Corrective Action Plans

Noncompliant GLBA Information Security Controls - SFA - UM - The University of Montana - Missoula has enhanced its annual review process to include verification that each federally required information security program element is supported by a current and formally approved policy or standard. The revised review process will also identify and document any required element that lacks supporting policy documentation so corrective action can be taken in a timely manner. The university implemented standards addressing encryption of customer information, multifactor authentication, and logging and monitoring of user activity on January 8, 2024, February 27, 2024, and April 4, 2024, respectively. These standards remain in effect and are reviewed annually as part of the university’s information security program review process to ensure continued compliance with federal requirements and to address any future regulatory changes. Responsible Party - Jonathan Neff, Chief Information Security Officer, University of Montana - Missoula Target Implementation Date - 9/30/2026

Noncompliant Direct Loan Reconciliation Controls - SFA - MSUB - The Montana State University - Billings concurs with the finding and has taken corrective action to strengthen segregation of duties within the cash management reconciliation process. While the reconciliation process has historically involved both Financial Aid and Financial Services personnel, the reconciliation and review were performed inconsistently within the Financial Aid office. Effective immediately, Financial Aid and Financial Services have implemented a monthly reconciliation meeting to jointly review and validate the cash management reconciliation. During this meeting, Financial Services provides reconciliation information from the University’s financial records, and Financial Aid independently extracts and reviews corresponding information from the Banner system and the Common Origination and Disbursement system. Any discrepancies identified are discussed and resolved collaboratively. The monthly meeting and review process will be documented and retained as evidence of review and approval. This enhanced process establishes a formal review control involving personnel from separate offices and strengthens segregation of duties over the cash management reconciliation process. Responsible Party - Justin Beach, Director of Financial Aid & Scholarships, Montana State University - Billings Rebecca Bunn, Controller, Montana State University - Billings Target Implementation Date - 8/31/2026

Inadequate Grant Reconciliations - SPED - OPI - The Montana Office of Public Instruction will update procedures and desk manuals to ensure monthly reconciliations for federal programs between the agency’s grant system, the state’s accounting system, and a manually updated tracking spreadsheet contain adequate documentation and verify federal compliance. Responsible Party - April Grady, Chief Financial Officer, Montana Office of Public Instruction Target Implementation Date - 9/30/2026

Inaccurate and Unsupported Maintenance of State Financial Support - SPED - OPI - The Montana Office of Public Instruction partially concurs with this finding. The Office developed a standardized process and process manual for maintenance of effort in December 2025. The Office will follow this process in future years to ensure the tracking spreadsheet uses budget allocations from the same data query for all years and all agencies. During the audit period, this funding allocation for the Office was combined into Base Aid and is separated in the budget system rather than in the accounting system. Staff will continue to follow the standardized process and process manual to ensure consistency. Responsible Party - April Grady, Chief Financial Officer, Montana Office of Public Instruction Target Implementation Date - 12/31/2026

Inadequate Assurance Over Controls at Service Organization - SNAP - DPHHS - The Montana Department of Public Health and Human Services does not concur. The department agrees that 7 CFR 274.8(b)(3)(i) requires the state agency to ensure that its electronic benefit transfer system includes storage and control measures for blank unissued cards. The department satisfies this requirement through controls operated by its contracted electronic benefit transfer vendor rather than through state‑held card stock. The department does not concur that this control is absent. As provided in 2 CFR 200.511(c), the explanation below describes why corrective action is not required. The department does not issue electronic benefit transfer cards over the counter. All card manufacture, personalization, storage, and mailing occur within the contracted vendor’s centralized issuance environment. No blank unissued cards are held in department offices or accessible to staff or the public. Blank unissued cards contain no benefits, are not associated with a participant account, and cannot be activated without a corresponding record in the electronic benefit transfer system. Their only intrinsic value is the cost of the card stock. The vendor conducts risk assessments and monitors subcontractors responsible for card stock. Independent assurance is provided through the system and Organization Controls (SOC) report, which confirms that these assessments and monitoring controls are fully implemented. Centralized issuance significantly reduces opportunities for unauthorized access, making the risk associated with blank unissued cards very low in Montana. The department also performs reconciliations independent of benefit issuance and redemption. Eligibility determinations in the departments eligibility system (CHIMES) are reconciled to the vendor’s records; retailer transactions are reconciled to the banking system; recipient transactions are reconciled to redeemed benefits; and funds drawn from the federal treasury are reconciled to the federal draw system. The department’s card monitoring controls address replaced, returned, and excessive card requests. These enhanced controls align higher‑risk activities with appropriate safeguards and oversight. Responsible Party - Brenda Crawford, Internal Control and Compliance Officer, Montana Department of Public Health and Human Services Target Implementation Date - N/A

