 200.302 Financial management requires that: (a) Each State must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State’s funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. (b) The recipient’s and subrecipient’s financial management system must provide for the following: (1) Identification of all Federal awards received and expended and the Federal programs under which they were received. Federal program and Federal award identification must include, as applicable, the Assistance Listings title and number, Federal award identification number, year the Federal award was issued, and name of the Federal agency or pass-through entity. (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in § 200.328 and § 200.329. When a Federal agency or pass-through entity requires reporting on an accrual basis from a recipient or subrecipient that maintains its records other than on an accrual basis, the recipient or subrecipient must not be required to establish an accrual accounting system. This recipient or subrecipient may develop accrual data for its reports based on an analysis of the documentation on hand. 2. The code of federal regulations – 2 CFR 200.303 Internal controls requires that recipients and subrecipients must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award. (c) Evaluate and monitor the recipient’s or subrecipient’s compliance with statutes, regulations, and the terms and conditions of Federal awards. (d) Take prompt action when instances of noncompliance are identified. Condition The following exceptions to the criteria were observed during the performance of the audit procedures: 1. After the completion of internal review and approval process that Amtrak has established for SEFA preparation and review, we have received multiple updated versions of the schedule with changes to FY24 expenditure amounts for three Assistance Listings included on the SEFA. Total expenditures increased by $80.2 million from version 1 to the final version received. 2. The starting point of the SEFA preparation for the current year was not the audited FY23 SEFA submitted to Federal Audit Clearinghouse, as we have identified that Amtrak subsequently made changes to the FY23 internal SEFA document without reconciling the changes to the audited FY23 SEFA, which resulted in the total cumulative expenditures as of 9/30/2023 to be updated and as such impacting the FY24 expenditures for the respective federal programs. One of the adjustments related to the Hudson Yards Concrete Casing project (HYCC-3) which initially incorrectly recorded $25.0 million of prepaid expenditures. 3. As Assistance Listing #20.314 has been obligated as of 9/27/2024, Amtrak has recorded expenditures related to the HYCC-3 project under this program for the established pre-award period, which dated from January 30, 2023 as part of the FY24 expenditures. Previously, a portion of the total expenditures was included within the FY23 SEFA under Assistance Listing #20.315, for the total amount of $15.6 million. This amount was not adjusted out of the cumulative expenditures for Assistance Listing #20.315 until 2025. Consequently, these expenditures were listed both within the FY23 SEFA under Assistance Listing #20.315 and under the FY24 SEFA as Assistance Listing #20.314 expenditures. 4. As part of SEFA preparation as it relates to allocation of operating expenditures across multiple funding sources, certain projects were incorrectly mapped to annual grants funding source, which resulted in approximately $0.3 million of operating expenses to be included within Assistance Listing #20.315 that were also reported under Assistance Listing #97.075. Cause Amtrak’s control procedures in place as it relates to the preparation of the SEFA were not operating in a manner that would timely identify the conditions noted. Additionally, Amtrak’s controls around allocation of federal funding to project codes were not designed in a manner that would timely identify the conditions noted. In reviewing management’s controls around the SEFA preparation, the design of key controls identified by management does not include an overarching review of the SEFA and reconciliation of what’s been reported on the SEFA from individual projects’ standpoint when such projects have multiple assistance listings as funding sources. We also noted that there was not a specific control that ensures timely updates of Work Breakdown Structure (WBS) funding assignments and allocations when there is a change such as a new grant agreement signed. Effect Amtrak’s control procedures in place as it relates to the preparation of the SEFA were not designed in such a manner that would timely identify the conditions noted, which resulted in several versions of the SEFA that were erroneous and inclusion of expenditures that were double counted within the SEFA. This puts Amtrak at greater risk of non-compliance with its grant agreements with respect to questioned costs and an inaccurate SEFA. Questioned Costs None. Context The SEFA, as originally provided, had exceptions as described in the Condition section above noted for matters 1 and 2 in the Criteria section above, indicating that certain internal controls were not functioning as designed and others were not designed effectively. Identification as a Repeat Finding Not a repeat finding. Recommendation We recommend Amtrak to strengthen the SEFA oversight process to ensure appropriate preparation and review of the SEFA to validate its accuracy, including reconciliation with prior year audited SEFA. This should include having one reviewer take overall responsibility for the completeness and accuracy of the final submitted SEFA. This robust review process should include appropriate procedures to confirm accuracy of the SEFA, which may include a protocol where representatives from various groups (both discretionary and non-discretionary federal programs) work collaboratively to review the SEFA and underlying details of expenditures, to ensure all the adjustments have been properly reflected as well as any projects that might have multiple fund sources are identified timely and reviewed for appropriate inclusion within the SEFA. Additionally, Amtrak should establish a process where any modifications of WBS funding assignments and allocations are updated in a timely manner. Views of Responsible Officials Amtrak recognizes the need to improve the preparation and review of the SEFA. The company has documented the steps for preparing and reviewing the SEFA within its process narrative. The company will update the narrative to address the preparation and review issues that led to the multiple versions of the SEFA being provided during the audit. The company will review and update the Grants Management Compliance Narrative and controls to improve timing of updates for modifications of WBS funding assignments. The company is in the process of updating the SEFA preparation documentation for FY2025, which will be used at the end of the year. The review procedures and controls are being enhanced to include a checklist to improve the review.