Audit 362742

Program: Community Development Block Grant (CDBG) ALN #: 14.218 Pass-through Entity: N/A- Direct Award Federal Agency: Department of Housing and Urban Development Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Performance Reporting Type of finding: Material weakness and noncompliance Criteria Special Reporting for Federal Funding Accountability and Transparency Act Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No.109-282), as amended by Section 6202 of Public Law 110-252, herein referred to as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Aspects of the Transparency Act that relate to subaward reporting (1) under grants and cooperative agreements were implemented in OMB in 2 CFR Part 170 and (2) under contracts, by the regulatory agencies responsible for the Federal Acquisition Regulation (FAR at 5 FR 39414 et seq., July 8, 2010). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Title 2 US Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, section 200.1 defines subaward as an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract. Further, 2 CFR 200.1 defines subrecipient as a nonfederal entity that receives a subaward from a passthrough entity to carry out part of a federal program but does not include an individual that is a beneficiary of such program. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City’s Community Development Department (CDBG) did not report awards granted to subrecipients for the CDBG program by the end of the month following the month in which the City awarded the subrecipient award. FFATA requires the City to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee DUNS/UEI number 3. Amount of subaward 4. Subaward obligation/action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that the City did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. Cause The condition found was due to the City not reporting amounts passed through to subrecipients for the period from July 2023 to June 2024, as the City typically reports these on a one-year lag due to the timing of when the contract starts and its final execution. Proper perspective During our testing of the three selected subawards, we noted reporting exceptions as subawards were not reported within the one month following the month that the City awarded the subrecipient contract. Additionally, there was a control exception to ensure that the data submitted is complete and accurate. Possible asserted effect Failure to submit subaward amounts passed through to subrecipients and subcontractors under subawards as defined by 2 CFR 200.1 in the City’s FFATA reporting could result in the City reporting inaccurate and incomplete amounts to the federal government. Questioned costs None noted Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding A similar finding was not reported in the prior year. Recommendation We recommend that the City review and enhance its policies, procedures, and internal controls to ensure that all amounts passed through to subrecipients under subawards, as defined in 2 CFR 200.1 are reported in accordance with the FFATA federal regulations. In addition, we recommend that the City use obligation date for FFATA reporting. Views of responsible officials and corrective actions The City has taken several steps to strengthen its FFATA compliance. Historically, FFATA reporting posed challenges for many recipients, including the City, due to legacy reporting systems that did not fully align with the requirements of SAM.gov. As part of its compliance improvement efforts, the City has transitioned to directly reporting subaward data in SAM.gov. This shift necessitated a thorough review of internal processes, particularly because many of the City's subrecipient contracts are designed to begin on July 1 of each fiscal year but are not fully executed until months later, after the HUD-signed grant agreement is received, which generally occurs between late September and November. These timing discrepancies previously made it difficult to consistently identify and use the correct obligation date for FFATA reporting. The Federal Grants team initially used a manual Excel-based system to compile FFATA data from fully executed contracts. Each contract contains the essential elements required for FFATA reporting, including the Assistance Listing (CFDA) number, the City's and subrecipient's UEI numbers, agency name and address, award amount, and a brief program description. This spreadsheet served as the foundation for reporting subawards in SAM.gov. To address these issues, the City has established an updated standardized data collection and tracking mechanism. In response to this audit finding, the City has implemented the following corrective actions: 1.Standardized Data Collection: An updated subrecipient data collection form has been developed to ensure consistent and complete capture of all required FFATA elements prior to contract execution. 2.Formal Tracking System: The City created a FFATA Tracking Spreadsheet to systematically document and monitor all required reporting elements, including the correct obligation date, which is now tied to the legal execution date of the subaward. 3.Policy and Procedure Development: FFATA reporting policy and procedures have been developed to codify roles, timelines, and compliance responsibilities. This includes guidance on identifying the proper obligation date, data verification steps, and the timeline for submission to SAM.gov (within 30 days of obligation). 4.Staff Training and Oversight: Relevant staff will be trained on FFATA compliance requirements, and the Grants Management Division will conduct quarterly spot checks to ensure accuracy and timeliness of reporting. These corrective actions reflect the City's commitment to strengthening its federal grant oversight and ensuring full compliance with FFATA regulations.

Finding Number: 2024-003 Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Pass-through Entity: N/A- Direct Award Federal Agency: Department of Housing and Urban Development Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Subrecipient Monitoring Type of finding: Material weakness and material noncompliance Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Appropriate monitoring of the subrecipient based on their risk of noncompliance. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. Cause The City does not have formal written policies, procedures, and internal controls in place to ensure that all required subrecipient monitoring procedures are performed. Proper perspective During our audit, we noted that four of the four subrecipients selected for testing did not have a completed risk assessment to determine their risk of noncompliance. As such, we were unable to determine that the proper level of monitoring was completed throughout the fiscal year over the contracted subrecipient. Additionally, we noted that the audited financial statements were obtained for the four subrecipients selected for testing, but there was no documentation to evidence the nature and extent of the City’s review of the reports obtained. Possible asserted effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned costs None Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding Yes, 2023-005 Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining and reviewing the documentation. The City should then conclude on and document the subrecipient’s risk of noncompliance based on the checklist to ensure the proper level of monitoring occurs throughout the year. Views of responsible officials and corrective actions The City has addressed this recommendation. The City has updated policies and procedures in place. A standardized Subrecipient Audit Risk Assessment Checklist is in place and a Monitoring Risk Assessment Checklist has also been developed and implemented to guide and document the evaluation of subrecipient risk, review of single audit reports, monitoring. Federal Grants Division staff will complete this checklist during the initial subrecipient review and update it annually. This will ensure consistent documentation of each subrecipient's risk level and corresponding compliance requirements. The process will enable the City to make informed decisions regarding the appropriate level of monitoring for each subrecipient, based on the risk assessment outcomes. This systematic approach enhances accountability, supports audit readiness, and aligns with federal guidance under 2 CFR Part 200. All the agencies/subrecipients have been informed of the upcoming monitoring.

