Audit 406385

Subrecipient Monitoring and Special Tests: Housing Quality Standards Federal Department – U.S. Department of Housing and Urban Development Federal Award Identification Number and Year: M17-DC170213 and 2017 M18-DC170213 and 2018 M21-DC170213 and 2021 M22-DC170213 and 2022 Home Investment Partnerships Program (HOME), Federal Assistance Listing #14.239 County Department – Department of Planning and Development (DPD) Finding 2025 – 001 CRITERIA Subrecipient Monitoring 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D—Post Federal Award Requirements Standards for Financial and Program Management, Section 200.303 Internal controls states, “the recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Section 200.332. Requirements for pass-through entities, requires that “A pass-through entity must: (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency)... (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must:(1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521.(4) Resolve audit findings specifically related to the subaward…. (g)Verify that a subrecipient is audited as required by subpart F of this part. (h) Consider whether the results of a subrecipient's audit, site visits, or other monitoring necessitate adjustments to the pass-through entity's records. (i) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 and in program regulations. DPD’s HOME Program Policies and Procedures Manual (updated January 2025), Monitoring Section (pages 114 to 129), under the Annual Monitoring Plan/Schedule Update, states the plan should identify the participating jurisdiction (PJ) monitoring goals and strategies, highlighting areas to which staff should pay special attention during the monitoring year. A specific schedule detailing annual, bi-annual, and tri-annual monitoring visits as required by HUD must be developed and maintained. To assure that adequate records are kept regarding each property and its compliance status, the monitor should establish a monitoring file for each property. The basic items in the file should include written agreement, written tenant selection criteria, property and unit inspections and results, etc. Also, HOME Program Compliance should conduct a risk assessment of its portfolio of the PJ’s HOME projects so that the highest risk projects can be identified and monitored first. In addition, HOME Program Compliance must conduct a desk review of all properties in the monitoring workload each year, as well as on-site reviews periodically, ranging from annually to every 3 years based on the number of units in property (i.e. 26 or more units require an annual review). Special Tests: Housing Quality Standards Per 24 CFR Section 92.209(i), Tenant-based rental assistance: Eligible costs and requirements, Housing Standards, states “The participating jurisdiction must require the housing occupied by a family receiving tenant-based rental assistance under this section to meet the participating jurisdiction's property standards under § 92.251. Initially and annually thereafter, the participating jurisdiction must determine the housing complies with its property standards and is decent, safe, sanitary, and in good repair in accordance with § 92.251(f). During the period of affordability (i.e., the period for which the nonfederal entity must maintain subsidized housing) for HOME assisted rental housing, the PJ must perform on-site inspections to determine compliance with property standards and verify the information submitted by the owners no less than (a) every three years for projects containing one to four units, (b) every two years for projects containing five to 25 units, and (c) every year for projects containing 26 or more units. CONDITION During the current audit period, the Cook County Department of Planning and Development (DPD) did not provide sufficient evidence to document annual monitoring performed, as well as performed the required inspections to ensure property standards were met, as required by Federal regulations and its internal policies. CAUSE Based on discussions with management, the cause of the findings occurred as a result of post pandemic allocations to the County which included several housing related fundings and initiatives, including Emergency Rental Assistance I & II (ERA I& II), Homeless Sheltering, Homeless and Transitional Sheltering Physical Site Acquisition and Development, HOME ARPA (HUD Allocation), and HOME, CDBG CV development delays that challenged the Housing teams provision of services and compliance requirement. While HUD had extended post pandemic compliance moratoriums into fiscal year 2024, Housing team hiring, training and implementation of compliance activities were unable to activate fully in the subject fiscal year to meet compliance. Additionally, for subrecipient monitoring of the HOME program, costs paid to developers were misclassified as subrecipient expenditures. The HOME program does not have contracts with subrecipients. EFFECT Failure to adequately monitor the activities and performance of subrecipients (and developers) could result in Federal awards being used for unauthorized purposes and DPD’s inability to adequately perform required risk assessments. Failure to perform the required inspections to ensure property standards were met is a violation of Federal regulations. QUESTIONED COSTS None. CONTEXT Subrecipient Monitoring During the current audit period, we noted a total of thirty-seven (37) projects were included on the Program Year 2024 (Fiscal Year 2025) HOME monitoring rental portfolio schedule provided, which required annual monitoring per DPD’s internal policies. Of the 37 projects, we noted three projects had some monitoring conducted during the period, which included some review of tenant files (for income verification/eligibility) and limited physical inspections of HOME units. No additional documentation was provided to verify compliance with federal regulations and the HOME Program Policies and Procedures Manual which required annual monitoring of each project (property). In addition, we noted approximately $7.3 million was reported on the SEFA as pass-through to two subrecipients under the program for the fiscal year ended November 30, 2025. Based on further discussions, DPD noted that these subrecipients are the two title companies used to pay the developers under the HOME program in accordance with its escrow agreement(s). We also reviewed a sample of these payments noting the supporting documentation referenced the developers as subrecipients. No documentation was provided to support compliance with subrecipient monitoring as required by 2 CFR Part 200.332. Special Tests: Housing Quality Standards We were provided with the same 37 projects reviewed under subrecipient monitoring to verify that DPD performed the required inspections to ensure that property standards were met. Based on our review, we noted the list included projects with HOME assisted units ranging from one (1) to 99 units, which would have required inspections every one to three years. However, the listing provided did not identify those units on which housing quality inspections were due. In addition, of the 37 projects, we were provided with documentary evidence to support only one (1) project whereby the required unit inspection reports were completed. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend DPD ensure procedures should be in place to ensure adequate documentation is maintained to support the evaluation of each subrecipient’s risk of noncompliance, as required by Federal regulations and internal policies. Also, documentation should be maintained to support that required inspections are performed to ensure that property standards are met, including identification of those units on which housing quality inspections are due, in accordance with 24 CFR 92.251(f). VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 42-43.