Inadequate HDS System Access Controls - HVC - Commerce - The Montana Department of Commerce has developed a user access review procedure to be performed semiannually. The first review was completed in June 2026. Responsible Party - Ingrid Mallo, Chief Financial Officer, Montana Department of Commerce Target Implementation Date - 12/16/2026

Inadequate HAP Reconciliation Controls - HVC - Commerce - The Montana Department of Commerce has provided additional staff training to ensure housing assistance payments are issued timely, even though the error rate was less than one percent. Responsible Party - Ingrid Mallo, Chief Financial Officer, Montana Department of Commerce Target Implementation Date - 8/19/2026

Inadequate HAPPY System Access Controls - HVC - Commerce - The Montana Department of Commerce began conducting user access reviews during the audit period. The department’s Chief Information Officer updated the Access Control Policy and distributed it to all employees. Staff received training on access control requirements on May 28, 2026. The department plans to obtain a new vendor to replace the HAPPY system by October 2028. Responsible Party - Ingrid Mallo, Chief Financial Officer, Montana Department of Commerce Target Implementation Date - 10/31/2028

Inadequate Field Agent Payment Controls - HVC - Commerce - The Montana Department of Commerce has updated its processes to ensure that contract limits are reviewed prior to payments being issued and that contract amendments are pursued when needed. Responsible Party - Ingrid Mallo, Chief Financial Officer, Montana Department of Commerce Target Implementation Date - 8/24/2026

Inadequate HQS Inspection Controls - HVC - Commerce - The Montana Department of Commerce has updated its inspection procedures to clearly outline requirements, including annual reexaminations. While the department may have lacked documentation of certain monthly reports, both the fiscal year 2024 and fiscal year 2025 Section 8 Management Assessment Program Indicator 12 inspection reviews received all available points. The department is also transitioning to the National Standards for the Physical Inspection of Real Estate (NSPIRE) model for inspections. Staff completed training on June 16, 2026, and have begun using the federal inspection checklist to ensure compliance with current standards. Responsible Party - Ingrid Mallo, Chief Financial Officer, Montana Department of Commerce Target Implementation Date - 9/18/2025

Inadequate FASS Reporting Controls - HVC - Commerce - The Montana Department of Commerce has developed procedures for the Financial Assessment Subsystem (FASS) reports to ensure they are complete and accurate and that the reviews of these reports are sufficiently documented. Responsible Party - Ingrid Mallo, Chief Financial Officer, Montana Department of Commerce Target Implementation Date - 8/20/2026

Noncompliant FFATA Reports - Nutrition - OPI - The Montana Office of Public Instruction does not concur with the portions of the finding related to historical reporting issues that were fully resolved in the prior audit, including the deletion of historical reports and resubmission of final versions. Earlier discrepancies resulted from concurrent reports within the federal reporting system, which caused amounts to duplicate. Federal partners verbally confirmed the system correction, and SAM.gov was updated at the beginning of fiscal year 2026. These issues were attributable to federal system functionality rather than to the Montana Office of Public Instruction, and reporting was completed as directed. The Office concurs with the portion of the finding involving discrepancies associated with prior‑period adjustments. After awards were liquidated and closed, the Office submitted final reports using complete expenditure data. Subsequent adjustments created differences between the Office’s internal records and federal reporting. For ALN 10.582, the Office concurs with the finding but does not agree that the Office is responsible. SAM.gov did not recognize the Federal Award Identification Number, preventing submission of required reports. This issue was later identified as a broader system problem affecting agencies nationwide. To address the recommendation, the Office will update internal FFATA guidance to ensure continued compliance with federal requirements. Documentation will be retained, and reconciliations will verify values reported in both USAspending and SAM.gov. These actions strengthen internal controls and support timely, accurate reporting. Responsible Party - April Grady, Chief Financial Officer, Montana Office of Public Instruction Target Implementation Date - 12/31/2026