Finding Number: 2024-004 Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Pass-through Entity: N/A- Direct Award Federal Agency: Department of Housing and Urban Development Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Reporting Type of finding: Material weakness and noncompliance Criteria Special Reporting for Federal Funding Accountability and Transparency Act Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No.109-282), as amended by Section 6202 of Public Law 110-252, herein referred to as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Aspects of the Transparency Act that relate to subaward reporting (1) under grants and cooperative agreements were implemented in OMB in 2 CFR Part 170 and (2) under contracts, by the regulatory agencies responsible for the Federal Acquisition Regulation (FAR at 5 FR 39414 et seq., July 8, 2010). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Title 2 US Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, section 200.1 defines subaward as an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract. Further, 2 CFR 200.1 defines subrecipient as a nonfederal entity that receives a subaward from a passthrough entity to carry out part of a federal program but does not include an individual that is a beneficiary of such program. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City’s Community Development Department did not report awards granted to subrecipients for the HOPWA program by the end of the month following the month in which the City awarded the subrecipient award. FFATA requires the City to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee DUNS/UEI number 3. Amount of subaward 4. Subaward obligation/action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that the City did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. Cause The condition found was due to the City not reporting amounts passed through to subrecipients for the period from July 2023 to June 2024, as the City typically reports these on a one-year lag due to the timing of when the contract starts and its final execution. Proper perspective During our testing of four selected subawards, we noted reporting exceptions as subawards were not reported within the one month following the month that the City awarded the subrecipient contract. Additionally, there was a control exception to ensure that the data submitted is complete and accurate. Possible asserted effect Failure to submit subaward amounts passed through to subrecipients and subcontractors under subawards as defined by 2 CFR 200.1 in the City’s FFATA reporting could result in the City reporting inaccurate and incomplete amounts to the federal government. Questioned costs None Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding Yes, 2023-006 Recommendation We recommend that the City review and enhance its policies, procedures, and internal controls to ensure that all amounts passed through to subrecipients under subawards, as defined in 2 CFR 200.1 are reported in accordance with the FFATA federal regulations. In addition, we recommend that the City use obligation date for FFATA reporting. Views of responsible officials and corrective actions The City has taken several steps to strengthen its FFATA compliance. Historically, FFATA reporting posed challenges for many recipients, including the City, due to legacy reporting systems that did not fully align with the requirements of SAM.gov. As part of its compliance improvement efforts, the City has transitioned to directly reporting subaward data in SAM.gov. This shift necessitated a thorough review of internal processes, particularly because many of the City's subrecipient contracts are designed to begin on July 1 of each fiscal year but are not fully executed until months later, after the HUD-signed grant agreement is received, which generally occurs between late September and November. These timing discrepancies previously made it difficult to consistently identify and use the correct obligation date for FFATA reporting. The Federal Grants team initially used a manual Excel-based system to compile FFATA data from fully executed contracts. Each contract contains the essential elements required for FFATA reporting, including the Assistance Listing (CFDA) number, the City's and subrecipient's UEI numbers, agency name and address, award amount, and a brief program description. This spreadsheet served as the foundation for reporting subawards in SAM.gov. In response to this audit finding, the City has implemented the following corrective actions: 1.Standardized Data Collection: A subrecipient data collection form has been developed to ensure consistent and complete capture of all required FFATA elements prior to contract execution. 2.Formal Tracking System: The City created a FFATA Tracking Spreadsheet to systematically document and monitor all required reporting elements, including the correct obligation date, which is now tied to the legal execution date of the subaward.