Subrecipient Monitoring Federal Department – U.S. Department of Treasury Federal Award Identification Number and Year: SLFRP0143 and 2021 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds, Federal Assistance Listing #21.027 County Department(s) – Various Finding 2025 – 002 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Section 200.332. Requirements for pass-through entities, requires that “A pass-through entity must: (b) ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the information provided below. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes: (1) Federal award identification. (i) Subrecipient's name (must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN)…(c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency)... (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. The Cook County, Illinois ARPA: Subrecipient Risk Assessment and Risk Reassessment Process Manual (dated May 16, 2024), states "If a subrecipient does not complete the risk reassessment by the assigned due date, their risk level will remain the same and they will be eligible for reimbursements only. Advancement requests will not be considered until the subrecipient completes the risk reassessment." Also, the level of monitoring to which the subrecipient must adhere to will vary by risk level assigned. The monitoring expectations associated with each risk level will be communicated to the subrecipient in the form of the risk reassessment and financial monitoring letter”. The monitoring parameters associated with each risk level are outlined below: • High Risk – minimum of monthly check-ins with County to share program progress, updates, and share programmatic questions/concerns • Medium Risk – minimum of monthly to quarterly check-ins with County to share program progress, updates, and share programmatic questions/concerns • Low Risk - minimum of quarterly check-ins with County to share program progress, updates, and share programmatic questions/concerns The Cook County ARPA Grants Compliance Guide, under External Risk Management, states "Federal grant regulations in Uniform Guidance require that all SLFRF-funded programs be conducted in a risk-informed manner, particularly the selection and monitoring of subrecipients that implement programming on behalf of Cook County. In order to assess the risk potential of external subrecipient partners, each subrecipient organization is assessed for risk as the beginning of their partnership with the County and assigned a risk rating of High, Medium, or Low. This rating informs the monitoring and documentation requirements for that subrecipient. Subrecipients are reassessed for risk annually to reflect any changes or improvements in their risk potential”. The Cook County ARPA SLFRG Grant Subaward Financial Management Manual (revised March 3, 2025), under Subaward Financial Management Roles and Responsibilities states that “as outlined in the risk assessment form, the level of monitoring will be based on subrecipient’s risk designation. The subrecipient will receive a risk assessment and financial management letter apprising it of the expectations associated with its assigned risk level”. In addition, under Section A. Advancement of Funds Process, Item VI. Shifting to Reimbursement Model, states “nine months prior to the program’s conclusion, no further advancements can be provided to a subrecipient. Unspent advance balances will be applied against subsequent expenses incurred and reported to the County. Some subrecipients may need working capital to maintain operations, and it will be the responsibility of the Department to create a drawdown schedule to ensure to the best of its ability that all advanced funds are expended and/or recouped by program-end”. CONDITION During the current audit period, the County performed inadequate monitoring of its subrecipients as required by its internal policies. CAUSE Based on discussions with management, the County instituted new internal guidelines for program and financial management of its State and Local Fiscal Recovery Funds (SLFRF) award. These guidelines included more strict monitoring controls than federal regulations require. Additionally, the County deployed a new grants management system specifically to assist in collection and reporting on program metrics and subrecipient financials. The grants management system went live in spring of 2024. The County continues to invest in compliance oversight and technical assistance to ensure its new guidelines are effectively implemented, particularly in relation to utilization of its grants management system. EFFECT Failure to adequately perform and document the risk assessments on its subrecipient(s) could result in inadequate monitoring of the activities and performance of a subrecipient. Also, this could result in Federal awards being used by the subrecipient for unauthorized purposes. QUESTIONED COSTS None. CONTEXT During our review of 40 subrecipients (of a population of 250 subrecipients), we noted the following:  For 1 subrecipient file, we noted one (1) monitoring log was completed. However, based on risk rating(s) assigned, a total of four (4) monitoring logs were required.  For 11 subrecipients, we noted the risk reassessments were expired, ranging from 167 to 920 days over the assigned due date. Of the 11 subrecipients, 6 had risk reassessments currently outstanding and 3 had advancement requests approved without a risk reassessment, both of which were contrary to County’s internal policies. The total amount advanced to the 3 subrecipients was $772,214.  