Audit 364163

Finding 2024 – 001: FFATA Controls Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 Criteria: 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: There is no internal control in place over Federal Funding Accountability and Transparency Act (FFATA) reporting submissions, which is a direct and material compliance requirement over USAID federal awards. Context: The lack of control in place over FFATA submissions did not result in any instances of noncompliance with FFATA reporting requirements. The lack of an internal control in place over FFATA submissions resulted in a significant deficiency in internal controls over the FFATA compliance requirement due to potential for future noncompliance. Cause: Policies and procedures documents do not include controls for FFATA report submissions. Effect: The lack of control around FFATA submissions could result in missed reporting requirements resulting in potential delays in award processing and discontinued funding. Questioned costs: None Repeat finding? No Recommendation: We recommend management implement a control over FFATA submissions that includes evidence of that control taking place (signature, email approval, etc.). Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 001: FFATA Controls Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 Criteria: 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: There is no internal control in place over Federal Funding Accountability and Transparency Act (FFATA) reporting submissions, which is a direct and material compliance requirement over USAID federal awards. Context: The lack of control in place over FFATA submissions did not result in any instances of noncompliance with FFATA reporting requirements. The lack of an internal control in place over FFATA submissions resulted in a significant deficiency in internal controls over the FFATA compliance requirement due to potential for future noncompliance. Cause: Policies and procedures documents do not include controls for FFATA report submissions. Effect: The lack of control around FFATA submissions could result in missed reporting requirements resulting in potential delays in award processing and discontinued funding. Questioned costs: None Repeat finding? No Recommendation: We recommend management implement a control over FFATA submissions that includes evidence of that control taking place (signature, email approval, etc.). Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 001: FFATA Controls Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 Criteria: 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: There is no internal control in place over Federal Funding Accountability and Transparency Act (FFATA) reporting submissions, which is a direct and material compliance requirement over USAID federal awards. Context: The lack of control in place over FFATA submissions did not result in any instances of noncompliance with FFATA reporting requirements. The lack of an internal control in place over FFATA submissions resulted in a significant deficiency in internal controls over the FFATA compliance requirement due to potential for future noncompliance. Cause: Policies and procedures documents do not include controls for FFATA report submissions. Effect: The lack of control around FFATA submissions could result in missed reporting requirements resulting in potential delays in award processing and discontinued funding. Questioned costs: None Repeat finding? No Recommendation: We recommend management implement a control over FFATA submissions that includes evidence of that control taking place (signature, email approval, etc.). Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 001: FFATA Controls Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 Criteria: 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: There is no internal control in place over Federal Funding Accountability and Transparency Act (FFATA) reporting submissions, which is a direct and material compliance requirement over USAID federal awards. Context: The lack of control in place over FFATA submissions did not result in any instances of noncompliance with FFATA reporting requirements. The lack of an internal control in place over FFATA submissions resulted in a significant deficiency in internal controls over the FFATA compliance requirement due to potential for future noncompliance. Cause: Policies and procedures documents do not include controls for FFATA report submissions. Effect: The lack of control around FFATA submissions could result in missed reporting requirements resulting in potential delays in award processing and discontinued funding. Questioned costs: None Repeat finding? No Recommendation: We recommend management implement a control over FFATA submissions that includes evidence of that control taking place (signature, email approval, etc.). Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 001: FFATA Controls Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 Criteria: 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: There is no internal control in place over Federal Funding Accountability and Transparency Act (FFATA) reporting submissions, which is a direct and material compliance requirement over USAID federal awards. Context: The lack of control in place over FFATA submissions did not result in any instances of noncompliance with FFATA reporting requirements. The lack of an internal control in place over FFATA submissions resulted in a significant deficiency in internal controls over the FFATA compliance requirement due to potential for future noncompliance. Cause: Policies and procedures documents do not include controls for FFATA report submissions. Effect: The lack of control around FFATA submissions could result in missed reporting requirements resulting in potential delays in award processing and discontinued funding. Questioned costs: None Repeat finding? No Recommendation: We recommend management implement a control over FFATA submissions that includes evidence of that control taking place (signature, email approval, etc.). Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 001: FFATA Controls Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 Criteria: 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: There is no internal control in place over Federal Funding Accountability and Transparency Act (FFATA) reporting submissions, which is a direct and material compliance requirement over USAID federal awards. Context: The lack of control in place over FFATA submissions did not result in any instances of noncompliance with FFATA reporting requirements. The lack of an internal control in place over FFATA submissions resulted in a significant deficiency in internal controls over the FFATA compliance requirement due to potential for future noncompliance. Cause: Policies and procedures documents do not include controls for FFATA report submissions. Effect: The lack of control around FFATA submissions could result in missed reporting requirements resulting in potential delays in award processing and discontinued funding. Questioned costs: None Repeat finding? No Recommendation: We recommend management implement a control over FFATA submissions that includes evidence of that control taking place (signature, email approval, etc.). Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 001: FFATA Controls Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 Criteria: 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: There is no internal control in place over Federal Funding Accountability and Transparency Act (FFATA) reporting submissions, which is a direct and material compliance requirement over USAID federal awards. Context: The lack of control in place over FFATA submissions did not result in any instances of noncompliance with FFATA reporting requirements. The lack of an internal control in place over FFATA submissions resulted in a significant deficiency in internal controls over the FFATA compliance requirement due to potential for future noncompliance. Cause: Policies and procedures documents do not include controls for FFATA report submissions. Effect: The lack of control around FFATA submissions could result in missed reporting requirements resulting in potential delays in award processing and discontinued funding. Questioned costs: None Repeat finding? No Recommendation: We recommend management implement a control over FFATA submissions that includes evidence of that control taking place (signature, email approval, etc.). Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 001: FFATA Controls Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 Criteria: 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: There is no internal control in place over Federal Funding Accountability and Transparency Act (FFATA) reporting submissions, which is a direct and material compliance requirement over USAID federal awards. Context: The lack of control in place over FFATA submissions did not result in any instances of noncompliance with FFATA reporting requirements. The lack of an internal control in place over FFATA submissions resulted in a significant deficiency in internal controls over the FFATA compliance requirement due to potential for future noncompliance. Cause: Policies and procedures documents do not include controls for FFATA report submissions. Effect: The lack of control around FFATA submissions could result in missed reporting requirements resulting in potential delays in award processing and discontinued funding. Questioned costs: None Repeat finding? No Recommendation: We recommend management implement a control over FFATA submissions that includes evidence of that control taking place (signature, email approval, etc.). Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.