Finding Number: 2024-005 Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Pass-through Entity: N/A- Direct Award Federal Agency: Department of Housing and Urban Development Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Performance Reporting Type of finding: Material weakness and material noncompliance Criteria Performance Reporting for the HOPWA Consolidated Annual Performance and Evaluation Report Per HUD, the Consolidated Annual Performance and Evaluation Report (CAPER) provides annual performance reporting on client outputs and outcomes that enables an assessment of grantee performance in achieving the housing stability outcome measure. The CAPER fulfills statutory and regulatory program reporting requirements and provides the grantee and HUD with the necessary information to assess the overall program performance and accomplishments against planned goals and objectives. Both HOPWA formula and competitive grantees submitting reports after January 1, 2023, must complete and submit the HUD-4155 “Consolidated APR/CAPER” (OMB number 2506-0133). HOPWA Formula Grantees that accept the supplemental funding authorized under the CARES Act should report on the use of supplemental grant funds in the same performance report as their use of entitlement funds. Both formula and competitive grantees are required to submit their completed HUD-4155 no later than 90 days after the close of their program or operating year. Competitive grantees have 120 days after the end of their grant’s last period of performance to submit the final HUD-4155. Grantees should be able to demonstrate that funds disbursed through federal financial systems are traceable in local accounts and accurately reported in Key Line Items in the HUD-4155. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • CAPER report is submitted to HUD within 90 days of the end of the 12-month program year. • Review of subrecipient’s CAPER to ensure complete and accurate reporting over key line items. Cause Subrecipients are required to submit their individual CAPER reports to the City prior to the City submitting its report to HUD. The City has had difficulty in getting the subrecipients to comply with the CAPER reporting, which is primarily due to staffing issues at the subrecipients. As a result, the City did not submit its CAPER to HUD within the required time-frame. Proper perspective The City failed to submit the CAPER that covers the period from July 1, 2022 to June 30, 2023 to HUD by the September 30, 2023 deadline. The City ultimately submitted the CAPER on May 3, 2024. Additionally, the City has been unable to provide documentation that the subrecipients’ CAPER has been reconciled to the Integrated Disbursement and Information System (IDIS). Possible asserted effect Incomplete or inaccurate information from its subrecipients has resulted in the City’s inability to properly comply with HUD’s CAPER reporting requirements. Questioned costs Not determinable Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding Yes, 2023-007 Recommendation We recommend that the City establish policies, procedures, and internal controls to ensure that all subrecipient CAPER reports are reconciled to the IDIS system and submitted to HUD within 90 days of year-end. Views of responsible officials and corrective actions The City will continue to work with all agencies receiving HOPWA to complete their annual CAPER correctly and in a timely manner. This emphasis will be reiterated throughout the awarding process and will be subject to regular status updates to ensure compliance and accuracy. Further, the City will work with HUD to establish a correct methodology in reporting consistency with IDIS, as the annual CAPER and HOPWA contracts do not operate open uniform timelines, nor do they involve consistent financial reporting structures. The City does not believe the simple and direct correlation to IDIS is a reasonable or useful metric for the CAPER, but acknowledges that there should be a consistent standard that can be reconciled to financial activity during the year covered by each CAPER.

Finding Number: 2024-006 Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Pass-through Entity: N/A- Direct Award Federal Agency: U.S. Department of Treasury Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Allowability Type of finding: Material weakness and noncompliance Criteria Per the activities allowed or unallowed requirement within Part 4 of the Compliance Supplement, recipients may use payments from CSLFRF to: 1. Respond to the public health and negative economic impacts of the pandemic, by supporting the health of communities, and helping households, small businesses, impacted industries, and the public sector recover from economic impacts of the pandemic. 2. Replace lost public sector revenue to provide government services; recipients may use this funding to provide government services to the extent of the reduction in revenue experienced due to the pandemic. 3. Provide premium pay for essential workers, offering additional support to those who have borne and will bear the greatest health risks because of their service in critical infrastructure sectors; and 4. Invest in water, sewer, and broadband infrastructure, making necessary investments to improve access to clean drinking water, support, vital wastewater and storm water infrastructure, and to expand access to broadband internet. For beneficiary payments (expenditures), evaluate whether the entity's records identify the individual or group as eligible to receive beneficiary payments for the applicable period. Additionally, according to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City set specific requirements for small businesses to be eligible to receive beneficiary payments under the CSLFRF program. Businesses were required to submit an application to the City with supporting documentation to confirm they were eligible for the payment. One of the requirements to be eligible is that the business must show a loss between the years of 2019 and 2021. We noted during our testing that the City awarded beneficiary payments to businesses that did not meet this requirements set by the City. We noted 3 exceptions from a sample selection of 40. Cause Due to improper review and approval, the City approved three business applications to receive a beneficiary payment that were ineligible. Proper perspective During our testing, we noted that 3 of 40 selections did not meet the eligibility criteria to be awarded a beneficiary payment. One exception showed a business loss in 2022, which is outside the period of the program requirements to submit loss documentation (2019-2021). One additional exception relates to a businesses showing an increase in sales/revenue for the 2021-2022 years. The City was unable to provide documentation that this business had a loss in either 2019 or 2020. The last exception relates to an individual that was awarded a small business grant where the business nor the individual is domiciled in Cambridge. As such, the City should not have approved these businesses for payment when reviewing their applications. Possible asserted effect Approving businesses that are not eligible to receive a beneficiary payment could cause the City to be charging the grant unallowable costs. Questioned costs $13,500 Statistical sampling That same was not intended to be, and was not, a statistically valid sample. Repeat finding A similar finding was not reported in the prior year. Recommendation We recommend the City review applications to ensure only eligible businesses are approved to receive beneficiary payments. Views of responsible officials and corrective actions The City has implemented additional controls over the review of all applicant information related to program funds being disbursed only to eligible applicants.