We noted one subrecipient submitted advancement requests totaling $852,757 during the County’s fiscal year. Based on review of the supporting documentation, it appears these funds are actual reimbursement of costs previously incurred by the subrecipient and should have been submitted via a payment request(s) as opposed to an advancement request(s). Consequently, the SEFA reported total expenditures incurred of $594,815, instead of the total $852,757, resulting in a net understatement of $257,942. However, the subrecipient was compensated for all work that was performed.  We noted the County executed a subrecipient agreement (signed December 20, 2024) prior to verifying the subrecipient had an active Unique Entity Identifier (UEI) number (active date January 20, 2025) which is required by Federal regulation. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend County implement procedures to ensure adequate documentation (monitoring log) is maintained and timely completion of risk reassessment is conducted to support the evaluation of each subrecipient’s risk of noncompliance as required by Federal regulations and its internal policies. Also, the County should adhere to its written internal policies which require that advancement requests not be considered until the subrecipient completes the risk reassessment. In addition, the agreement with a subrecipient should not be executed without an active UEI, unless exceptions to these policies are clearly documented. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 44-45.

Program Income Federal Department – U.S. Department of Health and Human Services Pass-through Chicago Department of Public Health and AIDS Foundation of Chicago Federal Award Identification Number(s) and Year(s): H8900008 and 2025 H89HA00008 and 2023 HIV Emergency Relief Program Grants, Federal Assistance Listing #93.914 County Department –Cook County Health (CCH) Finding 2025 – 003 CRITERIA Per the U.S Department of Health and Human Services, Health Resources & Services Administration (HRSA) Policy Clarification Notice # 15-03, Clarification Regarding the Ryan White HIV/AIDS Program (RWHAP) and Program Income, Grant Policy Update 9/15/2025, states that in the context of the RWHAP, program income is most commonly generated by recipients and subrecipients as a result of charging for services and receiving payment from third-party reimbursement. Under the uniform administrative requirements, to the extent available, recipients and subrecipients must disburse funds available from program income, rebates, refunds, contract settlements, audit recoveries and interest earned on such funds before requesting additional cash payments. Also, recipients are required to track and account for all program income in accordance with 2 CFR § 200.302(b)(3). Additionally, it is the responsibility of the recipient to monitor and track program income earned by subrecipients. Subrecipients should retain program income for “additive” use within their own programs. 2 CFR Part 200.307, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Program income. (a) General. The recipient or subrecipient is encouraged to earn income to defray program costs when appropriate. Program income must be used for the original purpose of the Federal award. Program income earned during the period of performance may only be used for costs incurred during the period of performance or allowable closeout costs. See § 200.472(b). Program income must be expended prior to requesting additional Federal funds. Program income exceeding amounts specified in the Federal award may be added to or deducted from the total allowable costs in accordance with the terms and conditions of the Federal award. CONDITION During the current audit period, Cook County Health (CCH) did not comply with federal regulations regarding the use and reporting of program income as it relates to funds awarded through the RWHAP. CAUSE Based on discussions with management, the HIV grants transitioned to CCH from an external organization in July 2025. Award amounts were granted in multiple phases, requiring four budget revisions, with the final revision approved in December 2025. The contractual period covered March 2025 through December 2025. During the transition period, CCH lacked formal operational procedures to identify, record, and track program income, as well as several operational and administrative challenges which contributed to this issue. EFFECT Failure to adequately track and report program income is a violation of Federal regulations and could result in the return of funds to the Federal government. QUESTIONED COSTS None. CONTEXT Based on initial discussions with CCH management, the RWHAP did not generate any program income during the period from December 1, 2024 to November 30, 2025. However, during our review of patient’s eligibility documentation, we noted certain participants insurance were billed for services performed under the federal program, thereby representing payments received from third-party reimbursements. Consequently, CCH was able to provide a patient payment report showing HIV diagnosis via its Invision and CPA Cerner systems which included $2,937,999 in total payments and $47,784 in total patient payments received during the period. We noted this information was not reported as program income to the two grantor agencies during the period ended November 30, 2025. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend that CCH implement written policies and procedures to ensure that program income is tracked and monitored to ensure accurate reporting to its grantor agencies. Also, procedures should be in place to properly allocate all program income to the RWHAP and to ensure that future funds disbursed from available program income are utilized for eligible program activities prior to requesting any additional reimbursement (cash payments) from the grantor agencies as required by 2 CFR Part 200.307. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 46-47.

