Audit 361411

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-008 PROGRAM INCOME Material Weakness Criteria Pursuant to 2 CFR 200 for award objectives and the regulations at 2 CFR 200.307, program income is defined as “Gross income earned by the recipient that is directly generated by a supported activity or earned as a result of the federal award during the period of performance” by 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards. Program income reporting is due forty five (45) days after the end of the federal fiscal year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. Condition Program income consists of registration fees collected for training, meetings or workshops and the proceeds from the sale of publications as a result of the federal award during the period of performance. Program income is treated as an additive to the federal funds received by CUAHSI. During a drawdown, program income reduces the amount that is requested to cover reimbursable costs through the Flexible Billing module. This allows program income to be applied to the award before a reimbursement is requested from NSF adding the value of program income received to the awarded amount. Program income reporting is due forty five (45) days after the end of the federal fiscal year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. CUAHSI program income totaled $12,605 for the year ended December 31, 2022.CUAHSI failed to submit the required Program Income Reporting Worksheet by the required deadline of forty five (45) days after the end of the federal fiscal year (November 15, 2022) to ensure with the program income policies in accordance with the UG for the year ended December 31, 2022. Cause & Context Lack of resources and detailed attention to the risks, along with circumvention of controls has resulted in weak internal controls, and conflicting or incomplete policies and procedures. Effect Non-compliance can lead to penalties, fines, or even termination of the contract. It may also damage CUAHSI’s future eligibility for federal funding and jeopardize CUAHSI’s ability to secure future grants or contracts from other funding agencies. Granting organizations typically prioritize funding recipients with a track record of compliance and accountability. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-009. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.307.View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-006 PROCUREMENT, SUSPENSION AND DEBARMENT Material Weakness Criteria The requirements for this compliance requirement are contained in 2 CFR sections 200.317- 200.326; 48 CFR parts 03, 15, 44, and the clauses at 48 CRF sections 52.244-2, 52.244-5, 52.203-13, 52.203-16 and 52.215-12; agency FAR supplements; 2 CFR part 180; OMB M-18- 18; and the terms and conditions of the federal award. There is a requirement to verify that contractors in covered transactions or any of its vendors are not federally debarred, suspended, or excluded. A covered transaction is a nonprocurement or procurement transaction in excess of $25,000 that is subject to the prohibitions noted in 2 CFR part 180. The covered transaction may be at the primary tier, between a federal agency and a person or a lower tier between a participant in a covered transaction and another person. Condition The auditor noted that CUAHSI failed to maintain and provide the proper records and support to document their review of vendor files for covered transactions. Such failure led to noncompliance with the procurement, suspension and debarment policies in accordance with the UG for the year ended December 31, 2022. CUAHSI did not complete the verification of its 2022 vendors until 2024. Based on our testing, no contractors in covered transactions were deemed to be federally debarred, suspended or excluded.Cause & Context CUAHSI has a policy in place to meet the procurement requirements but there was no evidence of compliance with that policy. Effect As a result of noncompliance, there could be possible repayment of funds and / or possible suspension or debarment. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-007. Recommendation CUAHSI should ensure that, to the extent practicable, the use of a competitive procurement process in compliance with 2 CFR section 200/317. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-005 SUBRECIPIENT MONITORING Material Weakness Criteria The regulations are documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h); (Requirements for Pass-Through Entities). The criteria for monitoring subrecipients of federal awards should be following federal regulations, the terms of the federal contract, and any additional requirements specified by the auditee's policies and procedures. Specifically, the monitoring criteria should include, but not be limited to, the following: • Subrecipient Risk Assessment • Financial Monitoring • Compliance Monitoring • Reporting and Documentation Condition The auditee failed to comply with federal regulations requiring the monitoring of subrecipients for federal awards on a timely basis. Recipients of federal awards are responsible for monitoring the activities of subrecipients to ensure that they comply with applicable laws, regulations, and the terms and conditions of the federal award. CUAHSI did not complete the monitoring of its 2022 subrecipients until 2024. During the year ended December 31, 2022, CUAHSI had $252,550 in amounts paid to subrecipients. Based on our testing of amounts paid to subrecipients, no amounts were identified as unallowable.Material Weakness Cause & Context CUAHSI had a policy and procedure manual in place which outlined the steps for monitoring. There was no audit evidence of CUAHSI following the policy and monitoring that the subrecipient was using the funding as prescribed during the year ended December 31, 2022. Effect CUAHSI’s lack of monitoring creates a significant risk of the possible misuse or improper use of funds. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-005. Recommendation The auditor recommends that management review the requirements documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h);(Requirements for Pass-Through Entities) and develops and implements procedures to adhere to such requirements. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-004 REPORTING - DCF Material Weakness Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (June 27, 2025) or nine months after CUAHSI’s year end (September 30, 2023). Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG.Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-004. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Material Weakness Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes.Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2021-002. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-007 CASH MANAGEMENT - FEDERAL DRAWDOWNS IN ADVANCE OF EXPENDITURES Material Weakness Criteria CFR § 200.305 Cash management: This section of the CFR outlines the requirements for the management of cash drawdowns and disbursements of federal funds. Federal funds should be disbursed in a timely manner for allowable costs that have been incurred. Cash advances must meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation. Condition CUAHSI did not meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation which details the requirements for advance fundings. During 2022, CUAHSI had advance drawdowns totaling $3,862,318 from the NSF. Of this amount, CUAHSI incurred $3,228,996 in eligible expenses for the year ended December 31, 2022. This resulted in $633,322 in excess federal advances as of year-end. The draw downs in excess of revenue recognized during the year ended December 31, 2022 are reported as part of advances payable in the accompanying Statement of Financial Position. Cause & Context CUAHSI initiated advance drawdowns without following the guidelines set forth by Chapter VIII.C.3 of the grant agreement.Effect Drawing down funds in advance of incurring eligible expenses could lead to non-compliance with federal regulations, such as those outlined in 2 CFR § 200.305. This may result in the need to repay the funds, potential financial penalties, or disqualification from future federal funding. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-008. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.35. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-008 PROGRAM INCOME Material Weakness Criteria Pursuant to 2 CFR 200 for award objectives and the regulations at 2 CFR 200.307, program income is defined as “Gross income earned by the recipient that is directly generated by a supported activity or earned as a result of the federal award during the period of performance” by 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards. Program income reporting is due forty five (45) days after the end of the federal fiscal year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. Condition Program income consists of registration fees collected for training, meetings or workshops and the proceeds from the sale of publications as a result of the federal award during the period of performance. Program income is treated as an additive to the federal funds received by CUAHSI. During a drawdown, program income reduces the amount that is requested to cover reimbursable costs through the Flexible Billing module. This allows program income to be applied to the award before a reimbursement is requested from NSF adding the value of program income received to the awarded amount. Program income reporting is due forty five (45) days after the end of the federal fiscal year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. CUAHSI program income totaled $12,605 for the year ended December 31, 2022.CUAHSI failed to submit the required Program Income Reporting Worksheet by the required deadline of forty five (45) days after the end of the federal fiscal year (November 15, 2022) to ensure with the program income policies in accordance with the UG for the year ended December 31, 2022. Cause & Context Lack of resources and detailed attention to the risks, along with circumvention of controls has resulted in weak internal controls, and conflicting or incomplete policies and procedures. Effect Non-compliance can lead to penalties, fines, or even termination of the contract. It may also damage CUAHSI’s future eligibility for federal funding and jeopardize CUAHSI’s ability to secure future grants or contracts from other funding agencies. Granting organizations typically prioritize funding recipients with a track record of compliance and accountability. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-009. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.307.View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-006 PROCUREMENT, SUSPENSION AND DEBARMENT Material Weakness Criteria The requirements for this compliance requirement are contained in 2 CFR sections 200.317- 200.326; 48 CFR parts 03, 15, 44, and the clauses at 48 CRF sections 52.244-2, 52.244-5, 52.203-13, 52.203-16 and 52.215-12; agency FAR supplements; 2 CFR part 180; OMB M-18- 18; and the terms and conditions of the federal award. There is a requirement to verify that contractors in covered transactions or any of its vendors are not federally debarred, suspended, or excluded. A covered transaction is a nonprocurement or procurement transaction in excess of $25,000 that is subject to the prohibitions noted in 2 CFR part 180. The covered transaction may be at the primary tier, between a federal agency and a person or a lower tier between a participant in a covered transaction and another person. Condition The auditor noted that CUAHSI failed to maintain and provide the proper records and support to document their review of vendor files for covered transactions. Such failure led to noncompliance with the procurement, suspension and debarment policies in accordance with the UG for the year ended December 31, 2022. CUAHSI did not complete the verification of its 2022 vendors until 2024. Based on our testing, no contractors in covered transactions were deemed to be federally debarred, suspended or excluded.Cause & Context CUAHSI has a policy in place to meet the procurement requirements but there was no evidence of compliance with that policy. Effect As a result of noncompliance, there could be possible repayment of funds and / or possible suspension or debarment. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-007. Recommendation CUAHSI should ensure that, to the extent practicable, the use of a competitive procurement process in compliance with 2 CFR section 200/317. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-005 SUBRECIPIENT MONITORING Material Weakness Criteria The regulations are documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h); (Requirements for Pass-Through Entities). The criteria for monitoring subrecipients of federal awards should be following federal regulations, the terms of the federal contract, and any additional requirements specified by the auditee's policies and procedures. Specifically, the monitoring criteria should include, but not be limited to, the following: • Subrecipient Risk Assessment • Financial Monitoring • Compliance Monitoring • Reporting and Documentation Condition The auditee failed to comply with federal regulations requiring the monitoring of subrecipients for federal awards on a timely basis. Recipients of federal awards are responsible for monitoring the activities of subrecipients to ensure that they comply with applicable laws, regulations, and the terms and conditions of the federal award. CUAHSI did not complete the monitoring of its 2022 subrecipients until 2024. During the year ended December 31, 2022, CUAHSI had $252,550 in amounts paid to subrecipients. Based on our testing of amounts paid to subrecipients, no amounts were identified as unallowable.Material Weakness Cause & Context CUAHSI had a policy and procedure manual in place which outlined the steps for monitoring. There was no audit evidence of CUAHSI following the policy and monitoring that the subrecipient was using the funding as prescribed during the year ended December 31, 2022. Effect CUAHSI’s lack of monitoring creates a significant risk of the possible misuse or improper use of funds. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-005. Recommendation The auditor recommends that management review the requirements documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h);(Requirements for Pass-Through Entities) and develops and implements procedures to adhere to such requirements. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-004 REPORTING - DCF Material Weakness Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (June 27, 2025) or nine months after CUAHSI’s year end (September 30, 2023). Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG.Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-004. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Material Weakness Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes.Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2021-002. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-007 CASH MANAGEMENT - FEDERAL DRAWDOWNS IN ADVANCE OF EXPENDITURES Material Weakness Criteria CFR § 200.305 Cash management: This section of the CFR outlines the requirements for the management of cash drawdowns and disbursements of federal funds. Federal funds should be disbursed in a timely manner for allowable costs that have been incurred. Cash advances must meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation. Condition CUAHSI did not meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation which details the requirements for advance fundings. During 2022, CUAHSI had advance drawdowns totaling $3,862,318 from the NSF. Of this amount, CUAHSI incurred $3,228,996 in eligible expenses for the year ended December 31, 2022. This resulted in $633,322 in excess federal advances as of year-end. The draw downs in excess of revenue recognized during the year ended December 31, 2022 are reported as part of advances payable in the accompanying Statement of Financial Position. Cause & Context CUAHSI initiated advance drawdowns without following the guidelines set forth by Chapter VIII.C.3 of the grant agreement.Effect Drawing down funds in advance of incurring eligible expenses could lead to non-compliance with federal regulations, such as those outlined in 2 CFR § 200.305. This may result in the need to repay the funds, potential financial penalties, or disqualification from future federal funding. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-008. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.35. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-008 PROGRAM INCOME Material Weakness Criteria Pursuant to 2 CFR 200 for award objectives and the regulations at 2 CFR 200.307, program income is defined as “Gross income earned by the recipient that is directly generated by a supported activity or earned as a result of the federal award during the period of performance” by 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards. Program income reporting is due forty five (45) days after the end of the federal fiscal year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. Condition Program income consists of registration fees collected for training, meetings or workshops and the proceeds from the sale of publications as a result of the federal award during the period of performance. Program income is treated as an additive to the federal funds received by CUAHSI. During a drawdown, program income reduces the amount that is requested to cover reimbursable costs through the Flexible Billing module. This allows program income to be applied to the award before a reimbursement is requested from NSF adding the value of program income received to the awarded amount. Program income reporting is due forty five (45) days after the end of the federal fiscal year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. CUAHSI program income totaled $12,605 for the year ended December 31, 2022.CUAHSI failed to submit the required Program Income Reporting Worksheet by the required deadline of forty five (45) days after the end of the federal fiscal year (November 15, 2022) to ensure with the program income policies in accordance with the UG for the year ended December 31, 2022. Cause & Context Lack of resources and detailed attention to the risks, along with circumvention of controls has resulted in weak internal controls, and conflicting or incomplete policies and procedures. Effect Non-compliance can lead to penalties, fines, or even termination of the contract. It may also damage CUAHSI’s future eligibility for federal funding and jeopardize CUAHSI’s ability to secure future grants or contracts from other funding agencies. Granting organizations typically prioritize funding recipients with a track record of compliance and accountability. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-009. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.307.View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-006 PROCUREMENT, SUSPENSION AND DEBARMENT Material Weakness Criteria The requirements for this compliance requirement are contained in 2 CFR sections 200.317- 200.326; 48 CFR parts 03, 15, 44, and the clauses at 48 CRF sections 52.244-2, 52.244-5, 52.203-13, 52.203-16 and 52.215-12; agency FAR supplements; 2 CFR part 180; OMB M-18- 18; and the terms and conditions of the federal award. There is a requirement to verify that contractors in covered transactions or any of its vendors are not federally debarred, suspended, or excluded. A covered transaction is a nonprocurement or procurement transaction in excess of $25,000 that is subject to the prohibitions noted in 2 CFR part 180. The covered transaction may be at the primary tier, between a federal agency and a person or a lower tier between a participant in a covered transaction and another person. Condition The auditor noted that CUAHSI failed to maintain and provide the proper records and support to document their review of vendor files for covered transactions. Such failure led to noncompliance with the procurement, suspension and debarment policies in accordance with the UG for the year ended December 31, 2022. CUAHSI did not complete the verification of its 2022 vendors until 2024. Based on our testing, no contractors in covered transactions were deemed to be federally debarred, suspended or excluded.Cause & Context CUAHSI has a policy in place to meet the procurement requirements but there was no evidence of compliance with that policy. Effect As a result of noncompliance, there could be possible repayment of funds and / or possible suspension or debarment. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-007. Recommendation CUAHSI should ensure that, to the extent practicable, the use of a competitive procurement process in compliance with 2 CFR section 200/317. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-005 SUBRECIPIENT MONITORING Material Weakness Criteria The regulations are documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h); (Requirements for Pass-Through Entities). The criteria for monitoring subrecipients of federal awards should be following federal regulations, the terms of the federal contract, and any additional requirements specified by the auditee's policies and procedures. Specifically, the monitoring criteria should include, but not be limited to, the following: • Subrecipient Risk Assessment • Financial Monitoring • Compliance Monitoring • Reporting and Documentation Condition The auditee failed to comply with federal regulations requiring the monitoring of subrecipients for federal awards on a timely basis. Recipients of federal awards are responsible for monitoring the activities of subrecipients to ensure that they comply with applicable laws, regulations, and the terms and conditions of the federal award. CUAHSI did not complete the monitoring of its 2022 subrecipients until 2024. During the year ended December 31, 2022, CUAHSI had $252,550 in amounts paid to subrecipients. Based on our testing of amounts paid to subrecipients, no amounts were identified as unallowable.Material Weakness Cause & Context CUAHSI had a policy and procedure manual in place which outlined the steps for monitoring. There was no audit evidence of CUAHSI following the policy and monitoring that the subrecipient was using the funding as prescribed during the year ended December 31, 2022. Effect CUAHSI’s lack of monitoring creates a significant risk of the possible misuse or improper use of funds. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-005. Recommendation The auditor recommends that management review the requirements documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h);(Requirements for Pass-Through Entities) and develops and implements procedures to adhere to such requirements. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-004 REPORTING - DCF Material Weakness Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (June 27, 2025) or nine months after CUAHSI’s year end (September 30, 2023). Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG.Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-004. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Material Weakness Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes.Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2021-002. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-007 CASH MANAGEMENT - FEDERAL DRAWDOWNS IN ADVANCE OF EXPENDITURES Material Weakness Criteria CFR § 200.305 Cash management: This section of the CFR outlines the requirements for the management of cash drawdowns and disbursements of federal funds. Federal funds should be disbursed in a timely manner for allowable costs that have been incurred. Cash advances must meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation. Condition CUAHSI did not meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation which details the requirements for advance fundings. During 2022, CUAHSI had advance drawdowns totaling $3,862,318 from the NSF. Of this amount, CUAHSI incurred $3,228,996 in eligible expenses for the year ended December 31, 2022. This resulted in $633,322 in excess federal advances as of year-end. The draw downs in excess of revenue recognized during the year ended December 31, 2022 are reported as part of advances payable in the accompanying Statement of Financial Position. Cause & Context CUAHSI initiated advance drawdowns without following the guidelines set forth by Chapter VIII.C.3 of the grant agreement.Effect Drawing down funds in advance of incurring eligible expenses could lead to non-compliance with federal regulations, such as those outlined in 2 CFR § 200.305. This may result in the need to repay the funds, potential financial penalties, or disqualification from future federal funding. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-008. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.35. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-008 PROGRAM INCOME Material Weakness Criteria Pursuant to 2 CFR 200 for award objectives and the regulations at 2 CFR 200.307, program income is defined as “Gross income earned by the recipient that is directly generated by a supported activity or earned as a result of the federal award during the period of performance” by 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards. Program income reporting is due forty five (45) days after the end of the federal fiscal year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. Condition Program income consists of registration fees collected for training, meetings or workshops and the proceeds from the sale of publications as a result of the federal award during the period of performance. Program income is treated as an additive to the federal funds received by CUAHSI. During a drawdown, program income reduces the amount that is requested to cover reimbursable costs through the Flexible Billing module. This allows program income to be applied to the award before a reimbursement is requested from NSF adding the value of program income received to the awarded amount. Program income reporting is due forty five (45) days after the end of the federal fiscal year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. CUAHSI program income totaled $12,605 for the year ended December 31, 2022.CUAHSI failed to submit the required Program Income Reporting Worksheet by the required deadline of forty five (45) days after the end of the federal fiscal year (November 15, 2022) to ensure with the program income policies in accordance with the UG for the year ended December 31, 2022. Cause & Context Lack of resources and detailed attention to the risks, along with circumvention of controls has resulted in weak internal controls, and conflicting or incomplete policies and procedures. Effect Non-compliance can lead to penalties, fines, or even termination of the contract. It may also damage CUAHSI’s future eligibility for federal funding and jeopardize CUAHSI’s ability to secure future grants or contracts from other funding agencies. Granting organizations typically prioritize funding recipients with a track record of compliance and accountability. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-009. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.307.View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-006 PROCUREMENT, SUSPENSION AND DEBARMENT Material Weakness Criteria The requirements for this compliance requirement are contained in 2 CFR sections 200.317- 200.326; 48 CFR parts 03, 15, 44, and the clauses at 48 CRF sections 52.244-2, 52.244-5, 52.203-13, 52.203-16 and 52.215-12; agency FAR supplements; 2 CFR part 180; OMB M-18- 18; and the terms and conditions of the federal award. There is a requirement to verify that contractors in covered transactions or any of its vendors are not federally debarred, suspended, or excluded. A covered transaction is a nonprocurement or procurement transaction in excess of $25,000 that is subject to the prohibitions noted in 2 CFR part 180. The covered transaction may be at the primary tier, between a federal agency and a person or a lower tier between a participant in a covered transaction and another person. Condition The auditor noted that CUAHSI failed to maintain and provide the proper records and support to document their review of vendor files for covered transactions. Such failure led to noncompliance with the procurement, suspension and debarment policies in accordance with the UG for the year ended December 31, 2022. CUAHSI did not complete the verification of its 2022 vendors until 2024. Based on our testing, no contractors in covered transactions were deemed to be federally debarred, suspended or excluded.Cause & Context CUAHSI has a policy in place to meet the procurement requirements but there was no evidence of compliance with that policy. Effect As a result of noncompliance, there could be possible repayment of funds and / or possible suspension or debarment. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-007. Recommendation CUAHSI should ensure that, to the extent practicable, the use of a competitive procurement process in compliance with 2 CFR section 200/317. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-005 SUBRECIPIENT MONITORING Material Weakness Criteria The regulations are documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h); (Requirements for Pass-Through Entities). The criteria for monitoring subrecipients of federal awards should be following federal regulations, the terms of the federal contract, and any additional requirements specified by the auditee's policies and procedures. Specifically, the monitoring criteria should include, but not be limited to, the following: • Subrecipient Risk Assessment • Financial Monitoring • Compliance Monitoring • Reporting and Documentation Condition The auditee failed to comply with federal regulations requiring the monitoring of subrecipients for federal awards on a timely basis. Recipients of federal awards are responsible for monitoring the activities of subrecipients to ensure that they comply with applicable laws, regulations, and the terms and conditions of the federal award. CUAHSI did not complete the monitoring of its 2022 subrecipients until 2024. During the year ended December 31, 2022, CUAHSI had $252,550 in amounts paid to subrecipients. Based on our testing of amounts paid to subrecipients, no amounts were identified as unallowable.Material Weakness Cause & Context CUAHSI had a policy and procedure manual in place which outlined the steps for monitoring. There was no audit evidence of CUAHSI following the policy and monitoring that the subrecipient was using the funding as prescribed during the year ended December 31, 2022. Effect CUAHSI’s lack of monitoring creates a significant risk of the possible misuse or improper use of funds. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-005. Recommendation The auditor recommends that management review the requirements documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h);(Requirements for Pass-Through Entities) and develops and implements procedures to adhere to such requirements. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-004 REPORTING - DCF Material Weakness Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (June 27, 2025) or nine months after CUAHSI’s year end (September 30, 2023). Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG.Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-004. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Material Weakness Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes.Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2021-002. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-007 CASH MANAGEMENT - FEDERAL DRAWDOWNS IN ADVANCE OF EXPENDITURES Material Weakness Criteria CFR § 200.305 Cash management: This section of the CFR outlines the requirements for the management of cash drawdowns and disbursements of federal funds. Federal funds should be disbursed in a timely manner for allowable costs that have been incurred. Cash advances must meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation. Condition CUAHSI did not meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation which details the requirements for advance fundings. During 2022, CUAHSI had advance drawdowns totaling $3,862,318 from the NSF. Of this amount, CUAHSI incurred $3,228,996 in eligible expenses for the year ended December 31, 2022. This resulted in $633,322 in excess federal advances as of year-end. The draw downs in excess of revenue recognized during the year ended December 31, 2022 are reported as part of advances payable in the accompanying Statement of Financial Position. Cause & Context CUAHSI initiated advance drawdowns without following the guidelines set forth by Chapter VIII.C.3 of the grant agreement.Effect Drawing down funds in advance of incurring eligible expenses could lead to non-compliance with federal regulations, such as those outlined in 2 CFR § 200.305. This may result in the need to repay the funds, potential financial penalties, or disqualification from future federal funding. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-008. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.35. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-004 REPORTING - DCF Material Weakness Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (June 27, 2025) or nine months after CUAHSI’s year end (September 30, 2023). Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG.Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-004. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Material Weakness Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes.Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2021-002. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-008 PROGRAM INCOME Material Weakness Criteria Pursuant to 2 CFR 200 for award objectives and the regulations at 2 CFR 200.307, program income is defined as “Gross income earned by the recipient that is directly generated by a supported activity or earned as a result of the federal award during the period of performance” by 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards. Program income reporting is due forty five (45) days after the end of the federal fiscal year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. Condition Program income consists of registration fees collected for training, meetings or workshops and the proceeds from the sale of publications as a result of the federal award during the period of performance. Program income is treated as an additive to the federal funds received by CUAHSI. During a drawdown, program income reduces the amount that is requested to cover reimbursable costs through the Flexible Billing module. This allows program income to be applied to the award before a reimbursement is requested from NSF adding the value of program income received to the awarded amount. Program income reporting is due forty five (45) days after the end of the federal fiscal year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. CUAHSI program income totaled $12,605 for the year ended December 31, 2022.CUAHSI failed to submit the required Program Income Reporting Worksheet by the required deadline of forty five (45) days after the end of the federal fiscal year (November 15, 2022) to ensure with the program income policies in accordance with the UG for the year ended December 31, 2022. Cause & Context Lack of resources and detailed attention to the risks, along with circumvention of controls has resulted in weak internal controls, and conflicting or incomplete policies and procedures. Effect Non-compliance can lead to penalties, fines, or even termination of the contract. It may also damage CUAHSI’s future eligibility for federal funding and jeopardize CUAHSI’s ability to secure future grants or contracts from other funding agencies. Granting organizations typically prioritize funding recipients with a track record of compliance and accountability. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-009. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.307.View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-006 PROCUREMENT, SUSPENSION AND DEBARMENT Material Weakness Criteria The requirements for this compliance requirement are contained in 2 CFR sections 200.317- 200.326; 48 CFR parts 03, 15, 44, and the clauses at 48 CRF sections 52.244-2, 52.244-5, 52.203-13, 52.203-16 and 52.215-12; agency FAR supplements; 2 CFR part 180; OMB M-18- 18; and the terms and conditions of the federal award. There is a requirement to verify that contractors in covered transactions or any of its vendors are not federally debarred, suspended, or excluded. A covered transaction is a nonprocurement or procurement transaction in excess of $25,000 that is subject to the prohibitions noted in 2 CFR part 180. The covered transaction may be at the primary tier, between a federal agency and a person or a lower tier between a participant in a covered transaction and another person. Condition The auditor noted that CUAHSI failed to maintain and provide the proper records and support to document their review of vendor files for covered transactions. Such failure led to noncompliance with the procurement, suspension and debarment policies in accordance with the UG for the year ended December 31, 2022. CUAHSI did not complete the verification of its 2022 vendors until 2024. Based on our testing, no contractors in covered transactions were deemed to be federally debarred, suspended or excluded.Cause & Context CUAHSI has a policy in place to meet the procurement requirements but there was no evidence of compliance with that policy. Effect As a result of noncompliance, there could be possible repayment of funds and / or possible suspension or debarment. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-007. Recommendation CUAHSI should ensure that, to the extent practicable, the use of a competitive procurement process in compliance with 2 CFR section 200/317. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-005 SUBRECIPIENT MONITORING Material Weakness Criteria The regulations are documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h); (Requirements for Pass-Through Entities). The criteria for monitoring subrecipients of federal awards should be following federal regulations, the terms of the federal contract, and any additional requirements specified by the auditee's policies and procedures. Specifically, the monitoring criteria should include, but not be limited to, the following: • Subrecipient Risk Assessment • Financial Monitoring • Compliance Monitoring • Reporting and Documentation Condition The auditee failed to comply with federal regulations requiring the monitoring of subrecipients for federal awards on a timely basis. Recipients of federal awards are responsible for monitoring the activities of subrecipients to ensure that they comply with applicable laws, regulations, and the terms and conditions of the federal award. CUAHSI did not complete the monitoring of its 2022 subrecipients until 2024. During the year ended December 31, 2022, CUAHSI had $252,550 in amounts paid to subrecipients. Based on our testing of amounts paid to subrecipients, no amounts were identified as unallowable.Material Weakness Cause & Context CUAHSI had a policy and procedure manual in place which outlined the steps for monitoring. There was no audit evidence of CUAHSI following the policy and monitoring that the subrecipient was using the funding as prescribed during the year ended December 31, 2022. Effect CUAHSI’s lack of monitoring creates a significant risk of the possible misuse or improper use of funds. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-005. Recommendation The auditor recommends that management review the requirements documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h);(Requirements for Pass-Through Entities) and develops and implements procedures to adhere to such requirements. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-004 REPORTING - DCF Material Weakness Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (June 27, 2025) or nine months after CUAHSI’s year end (September 30, 2023). Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG.Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-004. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Material Weakness Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes.Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2021-002. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-007 CASH MANAGEMENT - FEDERAL DRAWDOWNS IN ADVANCE OF EXPENDITURES Material Weakness Criteria CFR § 200.305 Cash management: This section of the CFR outlines the requirements for the management of cash drawdowns and disbursements of federal funds. Federal funds should be disbursed in a timely manner for allowable costs that have been incurred. Cash advances must meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation. Condition CUAHSI did not meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation which details the requirements for advance fundings. During 2022, CUAHSI had advance drawdowns totaling $3,862,318 from the NSF. Of this amount, CUAHSI incurred $3,228,996 in eligible expenses for the year ended December 31, 2022. This resulted in $633,322 in excess federal advances as of year-end. The draw downs in excess of revenue recognized during the year ended December 31, 2022 are reported as part of advances payable in the accompanying Statement of Financial Position. Cause & Context CUAHSI initiated advance drawdowns without following the guidelines set forth by Chapter VIII.C.3 of the grant agreement.Effect Drawing down funds in advance of incurring eligible expenses could lead to non-compliance with federal regulations, such as those outlined in 2 CFR § 200.305. This may result in the need to repay the funds, potential financial penalties, or disqualification from future federal funding. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-008. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.35. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-008 PROGRAM INCOME Material Weakness Criteria Pursuant to 2 CFR 200 for award objectives and the regulations at 2 CFR 200.307, program income is defined as “Gross income earned by the recipient that is directly generated by a supported activity or earned as a result of the federal award during the period of performance” by 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards. Program income reporting is due forty five (45) days after the end of the federal fiscal year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. Condition Program income consists of registration fees collected for training, meetings or workshops and the proceeds from the sale of publications as a result of the federal award during the period of performance. Program income is treated as an additive to the federal funds received by CUAHSI. During a drawdown, program income reduces the amount that is requested to cover reimbursable costs through the Flexible Billing module. This allows program income to be applied to the award before a reimbursement is requested from NSF adding the value of program income received to the awarded amount. Program income reporting is due forty five (45) days after the end of the federal fiscal year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. CUAHSI program income totaled $12,605 for the year ended December 31, 2022.CUAHSI failed to submit the required Program Income Reporting Worksheet by the required deadline of forty five (45) days after the end of the federal fiscal year (November 15, 2022) to ensure with the program income policies in accordance with the UG for the year ended December 31, 2022. Cause & Context Lack of resources and detailed attention to the risks, along with circumvention of controls has resulted in weak internal controls, and conflicting or incomplete policies and procedures. Effect Non-compliance can lead to penalties, fines, or even termination of the contract. It may also damage CUAHSI’s future eligibility for federal funding and jeopardize CUAHSI’s ability to secure future grants or contracts from other funding agencies. Granting organizations typically prioritize funding recipients with a track record of compliance and accountability. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-009. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.307.View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-006 PROCUREMENT, SUSPENSION AND DEBARMENT Material Weakness Criteria The requirements for this compliance requirement are contained in 2 CFR sections 200.317- 200.326; 48 CFR parts 03, 15, 44, and the clauses at 48 CRF sections 52.244-2, 52.244-5, 52.203-13, 52.203-16 and 52.215-12; agency FAR supplements; 2 CFR part 180; OMB M-18- 18; and the terms and conditions of the federal award. There is a requirement to verify that contractors in covered transactions or any of its vendors are not federally debarred, suspended, or excluded. A covered transaction is a nonprocurement or procurement transaction in excess of $25,000 that is subject to the prohibitions noted in 2 CFR part 180. The covered transaction may be at the primary tier, between a federal agency and a person or a lower tier between a participant in a covered transaction and another person. Condition The auditor noted that CUAHSI failed to maintain and provide the proper records and support to document their review of vendor files for covered transactions. Such failure led to noncompliance with the procurement, suspension and debarment policies in accordance with the UG for the year ended December 31, 2022. CUAHSI did not complete the verification of its 2022 vendors until 2024. Based on our testing, no contractors in covered transactions were deemed to be federally debarred, suspended or excluded.Cause & Context CUAHSI has a policy in place to meet the procurement requirements but there was no evidence of compliance with that policy. Effect As a result of noncompliance, there could be possible repayment of funds and / or possible suspension or debarment. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-007. Recommendation CUAHSI should ensure that, to the extent practicable, the use of a competitive procurement process in compliance with 2 CFR section 200/317. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-005 SUBRECIPIENT MONITORING Material Weakness Criteria The regulations are documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h); (Requirements for Pass-Through Entities). The criteria for monitoring subrecipients of federal awards should be following federal regulations, the terms of the federal contract, and any additional requirements specified by the auditee's policies and procedures. Specifically, the monitoring criteria should include, but not be limited to, the following: • Subrecipient Risk Assessment • Financial Monitoring • Compliance Monitoring • Reporting and Documentation Condition The auditee failed to comply with federal regulations requiring the monitoring of subrecipients for federal awards on a timely basis. Recipients of federal awards are responsible for monitoring the activities of subrecipients to ensure that they comply with applicable laws, regulations, and the terms and conditions of the federal award. CUAHSI did not complete the monitoring of its 2022 subrecipients until 2024. During the year ended December 31, 2022, CUAHSI had $252,550 in amounts paid to subrecipients. Based on our testing of amounts paid to subrecipients, no amounts were identified as unallowable.Material Weakness Cause & Context CUAHSI had a policy and procedure manual in place which outlined the steps for monitoring. There was no audit evidence of CUAHSI following the policy and monitoring that the subrecipient was using the funding as prescribed during the year ended December 31, 2022. Effect CUAHSI’s lack of monitoring creates a significant risk of the possible misuse or improper use of funds. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-005. Recommendation The auditor recommends that management review the requirements documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h);(Requirements for Pass-Through Entities) and develops and implements procedures to adhere to such requirements. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-004 REPORTING - DCF Material Weakness Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (June 27, 2025) or nine months after CUAHSI’s year end (September 30, 2023). Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG.Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-004. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Material Weakness Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes.Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2021-002. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-007 CASH MANAGEMENT - FEDERAL DRAWDOWNS IN ADVANCE OF EXPENDITURES Material Weakness Criteria CFR § 200.305 Cash management: This section of the CFR outlines the requirements for the management of cash drawdowns and disbursements of federal funds. Federal funds should be disbursed in a timely manner for allowable costs that have been incurred. Cash advances must meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation. Condition CUAHSI did not meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation which details the requirements for advance fundings. During 2022, CUAHSI had advance drawdowns totaling $3,862,318 from the NSF. Of this amount, CUAHSI incurred $3,228,996 in eligible expenses for the year ended December 31, 2022. This resulted in $633,322 in excess federal advances as of year-end. The draw downs in excess of revenue recognized during the year ended December 31, 2022 are reported as part of advances payable in the accompanying Statement of Financial Position. Cause & Context CUAHSI initiated advance drawdowns without following the guidelines set forth by Chapter VIII.C.3 of the grant agreement.Effect Drawing down funds in advance of incurring eligible expenses could lead to non-compliance with federal regulations, such as those outlined in 2 CFR § 200.305. This may result in the need to repay the funds, potential financial penalties, or disqualification from future federal funding. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-008. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.35. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-008 PROGRAM INCOME Material Weakness Criteria Pursuant to 2 CFR 200 for award objectives and the regulations at 2 CFR 200.307, program income is defined as “Gross income earned by the recipient that is directly generated by a supported activity or earned as a result of the federal award during the period of performance” by 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards. Program income reporting is due forty five (45) days after the end of the federal fiscal year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. Condition Program income consists of registration fees collected for training, meetings or workshops and the proceeds from the sale of publications as a result of the federal award during the period of performance. Program income is treated as an additive to the federal funds received by CUAHSI. During a drawdown, program income reduces the amount that is requested to cover reimbursable costs through the Flexible Billing module. This allows program income to be applied to the award before a reimbursement is requested from NSF adding the value of program income received to the awarded amount. Program income reporting is due forty five (45) days after the end of the federal fiscal year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. CUAHSI program income totaled $12,605 for the year ended December 31, 2022.CUAHSI failed to submit the required Program Income Reporting Worksheet by the required deadline of forty five (45) days after the end of the federal fiscal year (November 15, 2022) to ensure with the program income policies in accordance with the UG for the year ended December 31, 2022. Cause & Context Lack of resources and detailed attention to the risks, along with circumvention of controls has resulted in weak internal controls, and conflicting or incomplete policies and procedures. Effect Non-compliance can lead to penalties, fines, or even termination of the contract. It may also damage CUAHSI’s future eligibility for federal funding and jeopardize CUAHSI’s ability to secure future grants or contracts from other funding agencies. Granting organizations typically prioritize funding recipients with a track record of compliance and accountability. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-009. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.307.View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-006 PROCUREMENT, SUSPENSION AND DEBARMENT Material Weakness Criteria The requirements for this compliance requirement are contained in 2 CFR sections 200.317- 200.326; 48 CFR parts 03, 15, 44, and the clauses at 48 CRF sections 52.244-2, 52.244-5, 52.203-13, 52.203-16 and 52.215-12; agency FAR supplements; 2 CFR part 180; OMB M-18- 18; and the terms and conditions of the federal award. There is a requirement to verify that contractors in covered transactions or any of its vendors are not federally debarred, suspended, or excluded. A covered transaction is a nonprocurement or procurement transaction in excess of $25,000 that is subject to the prohibitions noted in 2 CFR part 180. The covered transaction may be at the primary tier, between a federal agency and a person or a lower tier between a participant in a covered transaction and another person. Condition The auditor noted that CUAHSI failed to maintain and provide the proper records and support to document their review of vendor files for covered transactions. Such failure led to noncompliance with the procurement, suspension and debarment policies in accordance with the UG for the year ended December 31, 2022. CUAHSI did not complete the verification of its 2022 vendors until 2024. Based on our testing, no contractors in covered transactions were deemed to be federally debarred, suspended or excluded.Cause & Context CUAHSI has a policy in place to meet the procurement requirements but there was no evidence of compliance with that policy. Effect As a result of noncompliance, there could be possible repayment of funds and / or possible suspension or debarment. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-007. Recommendation CUAHSI should ensure that, to the extent practicable, the use of a competitive procurement process in compliance with 2 CFR section 200/317. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-005 SUBRECIPIENT MONITORING Material Weakness Criteria The regulations are documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h); (Requirements for Pass-Through Entities). The criteria for monitoring subrecipients of federal awards should be following federal regulations, the terms of the federal contract, and any additional requirements specified by the auditee's policies and procedures. Specifically, the monitoring criteria should include, but not be limited to, the following: • Subrecipient Risk Assessment • Financial Monitoring • Compliance Monitoring • Reporting and Documentation Condition The auditee failed to comply with federal regulations requiring the monitoring of subrecipients for federal awards on a timely basis. Recipients of federal awards are responsible for monitoring the activities of subrecipients to ensure that they comply with applicable laws, regulations, and the terms and conditions of the federal award. CUAHSI did not complete the monitoring of its 2022 subrecipients until 2024. During the year ended December 31, 2022, CUAHSI had $252,550 in amounts paid to subrecipients. Based on our testing of amounts paid to subrecipients, no amounts were identified as unallowable.Material Weakness Cause & Context CUAHSI had a policy and procedure manual in place which outlined the steps for monitoring. There was no audit evidence of CUAHSI following the policy and monitoring that the subrecipient was using the funding as prescribed during the year ended December 31, 2022. Effect CUAHSI’s lack of monitoring creates a significant risk of the possible misuse or improper use of funds. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-005. Recommendation The auditor recommends that management review the requirements documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h);(Requirements for Pass-Through Entities) and develops and implements procedures to adhere to such requirements. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-004 REPORTING - DCF Material Weakness Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (June 27, 2025) or nine months after CUAHSI’s year end (September 30, 2023). Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG.Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-004. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Material Weakness Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes.Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2021-002. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-007 CASH MANAGEMENT - FEDERAL DRAWDOWNS IN ADVANCE OF EXPENDITURES Material Weakness Criteria CFR § 200.305 Cash management: This section of the CFR outlines the requirements for the management of cash drawdowns and disbursements of federal funds. Federal funds should be disbursed in a timely manner for allowable costs that have been incurred. Cash advances must meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation. Condition CUAHSI did not meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation which details the requirements for advance fundings. During 2022, CUAHSI had advance drawdowns totaling $3,862,318 from the NSF. Of this amount, CUAHSI incurred $3,228,996 in eligible expenses for the year ended December 31, 2022. This resulted in $633,322 in excess federal advances as of year-end. The draw downs in excess of revenue recognized during the year ended December 31, 2022 are reported as part of advances payable in the accompanying Statement of Financial Position. Cause & Context CUAHSI initiated advance drawdowns without following the guidelines set forth by Chapter VIII.C.3 of the grant agreement.Effect Drawing down funds in advance of incurring eligible expenses could lead to non-compliance with federal regulations, such as those outlined in 2 CFR § 200.305. This may result in the need to repay the funds, potential financial penalties, or disqualification from future federal funding. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-008. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.35. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-008 PROGRAM INCOME Material Weakness Criteria Pursuant to 2 CFR 200 for award objectives and the regulations at 2 CFR 200.307, program income is defined as “Gross income earned by the recipient that is directly generated by a supported activity or earned as a result of the federal award during the period of performance” by 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards. Program income reporting is due forty five (45) days after the end of the federal fiscal year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. Condition Program income consists of registration fees collected for training, meetings or workshops and the proceeds from the sale of publications as a result of the federal award during the period of performance. Program income is treated as an additive to the federal funds received by CUAHSI. During a drawdown, program income reduces the amount that is requested to cover reimbursable costs through the Flexible Billing module. This allows program income to be applied to the award before a reimbursement is requested from NSF adding the value of program income received to the awarded amount. Program income reporting is due forty five (45) days after the end of the federal fiscal year. NSF requires that all cumulative program income is reported for all open grants and agreements in the current year. CUAHSI program income totaled $12,605 for the year ended December 31, 2022.CUAHSI failed to submit the required Program Income Reporting Worksheet by the required deadline of forty five (45) days after the end of the federal fiscal year (November 15, 2022) to ensure with the program income policies in accordance with the UG for the year ended December 31, 2022. Cause & Context Lack of resources and detailed attention to the risks, along with circumvention of controls has resulted in weak internal controls, and conflicting or incomplete policies and procedures. Effect Non-compliance can lead to penalties, fines, or even termination of the contract. It may also damage CUAHSI’s future eligibility for federal funding and jeopardize CUAHSI’s ability to secure future grants or contracts from other funding agencies. Granting organizations typically prioritize funding recipients with a track record of compliance and accountability. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-009. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.307.View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-006 PROCUREMENT, SUSPENSION AND DEBARMENT Material Weakness Criteria The requirements for this compliance requirement are contained in 2 CFR sections 200.317- 200.326; 48 CFR parts 03, 15, 44, and the clauses at 48 CRF sections 52.244-2, 52.244-5, 52.203-13, 52.203-16 and 52.215-12; agency FAR supplements; 2 CFR part 180; OMB M-18- 18; and the terms and conditions of the federal award. There is a requirement to verify that contractors in covered transactions or any of its vendors are not federally debarred, suspended, or excluded. A covered transaction is a nonprocurement or procurement transaction in excess of $25,000 that is subject to the prohibitions noted in 2 CFR part 180. The covered transaction may be at the primary tier, between a federal agency and a person or a lower tier between a participant in a covered transaction and another person. Condition The auditor noted that CUAHSI failed to maintain and provide the proper records and support to document their review of vendor files for covered transactions. Such failure led to noncompliance with the procurement, suspension and debarment policies in accordance with the UG for the year ended December 31, 2022. CUAHSI did not complete the verification of its 2022 vendors until 2024. Based on our testing, no contractors in covered transactions were deemed to be federally debarred, suspended or excluded.Cause & Context CUAHSI has a policy in place to meet the procurement requirements but there was no evidence of compliance with that policy. Effect As a result of noncompliance, there could be possible repayment of funds and / or possible suspension or debarment. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-007. Recommendation CUAHSI should ensure that, to the extent practicable, the use of a competitive procurement process in compliance with 2 CFR section 200/317. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-005 SUBRECIPIENT MONITORING Material Weakness Criteria The regulations are documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h); (Requirements for Pass-Through Entities). The criteria for monitoring subrecipients of federal awards should be following federal regulations, the terms of the federal contract, and any additional requirements specified by the auditee's policies and procedures. Specifically, the monitoring criteria should include, but not be limited to, the following: • Subrecipient Risk Assessment • Financial Monitoring • Compliance Monitoring • Reporting and Documentation Condition The auditee failed to comply with federal regulations requiring the monitoring of subrecipients for federal awards on a timely basis. Recipients of federal awards are responsible for monitoring the activities of subrecipients to ensure that they comply with applicable laws, regulations, and the terms and conditions of the federal award. CUAHSI did not complete the monitoring of its 2022 subrecipients until 2024. During the year ended December 31, 2022, CUAHSI had $252,550 in amounts paid to subrecipients. Based on our testing of amounts paid to subrecipients, no amounts were identified as unallowable.Material Weakness Cause & Context CUAHSI had a policy and procedure manual in place which outlined the steps for monitoring. There was no audit evidence of CUAHSI following the policy and monitoring that the subrecipient was using the funding as prescribed during the year ended December 31, 2022. Effect CUAHSI’s lack of monitoring creates a significant risk of the possible misuse or improper use of funds. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-005. Recommendation The auditor recommends that management review the requirements documented in 31 USC 7502(f)(2), 2 CFR sections 200.330, .331, and .501(h);(Requirements for Pass-Through Entities) and develops and implements procedures to adhere to such requirements. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-004 REPORTING - DCF Material Weakness Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (June 27, 2025) or nine months after CUAHSI’s year end (September 30, 2023). Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG.Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-004. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Material Weakness Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes.Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2021-002. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation Federal program title: Geosciences, Computer and Information Science and Engineering & Office of Cyber Infrastructure AL No.: 47.050, 47.070, 47.079 & 47.080 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023) & OAC-1664061 (10/01/17 – 09/30/2022) Pass Through Entity: Utah State University MW2022-007 CASH MANAGEMENT - FEDERAL DRAWDOWNS IN ADVANCE OF EXPENDITURES Material Weakness Criteria CFR § 200.305 Cash management: This section of the CFR outlines the requirements for the management of cash drawdowns and disbursements of federal funds. Federal funds should be disbursed in a timely manner for allowable costs that have been incurred. Cash advances must meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation. Condition CUAHSI did not meet the conditions specified in Chapter VIII.C.3 of the grant agreement with the National Science Foundation which details the requirements for advance fundings. During 2022, CUAHSI had advance drawdowns totaling $3,862,318 from the NSF. Of this amount, CUAHSI incurred $3,228,996 in eligible expenses for the year ended December 31, 2022. This resulted in $633,322 in excess federal advances as of year-end. The draw downs in excess of revenue recognized during the year ended December 31, 2022 are reported as part of advances payable in the accompanying Statement of Financial Position. Cause & Context CUAHSI initiated advance drawdowns without following the guidelines set forth by Chapter VIII.C.3 of the grant agreement.Effect Drawing down funds in advance of incurring eligible expenses could lead to non-compliance with federal regulations, such as those outlined in 2 CFR § 200.305. This may result in the need to repay the funds, potential financial penalties, or disqualification from future federal funding. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-008. Recommendation The auditor recommends that CUAHSI develops and implements controls over policies consistent with 2 CFR 200.35. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-004 REPORTING - DCF Material Weakness Criteria 2 CFR Section 200.512(a) requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of thirty calendar days after the reports are received from the auditor or nine months after the end of the audit period. Condition Due to the delay in financial close of CUAHSI’s books and records, a federal single audit for fiscal year 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The UG requires the reporting package and DCF to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor (June 27, 2025) or nine months after CUAHSI’s year end (September 30, 2023). Cause & Context CUAHSI did not have effective controls in place to allow for a timely year-end closing. This caused significant auditor delays which resulted in CUAHSI’s inability to meet the filing requirements under the UG.Effect CUAHSI is not in compliance with 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Questioned Costs None Prior Year Audit Finding Yes, previously reported as MW2021-004. Recommendation Management should implement policies to ensure timely financial reporting and ensure the timely completion of an audit. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.

Federal agency name: U.S. National Science Foundation and U.S. Department of Commerce Federal program title: Geosciences, Computer and Information Science and Engineering, Office of Cyber Infrastructure & NOAA – Cooperative Institute AL No.: 47.050, 47.070, 47.079, 47.080 & 11.432 Federal Award Identification No. & Award Period: EAR-1849458 (06/01/2019 -05/31/2024), EAR-2012893 (10/01/2020 – 08/31/2025), OAC-1931278 (10/1/2019 – 09/30/2022), OAC- 1829744 (09/01/2018 – 08/31/2023), OAC-1835592 (01/01/2009 – 12/31/2022), OAC-1835818 (10/01/2018 – 09/30/2022), OAC-2103780 (10/01/2021 – 09/30/2026), OAC-2118329 (10/01/2021 – 09/30/2026),OISE-1855654 (05/15/2019 – 12/31/2023), OAC-1664061 (10/01/17 – 09/30/2022) & A22NWS4320003 (08/01/2022 – 7/25/2025) Pass Through Entity: Utah State University & University of Alabama MW2022-002 ACCURACY AND COMPLETENESS OF SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (“SEFA”) Material Weakness Criteria CUAHSI is required to prepare a SEFA in accordance with the prescribed guidelines of the Uniform Guidance (“UG”). In addition, 2 CFR Section 200.512(a) of the Uniform Guidance requires the reporting package and Data Collection Form (“DCF”) to be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditor or nine months after CUAHSI’s year end. Condition CUAHSI provided two different versions of the SEFA to the auditor during the audit process. Additionally, due to the delay in financial close of CUAHSI’s books and records, a federal single audit for the year ended December 31, 2022 was not performed in a timely manner and the DCF was not submitted by its due date of September 30, 2023. The inaccurate reporting of grants and related activity in the SEFA can lead to improper identification of major programs causing inadequate testing by the auditor as required by UG. As a result of the audit procedures performed and proposed adjustments to CUAHSI’s preliminary SEFA by the audit, management was able to make the required changes.Cause & Context Due personnel and staffing issues, CUAHSI was not able to complete the financial close process in a timely manner which led to the changes in qualified expenditures and delay in the financial statement and the federal single audit being completed. Effect Failure to comply with federal regulations and reporting requirements exposes CUAHSI to potential legal and regulatory consequences, including the risk of future funding loss and financial penalties. Questioned Costs None Prior Year Audit Finding Yes - previously reported as MW2021-002. Recommendation To address the identified deficiencies and improve controls over the preparation of the SEFA, the auditor recommends the development and documentation of procedures for tracking federal awards and related disbursements to subrecipients. View of Responsible Official and Planned Corrective Action See accompanying Corrective Action Plan.