Finding Number: 2024-007 Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Pass-through Entity: N/A- Direct Award Federal Agency: U.S. Department of Treasury Federal Awar Year: July 1, 2023–June 30, 2024 Compliance Requirement: Procurement Type of finding: Material weakness and noncompliance Criteria Recipients may use awarded funds to enter into contracts to procure goods and services necessary to implement one or more of the eligible purposes outlined in 42 USC sections 802(c) and 803(c) and Treasury’s 2021 Interim Final Rule, and 2022 Final Rule, and 2023 Interim Final Rule. Non-federal entities other than states, including those operating federal programs as subrecipients of states, must follow the procurement standards set out at 2 CFR sections 200.318 through 200.327. They must use their own documented procurement procedures, which reflect applicable state and local laws and regulations, provided that the procurements conform to applicable federal statutes and the procurement requirements identified in 2 CFR Part 200. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition For three of seven selections, we noted that the City did not follow the proper procurement policies as outlined in the Massachusetts General Law Chapter 30B. One exception related to a vendor that had cumulative expenditures greater than $10,000 in FY24. This vendor did not have a related contract for these expenditures and therefore the City did not follow procurement policies. Two additional exceptions relate to sole-source procurements with contract values greater than $50,000. Per Chapter 30B, sole-source procurements of more the $50,000 cannot be completed unless the contract relates to software maintenance, library books, and educational materials. These contracts did not relate to any of the beforementioned categories. Additionally, the City did not have documentation to show that a reasonable services. As such, a sole-source procurement method was not in compliance with Chapter 30B of the Massachusetts General Law. Cause The nature and reason for the noncompliance is attributed to oversight error on the City's part for not entering into contracts/maintaining procurement documentation appropriately. The City enters into hundreds of contracts annually funded with the ARPA program, all of which are manually reviewed. Therefore, it is likely that human error caused the noncompliance. Proper perspective The City’s policy is to follow the Massachusetts General Law Chapter 30B when procuring goods and services. Out of a sample size of seven, we noted that three of the vendors were not properly procured, as described in the conditions found. Possible asserted effect Not following the proper procurement policies, as outlined in Chapter 30B, could cause the City to inappropriately award a contract to a vendor. Questioned costs None noted Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding A similar finding was not reported in the prior year. Recommendation We recommend the City to review the procurement policies and ensure that expenditures for vendors that exceed $10,000 follow the correct procurement policies and procedures. Additionally, sole source bids require the City to follow certain policies and procedures. Views of responsible officials and corrective actions The City has updated its procurement process in FY2025 to ensure that expenditures for vendors that exceed $10,000 and sole source contracts follow the correct procurement policies and procedures in accordance with MGL 30B. investigation occurred that showed only one, or all vendors contracted with, could provide the required

Finding Number: 2024-008 Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Pass-through Entity: N/A- Direct Award Federal Agency: U.S. Department of Treasury Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Suspension and Debarment Type of finding: Material weakness and noncompliance Criteria The 2 CFR sections 180.215 and 180.220 provide the principles to be applied to ensure nonfederal entities are not contracting with or making subawards under covered transactions to parties that are suspended or debarred. Additionally, when a nonfederal entity enters into a covered transaction with an entity at a lower tier, the nonfederal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have formal policies and procedures for ensuring vendors are not suspended or debarred prior to entering into a contract. However, when establishing contracts for vendors under the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF), the City requires that standard contract language be included to address the applicable suspension and debarment requirements. Additionally, the City requires the program staff check the System of Award Management (SAM) to ensure the vendor is not suspended or debarred from working under a federal contract. If neither of the beforementioned methods are used, the City will require the vendor to submit a self-certification to ensure they are not suspended or debarred. Throughout our testing, we noted the required contract language was not included within all vendor contracts. Additionally, there was no evidence that city verified the vendor on SAM.gov, or that there was a self-certification included as part of the contracting process. Cause The City requires that standard contract language be included in all vendor contracts that addresses the suspension and debarment requirements. The City was unaware that the required language was excluded from vendor contracts entered into for the CSLFRF program. There was insufficient review of the contracts prior to execution to ensure all required elements were present. Additionally, the City did not retain any documentation that they checked SAM.gov prior to entering into a control with a vendor. Proper perspective During our audit, we noted five of nine vendors selected for testing did not contain language in the contract regarding suspension and debarment, as evidenced via review of the subrecipient contracts. Additionally, it was communicated to us that the City checked SAM.gov for each vendor’s status, however, they were not able to provide evidence that this occurred. During compliance testing, it was confirmed all subrecipients, except for two, were not suspended or debarred. The engagement team was unable to determine if Margaret Fuller Neighborhood House and Smartcat Platforms Inc. was suspended or debarred as they are not registered with SAM.gov. Possible asserted effect Lack of formal review of subrecipient contracts and review of entities on SAM.gov could result in the City entering into contracts with prohibited entities. Questions costs None noted Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding Yes, 2023-008 Recommendation We recommend the City set formal policies and procedures around ensuring vendors are not suspended or debarred. Documented policies and procedures would ensure that required language is included within all vendor contracts prior to execution and that SAM.gov is checked and documentation is retained. Views of responsible officials and corrective actions The City has taken actions to ensure that the “Suspension and Debarment” clause or vendor selfcertification confirmation statement has been added to the FY2025 contract and grant agreements. Additionally, City staff has adopted a new sign-off process to document the City's staff review of the vendors status in “SAM.gov”.

Finding Number: 2024-009 Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Pass-through Entity: N/A- Direct Award Federal Agency: U.S. Department of Treasury Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Subrecipient Monitoring Type of finding: Material weakness and material noncompliance Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. • All required elements of the subrecipient contracts are included during execution. Cause The City’s lack of effective internal controls and written policies and procedures have caused the following Proper perspective During the audit, we noted that eight of the nine subrecipient selections did not contain all the required elements of the contract. Additionally, nine of the nine selections completed a risk assessment questionnaire. However, there is no indication that the City reviewed the questionnaires and subsequently concluded on the subrecipient’s risk of noncompliance. We also noted that audited financial statements were obtained for the three subrecipients that required a single audit, but there was no documentation to evidence the nature and extent of the City’s review of the audit reports obtained. Therefore, we were unable to determine if, based on the subrecipient’s risk assessment questionnaire and single audit report, if additional monitoring procedures were required Possible asserted effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned costs None Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding Yes, 2023-009 Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining and reviewing the documentation. The City should then conclude on and document the subrecipient’s risk of noncompliance based on the checklist to ensure the proper level of monitoring occurs throughout the year. Views of responsible officials and corrective actions The City has implemented additional controls over subrecipient monitoring by establishing a formal policy to review and document subrecipient qualifications, risk assessments and financial reports and have created subsequent monitoring plans and checklists. noncompliance and control exceptions.