Reporting Federal Department – U.S. Department of Homeland Security Pass-through Illinois Emergency Management Agency Federal Award Identification Number and Year: EMW-2021-SS-00001 and 2021 EMW-2022-SS-00025-S01 and 2022 EMW-2023-SS-00013 and 2023 EMW-2024-SS-05137 and 2024 Homeland Security Grant Program, Federal Assistance Listing #97.067 County Department – Department of Emergency Management and Regional Security Finding 2025 – 004 CRITERIA As required by the 2024 grant agreement(s) with the State of Illinois, Illinois Emergency Management Agency (IEMA), Section 10.1 and 11.1, states that Grantee must submit financial and performance reports as requested and in the format required by Grantor no later than the dues date(s) specified in PART TWO or PART THREE. Grantee must submit quarterly reports with Grantor describing the expenditure(s) of the funds related thereto, unless more frequent reporting is required by the Grantee due to the funding source or pursuant to specific award conditions. 2 CFR 200.208. Any report required by 30 ILCS 708/125 may be detailed in PART TWO or PART THREE. Grantee must report to Grantor on the performance measures listed in Exhibit D, PART TWO or PART THREE at the intervals specified by Grantor, which must be no less frequent than annually and no more frequent than quarterly, unless otherwise specified in PART TWO, PART THREE, or Exhibit E pursuant to specific award conditions. For certain construction-related Awards, such reports may be exempted as identified in PART TWO or PART THREE. 2 CFR 200.329. Under Exhibit D, Performance Measures and Standards, states that the Grantee shall provide a quarterly Reimbursement Request and Reporting Form to IEMA-OHS within thirty (30) days after the end of the quarter throughout the performance period of the Agreement. The Grantee must submit a final Reimbursement Request and Reporting Form to the Grantor within 30 days after the expiration of the Agreement, or within 30 days of completion of all approved projects, whichever occurs first. Performance standards include: 1. Appropriate use of grant funds in accordance with the approved scope of work and budget outlined in Section 2.3, and the terms outlined in this Agreement; 2. The timely submittal of required documentation, as defined in this Agreement; and 3. Adequate results from grant monitoring conducted by the Grantor. CONDITION During the current audit period, Cook County Department of Emergency Management and Regional Security (DEMRS) did not comply with the reporting requirements as outlined in its grant agreement(s). CAUSE Based on discussions with management, this finding occurred due to significant turnover in key finance and grants management positions, which created gaps in continuity and delayed the Department’s transition to IEMA’s Amplifund reporting system. As prior management departed and new staff were onboarded, the Department faced operational challenges that affected the consistency of its grant reporting processes. Due to Amplifund’s requirement that reimbursement requests be submitted sequentially before performance reports can be filed, the delays in prior‑period submissions prevented DEMRS from accessing and submitting the quarterly reports. Statewide pauses in FEMA and IEMA grant processing further contributed to the backlog. EFFECT Failure to prepare and submit required reports is a violation of federal regulations and impairs the grantor agency’s ability to adequately monitor the program activities/federally funded program and could result in the loss of grant funding. QUESTIONED COSTS None. CONTEXT During the County’s fiscal year ended November 30, 2025, DEMRS had four (4) active grant agreements with IEMA, which represented a total of 16 quarterly reimbursement requests (reports) and 1 final close-out report that were required to be submitted during this period. As a result, we selected for review a total of 8 quarterly reports and the 1 final close-out report required under the 2021 IEMA grant agreement, which ended August 31, 2025. Based on discussions with management and review of the grantor payment request portal, we noted DEMRS did not submit any of the required quarterly reports due under the 2022, 2023 and 2024 grant agreements. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend that DEMRS develop and implement procedures to ensure required reports are prepared, reviewed, and submitted in a timely manner and in compliance with its grant agreements A compliance calendar of all future grants reporting due dates should be maintained to assist with ensuring future compliance with reporting requirements. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 48.