Inadequate Physical Inventory Procedures - Nutrition - OPI - The Montana Office of Public Instruction partially concurs with this finding. The 1,000 cases of beef arrived on June 12 for the next fiscal year, while the physical inventory count occurred on June 3. The order had been entered into MAPS before the count, but the product had not yet arrived at the warehouse. When MAPS reporting was run after June 12, during verification, the beef appeared in the system even though it was not present during the physical count. The product was distributed during the following school year. This discrepancy was due solely to timing between delivery, system entry, and the inventory count. Because of staff turnover, the employee entering inventory into MAPS was not aware that items should only be entered once they are physically received. The invoice was entered before delivery, while inventory was being performed, creating a short‑term difference between the MAPS count and the actual inventory. This was a training issue, and staff have now been instructed on correct inventory procedures. Responsible Party - April Grady, Chief Financial Officer, Montana Office of Public Instruction Target Implementation Date - 12/31/2026

Noncompliant Obligations and Cost Transfers - CCDF - DPHHS - The Montana Department of Public Health and Human Services partially concurs. The department acknowledges that, in certain cases, documentation did not sufficiently demonstrate compliance with obligation‑period requirements when costs were moved between grant years. Regarding the $273,474 in known questioned costs, the department agrees that compliance with the liquidation period alone is not sufficient and that an obligation‑period evaluation should have been performed and documented. However, the department disagrees with the remaining $17,300,599 in questioned costs. The department maintains that all of the costs are allowable, fully supported, and within the applicable liquidation period. Much of the accounting activity included in the total questioned costs was not the result of moving costs between grant periods but rather necessary corrections to ensure accuracy in financial reporting. The department believes it is in compliance with the period of performance requirements. The department will reevaluate its obligation processes and further strengthen procedures to ensure systematic compliance. The department will establish a written obligation policy and procedure documenting the point of obligation, reinforce obligation‑tracking and documentation protocols, and establish enhanced review processes when activity is moved between grant years. These measures will ensure consistent application of obligation dates and compliance with federal regulations. Responsible Party - Brenda Crawford, Internal Control and Compliance Officer, Montana Department of Public Health and Human Services Target Implementation Date - 12/31/2026

Noncompliant FFATA Reports - CCDF - DPHHS - The Montana Department of Public Health and Human Services partially concurs. The department agrees that internal control deficiencies existed in its subaward reporting processes under the Federal Funding Accountability and Transparency Act (FFATA) during fiscal years 2024 and 2025, and that instances of noncompliance occurred. The department does not concur with the quantified extent of the exceptions, including report counts and reporting figures. The department has been unable to replicate the amounts noted and did not receive sufficient detail, as outlined in 2 CFR 200.516(b), to fully understand the specific errors identified. In response to a prior audit recommendation, the department implemented corrective actions to strengthen its internal controls and review processes. These actions included enhanced oversight and the identification and correction of duplicate and inaccurate records. Many of these duplication issues originated from data quality challenges within the former federal reporting system. When the federal reporting system transitioned to the System for Award Management in state fiscal year 2026, many of those data quality concerns were eliminated. The department corrected most of the duplicated and inaccurate records that migrated from the former system to the new one. The department also enhanced its internal controls and revised its policies and procedures for reporting under FFATA. Responsible Party - Brenda Crawford, Internal Control and Compliance Officer, Montana Department of Public Health and Human Services Target Implementation Date - 7/23/2025