Program: Community Development Block Grant (CDBG) ALN #: 14.218 Pass-through Entity: N/A- Direct Award Federal Agency: Department of Housing and Urban Development Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Performance Reporting Type of finding: Material weakness and noncompliance Criteria Special Reporting for Federal Funding Accountability and Transparency Act Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No.109-282), as amended by Section 6202 of Public Law 110-252, herein referred to as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Aspects of the Transparency Act that relate to subaward reporting (1) under grants and cooperative agreements were implemented in OMB in 2 CFR Part 170 and (2) under contracts, by the regulatory agencies responsible for the Federal Acquisition Regulation (FAR at 5 FR 39414 et seq., July 8, 2010). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Title 2 US Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, section 200.1 defines subaward as an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract. Further, 2 CFR 200.1 defines subrecipient as a nonfederal entity that receives a subaward from a passthrough entity to carry out part of a federal program but does not include an individual that is a beneficiary of such program. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City’s Community Development Department (CDBG) did not report awards granted to subrecipients for the CDBG program by the end of the month following the month in which the City awarded the subrecipient award. FFATA requires the City to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee DUNS/UEI number 3. Amount of subaward 4. Subaward obligation/action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that the City did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. Cause The condition found was due to the City not reporting amounts passed through to subrecipients for the period from July 2023 to June 2024, as the City typically reports these on a one-year lag due to the timing of when the contract starts and its final execution. Proper perspective During our testing of the three selected subawards, we noted reporting exceptions as subawards were not reported within the one month following the month that the City awarded the subrecipient contract. Additionally, there was a control exception to ensure that the data submitted is complete and accurate. Possible asserted effect Failure to submit subaward amounts passed through to subrecipients and subcontractors under subawards as defined by 2 CFR 200.1 in the City’s FFATA reporting could result in the City reporting inaccurate and incomplete amounts to the federal government. Questioned costs None noted Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding A similar finding was not reported in the prior year. Recommendation We recommend that the City review and enhance its policies, procedures, and internal controls to ensure that all amounts passed through to subrecipients under subawards, as defined in 2 CFR 200.1 are reported in accordance with the FFATA federal regulations. In addition, we recommend that the City use obligation date for FFATA reporting. Views of responsible officials and corrective actions The City has taken several steps to strengthen its FFATA compliance. Historically, FFATA reporting posed challenges for many recipients, including the City, due to legacy reporting systems that did not fully align with the requirements of SAM.gov. As part of its compliance improvement efforts, the City has transitioned to directly reporting subaward data in SAM.gov. This shift necessitated a thorough review of internal processes, particularly because many of the City's subrecipient contracts are designed to begin on July 1 of each fiscal year but are not fully executed until months later, after the HUD-signed grant agreement is received, which generally occurs between late September and November. These timing discrepancies previously made it difficult to consistently identify and use the correct obligation date for FFATA reporting. The Federal Grants team initially used a manual Excel-based system to compile FFATA data from fully executed contracts. Each contract contains the essential elements required for FFATA reporting, including the Assistance Listing (CFDA) number, the City's and subrecipient's UEI numbers, agency name and address, award amount, and a brief program description. This spreadsheet served as the foundation for reporting subawards in SAM.gov. To address these issues, the City has established an updated standardized data collection and tracking mechanism. In response to this audit finding, the City has implemented the following corrective actions: 1.Standardized Data Collection: An updated subrecipient data collection form has been developed to ensure consistent and complete capture of all required FFATA elements prior to contract execution. 2.Formal Tracking System: The City created a FFATA Tracking Spreadsheet to systematically document and monitor all required reporting elements, including the correct obligation date, which is now tied to the legal execution date of the subaward. 3.Policy and Procedure Development: FFATA reporting policy and procedures have been developed to codify roles, timelines, and compliance responsibilities. This includes guidance on identifying the proper obligation date, data verification steps, and the timeline for submission to SAM.gov (within 30 days of obligation). 4.Staff Training and Oversight: Relevant staff will be trained on FFATA compliance requirements, and the Grants Management Division will conduct quarterly spot checks to ensure accuracy and timeliness of reporting. These corrective actions reflect the City's commitment to strengthening its federal grant oversight and ensuring full compliance with FFATA regulations.

Finding Number: 2024-003 Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Pass-through Entity: N/A- Direct Award Federal Agency: Department of Housing and Urban Development Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Subrecipient Monitoring Type of finding: Material weakness and material noncompliance Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Appropriate monitoring of the subrecipient based on their risk of noncompliance. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. Cause The City does not have formal written policies, procedures, and internal controls in place to ensure that all required subrecipient monitoring procedures are performed. Proper perspective During our audit, we noted that four of the four subrecipients selected for testing did not have a completed risk assessment to determine their risk of noncompliance. As such, we were unable to determine that the proper level of monitoring was completed throughout the fiscal year over the contracted subrecipient. Additionally, we noted that the audited financial statements were obtained for the four subrecipients selected for testing, but there was no documentation to evidence the nature and extent of the City’s review of the reports obtained. Possible asserted effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned costs None Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding Yes, 2023-005 Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining and reviewing the documentation. The City should then conclude on and document the subrecipient’s risk of noncompliance based on the checklist to ensure the proper level of monitoring occurs throughout the year. Views of responsible officials and corrective actions The City has addressed this recommendation. The City has updated policies and procedures in place. A standardized Subrecipient Audit Risk Assessment Checklist is in place and a Monitoring Risk Assessment Checklist has also been developed and implemented to guide and document the evaluation of subrecipient risk, review of single audit reports, monitoring. Federal Grants Division staff will complete this checklist during the initial subrecipient review and update it annually. This will ensure consistent documentation of each subrecipient's risk level and corresponding compliance requirements. The process will enable the City to make informed decisions regarding the appropriate level of monitoring for each subrecipient, based on the risk assessment outcomes. This systematic approach enhances accountability, supports audit readiness, and aligns with federal guidance under 2 CFR Part 200. All the agencies/subrecipients have been informed of the upcoming monitoring.

