The following findings represent significant deficiencies and/or instances of noncompliance, including questioned costs, required to be reported in accordance with Uniform Guidance 2 CFR 200.516. Finding Number 2025‐001 Program: Continuum of Care Assistance Listing Number: 14.267 Federal Grantor: U.S. Department of Housing and Urban Development Passed‐through: N/A – Direct Assistance Award No. and Year: MD0523H3G012200 (2025) Compliance Requirements: Reporting – Annual Audit of Financial Statements and Schedule of Expenditures of Federal Awards Type of Finding: Instance of Non‐Compliance Criteria: Under the Uniform Guidance, a pass‐through entity is required to ensure that every subaward is clearly identified to the subrecipient as a subaward and includes required federal award identification information. Required subaward information includes, among other items, the federal award, the subrecipient name and unique entity identifier, the Assistance Listing title and number, the dollar amount made available under each federal award, and the Assistance Listing number at the time of disbursement. If any required data elements change, the changes must be included in subsequent subaward notifications, and when certain information is not available, the pass‐through entity must provide the best information available to describe the federal award and subaward. In addition, 2 CFR § 200.332 requires a pass‐through entity to evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring needed. In performing this evaluation, the pass‐through entity should consider factors such as the subrecipient’s prior experience with the same or similar subawards, results of previous audits, whether the subrecipient has new personnel or new or substantially changed systems, and the extent and results of any monitoring by the federal agency. Section III – Federal Award Findings and Questioned Costs (continued) Condition: During our testing of the Continuum of Care Program subrecipient monitoring compliance requirement, we noted that the Organization did not maintain sufficient documentation to demonstrate compliance with certain pass‐through entity requirements under 2 CFR § 200.332. Specifically, for the items tested, the following required elements were not clearly evident or documented: 1. Subrecipient identification on the subaward — The subrecipient name and unique entity identifier were not clearly evident on the subaward documentation. 2. Federal award identification and funding information — The subaward documentation and related disbursement support did not clearly identify the federal award, the Assistance Listing Number and Name. 3. Subrecipient risk assessment — The Organization did not document that it evaluated each subrecipient’s risk of noncompliance for the purpose of determining the appropriate level and nature of subrecipient monitoring related to the subaward. Context: The Organization received and administered HUD Continuum of Care Program funding during the year ended December 31, 2025. The Organization acted as a pass‐through entity for certain program funds and made subawards to a subrecipient to carry out program activities. Our audit procedures included testing a sample of $225,115 in subawards, representing all subrecipient disbursements during the audit year. We identified five exceptions related to required subaward identification information and documented subrecipient risk assessments. Cause: The Organization did not have sufficiently designed or consistently implemented procedures to ensure that all required federal award identification elements were included in subaward documentation and communicated at the time of disbursement. In addition, the Organization’s subrecipient monitoring process did not include a formal, documented risk assessment process for each subrecipient, or such documentation was not retained in a manner sufficient to demonstrate compliance. Effect / Potential Effect: Failure to include required federal award identification information in subaward documents and at the time of disbursement may result in subrecipients not being adequately informed of applicable federal award requirements, including the specific federal program, Assistance Listing information, and amount of federal funds subject to compliance requirements. Section III – Federal Award Findings and Questioned Costs (continued) Effect / Potential Effect: (continued) Failure to document subrecipient risk assessments may result in the Organization not identifying subrecipients, requiring enhanced monitoring or additional award conditions. As a result, monitoring activities may not be appropriately tailored to the subrecipient’s risk of noncompliance, which could increase the risk that program funds are not administered in accordance with federal statutes, regulations, and the terms and conditions of the federal award. Questioned Costs: No questioned costs were identified as a result of this finding because the exceptions noted relate to required subaward identification, communication, and risk assessment documentation, and the audit procedures performed did not identify specific unallowable costs associated with these exceptions. Recommendation: We recommend that the Organization strengthen its policies and procedures over subrecipient monitoring to ensure compliance with 2 CFR § 200.332. Such procedures should include, at a minimum: 1. Standardized subaward templates that require inclusion of all applicable federal award identification elements, including subrecipient name, unique entity identifier, Assistance Listing Number and Name, federal award identification information, the amount of federal funds obligated or made available, and other required subaward terms. 2. Disbursement‐level review procedures to ensure the Assistance Listing number and applicable federal award information are identified and communicated when required at the time of disbursement. 3. Documented risk assessments for each subrecipient, performed and retained in the grant file, that consider relevant risk factors such as prior experience with similar awards, audit results, changes in personnel or systems, and results of federal or other monitoring. 4. Risk‐based monitoring plans that link the results of each subrecipient’s risk assessment to the type, timing, and extent of monitoring activities to be performed. 5. Supervisory review and retention controls to verify that required subaward information and risk assessment documentation are complete before subawards are executed and funds are disbursed. Views of Responsible Officials / Corrective Action Plan: Management agrees and will implement our recommendations.