Audit 384683

U.S. Department of Housing and Urban Development (HUD) AL No. 14.218 Community Development Block Grants/Entitlement Grants Significant Deficiency in Internal Controls and Noncompliance over Reporting Repeat Finding: No Condition: The agency did not maintain documentation to support financial information submitted in the federal funding reports submitted during the year. Criteria: In accordance with 2 CFR §200.303: The non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. Cause: The agency did not have controls in place to evidence the reporting requirements of the grant were met. Effect: The agency may not be in compliance with the reporting requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with reporting requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Reporting Repeat Finding: Yes; 2024-013 Condition: For 1 out of 3 selections, we were unable to agree the expenditure details from the general ledger to the amounts reported in the Federal Financial Report to ensure completeness, accuracy and compliance with required accounting basis. We were unable to verify whether the Federal Funding Accountability and Transparency Act (FFATA) report was prepared and submitted. Criteria: In accordance with 2 CFR §200.303: The non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, hereafter referred as the “Transparency Act” that was codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Cause: The agency did not report its first-tier subawards in accordance with the Transparency Act requirements. The agency may not have proper controls in place for the reporting process. Effect: The agency may not be in compliance with the reporting requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with reporting requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-014 Condition: For 2 out of 2 selections, the unique identifier number and federal award identification number were not included in the grant agreement. For 2 out 2 selections, evidence that the prior year Single Audit Report was reviewed was not provided. Criteria: In accordance with 2 CFR §200.303: The non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Pursuant to 31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.330, .331, and .501(h), a pass-through entity must identify the award and applicable requirements, evaluate risk, monitor, and ensure accountability of subrecipients. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. (b) Evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; and (2) The results of previous audits including whether or not the subrecipient receives a Single Audit. (f) Verify that every subrecipient is audited as required by 2 CFR § 200.331 when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Cause: The Mayor’s Office of Homeless Services (MOHS) did not maintain adequate documentation of the requirements included in Uniform Guidance for subrecipient monitoring. Effect: The subrecipient could not be in compliance with Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend that MOHS establish and implement controls to ensure grant agreements include the unique identifier number and federal award identification number. We also recommend a process to ensure that the single audit of subrecipients are reviewed timely. Additionally, we recommend that MOHS provides training on the Uniform Guidance requirements related to subrecipient monitoring. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Labor (DOL) AL No. 17.258, 17.259, 17.278 Workforce Innovation and Opportunity Act (WIOA) Cluster Significant Deficiency in Internal Controls and Noncompliance over Activities Allowed or Unallowed and Allowable Costs/Cost Principles (Payroll) Repeat Finding: No Condition: For 4 of out 40 payroll transactions selected for testing, there was no evidence of supervisory review of costs charged to the program. Criteria: In accordance with 2 CFR 200.430: (i) Standards for Documentation of Personnel Expenses (1) Charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted and all other activities compensated by the non-federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-federal entity’s written policy; (v) Comply with the established accounting policies and practices of the non-federal entity; and (vi) Support the distribution of the employee’s salary or wages among specific activities or cost objectives if the employee works on more than one federal award; a federal award and non-federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. According to AM 413-60, Grant Documentation, Grant Manager/Program Manager/Director conducts ongoing monitoring and control of all reimbursement receipts and deposits until grant ends; as well as all program and sub-recipient (when applicable) documentation, to include: (1) program documentation; (2) timesheets; (3) deliverables; (4) activities; (5) vendor payments; (6) program data/charts/numbers; and (7) financial and compliance report. Cause: The City did not have proper controls in place to ensure that costs charged to federal programs were appropriately reviewed. Effect: Unallowed payroll costs could be charged to the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with activities allowed and allowable costs. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Labor (DOL) AL No. 17.258, 17.259, 17.278 Workforce Innovation and Opportunity Act (WIOA) Cluster Significant Deficiency in Internal Controls and Noncompliance over Reporting Repeat Finding: No Condition: In 2 instances (out of 14 reports selected for testing), the report was submitted after the 45 day requirement date. Criteria: In accordance with 2 CFR §200.303: The non-Federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Under the requirements of the grant, reports are due 45 calendar days after the end of the reporting quarter. Cause: The agency did not have controls in place to evidence the reporting requirements of the grant were met. Effect: The agency may not be in compliance with the reporting requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with reporting requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Labor (DOL) AL No. 17.258, 17.259, 17.278 Workforce Innovation and Opportunity Act (WIOA) Cluster Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Condition: For 2 out of 2 selections, the unique identifier number on the notice of award did not agree with the subrecipient's active registration UEI on SAM.gov. For 2 out of 2 selections, management was unable to provide evidence that subrecipient monitoring was performed to ensure compliance with accounting requirements. For 2 out of 2 selections, evidence that the prior year Single Audit Report was reviewed was not provided. Criteria: In accordance with 2 CFR §200.303: The non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. (b) Evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. According to AM 413-60, Grant Documentation, Grant Manager/Program Manager/Director Conducts ongoing monitoring and control of all reimbursement receipts and deposits until grant ends; as well as all program and sub-recipient (when applicable) documentation, to include: (1) program documentation; (2) timesheets; (3) deliverables; (4) activities; (5) vendor payments; (6) program data/charts/numbers; and (7) financial and compliance report. According to AM 413-61, Grant Management Financial Reporting, Grant Manager/Program Manager/Director maintains all documentation, either electronic or hard copy, for all federally funded grants for the term of the grant for a minimum of seven years for review and audit by the granting agency or its designee. Cause: The Mayor’s Office of Employment Development (MOED) did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: MOED may not be in compliance with the subrecipient monitoring requirements of its grants. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Health and Human Services AL No. 93.686 Ending the HIV Epidemic: A Plan for America Significant Deficiency in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-022 Condition: The unique entity identifier (UEI) was not included in the grant agreements for 1 out of 1 subrecipient grant agreement selected for testing. Criteria: In accordance with 2 CFR 200.303: Internal Control, the non-Federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. Cause: The Baltimore County Department of Health (BCHD) did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: BCHD may not be in compliance with the subrecipient monitoring requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Health and Human Services AL No. 93.914 HIV Emergency Relief Project Grants Significant Deficiency in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-025 Condition: The unique entity identifier (UEI) was not included in the grant agreements for 5 out of 6 subrecipient grant agreement selected for testing. Criteria: In accordance with 2 CFR 200.303: Internal Control, the non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. Cause: The Baltimore County Department of Health (BCHD) did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: BCHD may not be in compliance with the subrecipient monitoring requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Health and Human Services AL No. 93.940 HIV Prevention Activities Health Department Based Significant Deficiency in Internal Controls and Noncompliance over Reporting Repeat Finding: Yes; 2024-027 Condition: Management could not provide evidence that Equipment and Supplies – Tangible Personal Property Report (SF-428) report was submitted. Criteria: In accordance with 2 CFR §200.303, The non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with the grant agreement: A completed Tangible Personal Property Report SF-428 and Final Report SF-428B addendum must be submitted, along with any Supplemental Sheet SF- 428S detailing all major equipment acquired or furnished under this project with a unit acquisition cost of $5,000 or more. If no equipment was acquired under an award, a negative report is required. The recipient must identify each item of equipment that it wished to retain for continued use in accordance with 45 CFR Part 75. Cause: The Baltimore County Department of Health (BCHD) may not have controls in place to ensure reporting requirements of the grant are met. Effect: BCHD may not be in compliance with the reporting requirements. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement a process to ensure all reports are submitted timely. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Health and Human Services AL No. 93.940 HIV Prevention Activities Health Department Based Significant Deficiency in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-028 Condition: The unique entity identifier (UEI) was not included in the grant agreements for 2 out of 5 subrecipient grant agreement selected for testing. Criteria: In accordance with 2 CFR §200.303: the non-federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. Cause: BCHD did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: BCHD may not be in compliance with the subrecipient monitoring requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Health and Human Services AL No. 93.977 Sexually Transmitted Diseases (STD) Prevention and Control Grants Significant Deficiency in Internal Controls and Noncompliance over Reporting Repeat Finding: No Condition: Management could not provide evidence that Equipment and Supplies – Tangible Personal Property Report (SF-428) report was submitted. Criteria: In accordance with 2 CFR §200.303, The non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with the grant agreement: A completed Tangible Personal Property Report SF-428 and Final Report SF-428B addendum must be submitted, along with any Supplemental Sheet SF- 428S detailing all major equipment acquired or furnished under this project with a unit acquisition cost of $5,000 or more. If no equipment was acquired under an award, a negative report is required. The recipient must identify each item of equipment that it wished to retain for continued use in accordance with 45 CFR Part 75. Cause: The Baltimore County Department of Health (BCHD) may not have controls in place to ensure reporting requirements of the grant are met. Effect: BCHD may not be in compliance with the reporting requirements. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement a process to ensure all reports are submitted timely. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

Finding 2025-020 U.S. Department of Health and Human Services AL No. 93.977 Sexually Transmitted Diseases (STD) Prevention and Control Grants Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Condition: For 1 out of 1 selection, management was unable to provide evidence that subrecipient monitoring was performed to ensure compliance with accounting requirements. Criteria: In accordance with 2 CFR 200.303: Internal Control, The non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300 recipients should: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Cause: BCHD did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: The Baltimore County Department of Health (BCHD) may not be in compliance with the subrecipient monitoring requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Treasury AL No. 21.027 American Rescue Plan Act Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-015 Condition: There was no evidence that the City verified whether the subrecipient was suspended and/or debarred from receiving federal funds for 3 out of 40 subrecipients selected for testing. The City did not have current subrecipient grant agreements for 3 out of 40 subrecipients selected for testing. The unique entity identifier (UEI) was not included in the grant agreements for 3 out of 40 subrecipient grant agreements selected for testing. The Federal Award Identification Number (FAIN) was not included in the grant agreements for 8 out of 40 subrecipient grant agreements selected for testing. The UEI was incorrect in the grant agreement for 1 out of 40 subrecipient grant agreements selected for testing. Criteria: In accordance with 2 CFR §200.303: The non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. According to AM 413-61, Grant Management Financial Reporting, Grant Manager/Program Manager/Director maintains all documentation, either electronic or hard copy, for all federally funded grants for the term of the grant for a minimum of seven years for review and audit by the granting agency or its designee. Cause: The City did not maintain adequate documentation of the requirements included in Uniform Guidance for subrecipient monitoring. Effect: The subrecipient could not be in compliance with Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.