Finding Number: 2024-004 Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Pass-through Entity: N/A- Direct Award Federal Agency: Department of Housing and Urban Development Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Reporting Type of finding: Material weakness and noncompliance Criteria Special Reporting for Federal Funding Accountability and Transparency Act Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No.109-282), as amended by Section 6202 of Public Law 110-252, herein referred to as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Aspects of the Transparency Act that relate to subaward reporting (1) under grants and cooperative agreements were implemented in OMB in 2 CFR Part 170 and (2) under contracts, by the regulatory agencies responsible for the Federal Acquisition Regulation (FAR at 5 FR 39414 et seq., July 8, 2010). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Title 2 US Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, section 200.1 defines subaward as an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract. Further, 2 CFR 200.1 defines subrecipient as a nonfederal entity that receives a subaward from a passthrough entity to carry out part of a federal program but does not include an individual that is a beneficiary of such program. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City’s Community Development Department did not report awards granted to subrecipients for the HOPWA program by the end of the month following the month in which the City awarded the subrecipient award. FFATA requires the City to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee DUNS/UEI number 3. Amount of subaward 4. Subaward obligation/action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that the City did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. Cause The condition found was due to the City not reporting amounts passed through to subrecipients for the period from July 2023 to June 2024, as the City typically reports these on a one-year lag due to the timing of when the contract starts and its final execution. Proper perspective During our testing of four selected subawards, we noted reporting exceptions as subawards were not reported within the one month following the month that the City awarded the subrecipient contract. Additionally, there was a control exception to ensure that the data submitted is complete and accurate. Possible asserted effect Failure to submit subaward amounts passed through to subrecipients and subcontractors under subawards as defined by 2 CFR 200.1 in the City’s FFATA reporting could result in the City reporting inaccurate and incomplete amounts to the federal government. Questioned costs None Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding Yes, 2023-006 Recommendation We recommend that the City review and enhance its policies, procedures, and internal controls to ensure that all amounts passed through to subrecipients under subawards, as defined in 2 CFR 200.1 are reported in accordance with the FFATA federal regulations. In addition, we recommend that the City use obligation date for FFATA reporting. Views of responsible officials and corrective actions The City has taken several steps to strengthen its FFATA compliance. Historically, FFATA reporting posed challenges for many recipients, including the City, due to legacy reporting systems that did not fully align with the requirements of SAM.gov. As part of its compliance improvement efforts, the City has transitioned to directly reporting subaward data in SAM.gov. This shift necessitated a thorough review of internal processes, particularly because many of the City's subrecipient contracts are designed to begin on July 1 of each fiscal year but are not fully executed until months later, after the HUD-signed grant agreement is received, which generally occurs between late September and November. These timing discrepancies previously made it difficult to consistently identify and use the correct obligation date for FFATA reporting. The Federal Grants team initially used a manual Excel-based system to compile FFATA data from fully executed contracts. Each contract contains the essential elements required for FFATA reporting, including the Assistance Listing (CFDA) number, the City's and subrecipient's UEI numbers, agency name and address, award amount, and a brief program description. This spreadsheet served as the foundation for reporting subawards in SAM.gov. In response to this audit finding, the City has implemented the following corrective actions: 1.Standardized Data Collection: A subrecipient data collection form has been developed to ensure consistent and complete capture of all required FFATA elements prior to contract execution. 2.Formal Tracking System: The City created a FFATA Tracking Spreadsheet to systematically document and monitor all required reporting elements, including the correct obligation date, which is now tied to the legal execution date of the subaward.

