Audit 407987

Federal Award Identification: 2023-70417-39322 Federal Program: American Rescue Plan Technical Assistance Investment Program Assistance Listing: 10.234 Federal Agency: U.S. Department of Agriculture Pass-through Entity: Not applicable - direct award Award Period Audited: Fiscal year ended December 31, 2025 Criteria: The Uniform Guidance and the terms and conditions of the American Rescue Plan Technical Assistance Investment Program require non Federal entities to submit required financial reports, including the SF 425 Federal Financial Report, within prescribed timeframes. Annual financial reports are generally due within 90 calendar days after the end of the reporting period, unless otherwise specified by the federal awarding agency. Condition: Ecotrust and its Subsidiaries (collectively, the Organization) did not submit the required annual SF 425 Federal Financial Report for the fiscal year ended December 31, 2025, within the prescribed timeframe. The report was submitted after the applicable due date but prior to the issuance of the auditor’s reports. Context: This condition was identified during testing of the Reporting compliance requirement. As part of audit procedures, we inquired of management regarding the status and timing of submission of the SF-425 Federal Financial Report. In connection with these procedures, we also noted that the SF 425 for the fiscal year ended December 31, 2024 had not been submitted within the prescribed timeframe. Cause: The condition resulted from a misunderstanding of applicable federal reporting requirements and unclear assignment of responsibility for federal financial reporting, including inadequate procedures to ensure reporting requirements were monitored during staff absences. Effect: As a result, the Organization did not ensure timely submission of required SF 425 Federal Financial Reports, resulting in noncompliance with federal reporting requirements. This condition indicates that internal controls over federal reporting were not operating effectively with respect to the timely submission of required reports, potentially limiting the federal awarding agency’s ability to perform timely oversight and monitoring. Known Questioned Costs: None. Repeat Finding Status: This is a new finding for the year ended December 31, 2025. Recommendation: The Organization should strengthen controls over federal financial reporting to ensure required SF 425 Federal Financial Reports are submitted timely in accordance with 2 CFR 200.328 and applicable award terms. Such controls should include clearly defined responsibility for federal reporting, procedures to ensure continuity of reporting during staff absences, and periodic training to reinforce awareness of federal reporting requirements. Views of Responsible Officials: Management agrees with the finding. Management acknowledges that the SF 425 Federal Financial Report was not submitted within the prescribed timeframe and has indicated that corrective actions will be taken to strengthen controls over the timely submission of required federal financial reports.

Federal Award Identification: 2023-70417-39322 Federal Program: American Rescue Plan Technical Assistance Investment Program Assistance Listing: 10.234 Federal Agency: U.S. Department of Agriculture Pass-through Entity: Not applicable - direct award Award Period Audited: Fiscal year ended December 31, 2025 Criteria: 2 CFR 200.332(c) requires pass through entities to evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring. In addition, 2 CFR 200.332(e) requires pass through entities to monitor subrecipients to ensure compliance with Federal statutes, regulations, and the terms and conditions of the subaward, including review of financial and performance information and follow up on identified issues. Condition: During the audit, it was determined that for all (2) subrecipients tested, the Organization did not document subrecipient risk assessments and, for one subrecipient tested, did not demonstrate that elevated risks were used to determine or adjust the nature, timing, or extent of subrecipient monitoring. Management identified one subrecipient as having recurring federal award findings, including material weaknesses reported in prior Single Audits. Despite this known elevated risk, the Organization applied the same baseline subrecipient monitoring procedures to all (2) subrecipients under the major program. Context: The deficiency was identified during audit testing of subrecipient monitoring controls and inquiry of management. Cause: The deficiency resulted from the absence of formal policies and procedures requiring documentation of subrecipient risk assessments and requiring that identified risks be used to determine and document the appropriate level of subrecipient monitoring. Effect: This significant deficiency in internal control over compliance created a reasonable possibility that material noncompliance with subrecipient monitoring requirements would not be prevented or detected on a timely basis. However, no instances of noncompliance were identified. Although no questioned costs were identified, the deficiency increased the risk that noncompliance could occur and remain undetected. Known Questioned Costs: None. Repeat Finding Status: This is a new finding for the year ended December 31, 2025. Recommendation: The Organization should implement formal, documented policies and procedures for risk-based subrecipient monitoring to ensure that monitoring activities are tailored based on subrecipient risk levels. This should include documented consideration of subrecipient audit results and retention of documentation supporting the performance and results of enhanced monitoring procedures for higher risk subrecipients. Views of Responsible Officials: Management agrees with the finding. Management acknowledges that subrecipient risk assessments were not formally documented and that monitoring activities were not adjusted based on identified risk levels. Management has indicated that corrective actions will be taken to implement a documented, risk based approach to subrecipient monitoring.