Finding Number: 2024-005 Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Pass-through Entity: N/A- Direct Award Federal Agency: Department of Housing and Urban Development Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Performance Reporting Type of finding: Material weakness and material noncompliance Criteria Performance Reporting for the HOPWA Consolidated Annual Performance and Evaluation Report Per HUD, the Consolidated Annual Performance and Evaluation Report (CAPER) provides annual performance reporting on client outputs and outcomes that enables an assessment of grantee performance in achieving the housing stability outcome measure. The CAPER fulfills statutory and regulatory program reporting requirements and provides the grantee and HUD with the necessary information to assess the overall program performance and accomplishments against planned goals and objectives. Both HOPWA formula and competitive grantees submitting reports after January 1, 2023, must complete and submit the HUD-4155 “Consolidated APR/CAPER” (OMB number 2506-0133). HOPWA Formula Grantees that accept the supplemental funding authorized under the CARES Act should report on the use of supplemental grant funds in the same performance report as their use of entitlement funds. Both formula and competitive grantees are required to submit their completed HUD-4155 no later than 90 days after the close of their program or operating year. Competitive grantees have 120 days after the end of their grant’s last period of performance to submit the final HUD-4155. Grantees should be able to demonstrate that funds disbursed through federal financial systems are traceable in local accounts and accurately reported in Key Line Items in the HUD-4155. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • CAPER report is submitted to HUD within 90 days of the end of the 12-month program year. • Review of subrecipient’s CAPER to ensure complete and accurate reporting over key line items. Cause Subrecipients are required to submit their individual CAPER reports to the City prior to the City submitting its report to HUD. The City has had difficulty in getting the subrecipients to comply with the CAPER reporting, which is primarily due to staffing issues at the subrecipients. As a result, the City did not submit its CAPER to HUD within the required time-frame. Proper perspective The City failed to submit the CAPER that covers the period from July 1, 2022 to June 30, 2023 to HUD by the September 30, 2023 deadline. The City ultimately submitted the CAPER on May 3, 2024. Additionally, the City has been unable to provide documentation that the subrecipients’ CAPER has been reconciled to the Integrated Disbursement and Information System (IDIS). Possible asserted effect Incomplete or inaccurate information from its subrecipients has resulted in the City’s inability to properly comply with HUD’s CAPER reporting requirements. Questioned costs Not determinable Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding Yes, 2023-007 Recommendation We recommend that the City establish policies, procedures, and internal controls to ensure that all subrecipient CAPER reports are reconciled to the IDIS system and submitted to HUD within 90 days of year-end. Views of responsible officials and corrective actions The City will continue to work with all agencies receiving HOPWA to complete their annual CAPER correctly and in a timely manner. This emphasis will be reiterated throughout the awarding process and will be subject to regular status updates to ensure compliance and accuracy. Further, the City will work with HUD to establish a correct methodology in reporting consistency with IDIS, as the annual CAPER and HOPWA contracts do not operate open uniform timelines, nor do they involve consistent financial reporting structures. The City does not believe the simple and direct correlation to IDIS is a reasonable or useful metric for the CAPER, but acknowledges that there should be a consistent standard that can be reconciled to financial activity during the year covered by each CAPER.

Finding Number: 2024-006 Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Pass-through Entity: N/A- Direct Award Federal Agency: U.S. Department of Treasury Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Allowability Type of finding: Material weakness and noncompliance Criteria Per the activities allowed or unallowed requirement within Part 4 of the Compliance Supplement, recipients may use payments from CSLFRF to: 1. Respond to the public health and negative economic impacts of the pandemic, by supporting the health of communities, and helping households, small businesses, impacted industries, and the public sector recover from economic impacts of the pandemic. 2. Replace lost public sector revenue to provide government services; recipients may use this funding to provide government services to the extent of the reduction in revenue experienced due to the pandemic. 3. Provide premium pay for essential workers, offering additional support to those who have borne and will bear the greatest health risks because of their service in critical infrastructure sectors; and 4. Invest in water, sewer, and broadband infrastructure, making necessary investments to improve access to clean drinking water, support, vital wastewater and storm water infrastructure, and to expand access to broadband internet. For beneficiary payments (expenditures), evaluate whether the entity's records identify the individual or group as eligible to receive beneficiary payments for the applicable period. Additionally, according to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City set specific requirements for small businesses to be eligible to receive beneficiary payments under the CSLFRF program. Businesses were required to submit an application to the City with supporting documentation to confirm they were eligible for the payment. One of the requirements to be eligible is that the business must show a loss between the years of 2019 and 2021. We noted during our testing that the City awarded beneficiary payments to businesses that did not meet this requirements set by the City. We noted 3 exceptions from a sample selection of 40. Cause Due to improper review and approval, the City approved three business applications to receive a beneficiary payment that were ineligible. Proper perspective During our testing, we noted that 3 of 40 selections did not meet the eligibility criteria to be awarded a beneficiary payment. One exception showed a business loss in 2022, which is outside the period of the program requirements to submit loss documentation (2019-2021). One additional exception relates to a businesses showing an increase in sales/revenue for the 2021-2022 years. The City was unable to provide documentation that this business had a loss in either 2019 or 2020. The last exception relates to an individual that was awarded a small business grant where the business nor the individual is domiciled in Cambridge. As such, the City should not have approved these businesses for payment when reviewing their applications. Possible asserted effect Approving businesses that are not eligible to receive a beneficiary payment could cause the City to be charging the grant unallowable costs. Questioned costs $13,500 Statistical sampling That same was not intended to be, and was not, a statistically valid sample. Repeat finding A similar finding was not reported in the prior year. Recommendation We recommend the City review applications to ensure only eligible businesses are approved to receive beneficiary payments. Views of responsible officials and corrective actions The City has implemented additional controls over the review of all applicant information related to program funds being disbursed only to eligible applicants.

Finding Number: 2024-007 Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Pass-through Entity: N/A- Direct Award Federal Agency: U.S. Department of Treasury Federal Awar Year: July 1, 2023–June 30, 2024 Compliance Requirement: Procurement Type of finding: Material weakness and noncompliance Criteria Recipients may use awarded funds to enter into contracts to procure goods and services necessary to implement one or more of the eligible purposes outlined in 42 USC sections 802(c) and 803(c) and Treasury’s 2021 Interim Final Rule, and 2022 Final Rule, and 2023 Interim Final Rule. Non-federal entities other than states, including those operating federal programs as subrecipients of states, must follow the procurement standards set out at 2 CFR sections 200.318 through 200.327. They must use their own documented procurement procedures, which reflect applicable state and local laws and regulations, provided that the procurements conform to applicable federal statutes and the procurement requirements identified in 2 CFR Part 200. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition For three of seven selections, we noted that the City did not follow the proper procurement policies as outlined in the Massachusetts General Law Chapter 30B. One exception related to a vendor that had cumulative expenditures greater than $10,000 in FY24. This vendor did not have a related contract for these expenditures and therefore the City did not follow procurement policies. Two additional exceptions relate to sole-source procurements with contract values greater than $50,000. Per Chapter 30B, sole-source procurements of more the $50,000 cannot be completed unless the contract relates to software maintenance, library books, and educational materials. These contracts did not relate to any of the beforementioned categories. Additionally, the City did not have documentation to show that a reasonable services. As such, a sole-source procurement method was not in compliance with Chapter 30B of the Massachusetts General Law. Cause The nature and reason for the noncompliance is attributed to oversight error on the City's part for not entering into contracts/maintaining procurement documentation appropriately. The City enters into hundreds of contracts annually funded with the ARPA program, all of which are manually reviewed. Therefore, it is likely that human error caused the noncompliance. Proper perspective The City’s policy is to follow the Massachusetts General Law Chapter 30B when procuring goods and services. Out of a sample size of seven, we noted that three of the vendors were not properly procured, as described in the conditions found. Possible asserted effect Not following the proper procurement policies, as outlined in Chapter 30B, could cause the City to inappropriately award a contract to a vendor. Questioned costs None noted Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding A similar finding was not reported in the prior year. Recommendation We recommend the City to review the procurement policies and ensure that expenditures for vendors that exceed $10,000 follow the correct procurement policies and procedures. Additionally, sole source bids require the City to follow certain policies and procedures. Views of responsible officials and corrective actions The City has updated its procurement process in FY2025 to ensure that expenditures for vendors that exceed $10,000 and sole source contracts follow the correct procurement policies and procedures in accordance with MGL 30B. investigation occurred that showed only one, or all vendors contracted with, could provide the required

Finding Number: 2024-008 Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Pass-through Entity: N/A- Direct Award Federal Agency: U.S. Department of Treasury Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Suspension and Debarment Type of finding: Material weakness and noncompliance Criteria The 2 CFR sections 180.215 and 180.220 provide the principles to be applied to ensure nonfederal entities are not contracting with or making subawards under covered transactions to parties that are suspended or debarred. Additionally, when a nonfederal entity enters into a covered transaction with an entity at a lower tier, the nonfederal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have formal policies and procedures for ensuring vendors are not suspended or debarred prior to entering into a contract. However, when establishing contracts for vendors under the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF), the City requires that standard contract language be included to address the applicable suspension and debarment requirements. Additionally, the City requires the program staff check the System of Award Management (SAM) to ensure the vendor is not suspended or debarred from working under a federal contract. If neither of the beforementioned methods are used, the City will require the vendor to submit a self-certification to ensure they are not suspended or debarred. Throughout our testing, we noted the required contract language was not included within all vendor contracts. Additionally, there was no evidence that city verified the vendor on SAM.gov, or that there was a self-certification included as part of the contracting process. Cause The City requires that standard contract language be included in all vendor contracts that addresses the suspension and debarment requirements. The City was unaware that the required language was excluded from vendor contracts entered into for the CSLFRF program. There was insufficient review of the contracts prior to execution to ensure all required elements were present. Additionally, the City did not retain any documentation that they checked SAM.gov prior to entering into a control with a vendor. Proper perspective During our audit, we noted five of nine vendors selected for testing did not contain language in the contract regarding suspension and debarment, as evidenced via review of the subrecipient contracts. Additionally, it was communicated to us that the City checked SAM.gov for each vendor’s status, however, they were not able to provide evidence that this occurred. During compliance testing, it was confirmed all subrecipients, except for two, were not suspended or debarred. The engagement team was unable to determine if Margaret Fuller Neighborhood House and Smartcat Platforms Inc. was suspended or debarred as they are not registered with SAM.gov. Possible asserted effect Lack of formal review of subrecipient contracts and review of entities on SAM.gov could result in the City entering into contracts with prohibited entities. Questions costs None noted Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding Yes, 2023-008 Recommendation We recommend the City set formal policies and procedures around ensuring vendors are not suspended or debarred. Documented policies and procedures would ensure that required language is included within all vendor contracts prior to execution and that SAM.gov is checked and documentation is retained. Views of responsible officials and corrective actions The City has taken actions to ensure that the “Suspension and Debarment” clause or vendor selfcertification confirmation statement has been added to the FY2025 contract and grant agreements. Additionally, City staff has adopted a new sign-off process to document the City's staff review of the vendors status in “SAM.gov”.

Finding Number: 2024-009 Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Pass-through Entity: N/A- Direct Award Federal Agency: U.S. Department of Treasury Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Subrecipient Monitoring Type of finding: Material weakness and material noncompliance Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. • All required elements of the subrecipient contracts are included during execution. Cause The City’s lack of effective internal controls and written policies and procedures have caused the following Proper perspective During the audit, we noted that eight of the nine subrecipient selections did not contain all the required elements of the contract. Additionally, nine of the nine selections completed a risk assessment questionnaire. However, there is no indication that the City reviewed the questionnaires and subsequently concluded on the subrecipient’s risk of noncompliance. We also noted that audited financial statements were obtained for the three subrecipients that required a single audit, but there was no documentation to evidence the nature and extent of the City’s review of the audit reports obtained. Therefore, we were unable to determine if, based on the subrecipient’s risk assessment questionnaire and single audit report, if additional monitoring procedures were required Possible asserted effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned costs None Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding Yes, 2023-009 Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining and reviewing the documentation. The City should then conclude on and document the subrecipient’s risk of noncompliance based on the checklist to ensure the proper level of monitoring occurs throughout the year. Views of responsible officials and corrective actions The City has implemented additional controls over subrecipient monitoring by establishing a formal policy to review and document subrecipient qualifications, risk assessments and financial reports and have created subsequent monitoring plans and checklists. noncompliance and control exceptions.