CORRECTIVE ACTION PLAN2025-001 [2023-001]—TRACKING AND VALUATION OF MORTGAGE RECEIVABLES AND AMOUNTS DUE TO GRANTORType of Finding: (A) Material Weakness in Internal Control Over Financial ReportingStatement of ConditionWhile the Housing Trust has begun a complete review of its loan portfolio, the project has not yet been completed. Therefore, we were unable to obtain sufficient audit evidence to support the Housing Trust’s tracking and valuation of its mortgage receivables and amounts that are due to grantor.Per our audit procedures, we noted that management was unable to provide the following:A reasonable methodology for estimating its allowance for loan losses.Funding provided by grantors for the loan programs that should also be classified as amounts that are due to grantor.Not all current year loans were recorded in the general ledger (approximative $512,066) and approx. $481,201 were recorded twice.A net prior year adjustment of $36,460 for mortgages receivable and $35,000 for land leases held was necessary.Reclassification between loans accounts and grant revenue were necessaryContextThe Housing Trust has a portfolio of over six-hundred individual mortgage receivables that include both non-amortizing and amortizing loans, which management has valued at approximately $25,291,075. These loans have been funded by several sources, including federal, state, and local funding. Some of the grantors have established in their agreements that these funds do not belong to the Housing Trust, but actually belong to the grantor. CriteriaThe Housing Trust should ensure it has a board-approved policy for its loan portfolio to ensure that these assets are properly tracked, classified, and maintained with specialized loan management software that can perform the following:Loan Classification and TrackingEach loan is properly identified with its funding source (federal, state, local, etc.) and type of restriction Each loan agreement has the funding source specifiedThe current status of each loan is tracked (current, delinquent, defaulted)Loan funding that has been established as due to the grantor is properly tracked.Compliance and ReportingEnsure the loans comply with the specific guidelines of their respective funding source. Audit trails are available for all transactions and valuations.The receivables and related interest accruals supported by the loan management software should be reconciled to the Housing Trust’s accounting software.Financial TrackingThe valuation of the portfolio should be updated periodically (at least quarterly) for any changes in loan status or market conditions.All new loans should be recorded in the general ledger A loan loss policy was established that includes a loan loss methodology incorporating risk classes based on the borrower’s ability to repay. However, the calculations seem to follow a different methodology established afterwards. The policy should be updated with calculation methodology and with the backup research of historical data. A loan review committee should be responsible for reviewing and approving the classifications of loans and the associated allowance for loan losses which should be supported by high-quality data collection on each borrower’s payment history and any relevant economic indicators. The calculations and methodology should follow the approved policy, or the policy should be improved to include all factors mentioned above.EffectThe auditors were not able to verify the accuracy of the loan records and financial statements related to mortgage loans, the related accrued loan interest, the allowance for loan losses and loan funding that should also be recorded as due to grantor. CauseWhile the Housing Trust has begun a complete review of its loan portfolio, the project has not yet been completed. Therefore, the loan portfolio tracking and valuation have not yet been designed or implemented to support its policies and procedures or provide the loan review committee with a workable system for reviewing, approving and monitoring the organization’s mortgage receivable portfolio. The methodology seems to be changing, and the calculations do not seem to be accurate,RecommendationWe recommend the Housing Trust update policies and procedures for its loan portfolio as identified in the “Context” section of this finding to include methodology, risk assessment, historical loan data research, calculations method with reasoning.View of Responsible OfficialThe Housing Trust acknowledges the finding. Due to turnover in prior years, historical loan records and tracking systems were incomplete or inaccurate. Since then, SFCHT has taken the following steps:A second title company has been contracted to obtain final loan data for the 2026 loan portfolio. A title company will also be engaged annually at year-end to identify and resolve any differences arising during the year.Establish one master loan inventory using Portfol data. This inventory will serve as the master loan control schedule for monthly financial reconciliations. All differences will have a documented resolution, including reconciliation of receivables and related interest between the two systems. Reconciliations will be completed by the 15th business day of the following month.Create a new loan-recording process for every loan closing.Create a Due to Grantor Matrix based on findings from the annual loan review performed by the title company. Supporting documentation, such as grant agreements, correspondence, or other applicable documentation, will be maintained.Review the ASC 326 loan loss methodology to ensure it reflects the actual calculation methodology and is supported by appropriate research. This review will be performed quarterly.Establish a formal loan review committee and process to review loan calculations and the allowance for loan losses. The committee will meet quarterly and review reports from Portfol. Meeting minutes will document updates, decisions, and changes.Corrective Action Plan TimelineFinalize and implement the loan loss methodology: by December 2026Begin monthly Portfol-to-QBO reconciliations: by September 2026Fully hand over all loans to Amerinat by end of 2026; Land Leases will remain “in-house”Continue staff training and Executive-level reviewDesignated Employee Responsible for Corrective Action-Director of Operations-Accounting Specialist2025-002 [2023-002]—FINANCIAL CLOSE AND RESTATEMENTS TO BEGINNING NET ASSETSType of Finding: (A) Material Weakness in Internal Control Over Financial ReportingStatement of ConditionDuring the audit of the financial statements, we noted that material adjustments and restatements were necessary to correct errors in the current and previously reported financial statements. A summary of the areas and the net effect of the changes are as follows: Type Amount, net Accounts Receivable $ (13,490) Grants and Contracts Receivable 830,747 Accrued Interest 5,798 Amortizing Loan Receivable 419,551 Non-Amortizing Loans Receivable (433,722) Land Held in Trust (61,323) Other Assets (145,000) Prepaid Expenses (61,940) Notes Receivable (195,000) Developments Projects (184,559) Real Estate Inventory to Sell (333,079) Fixed Assets (785,081) ROU Accumulated Amortization (7,511) Accounts Payable (807) Due to Grantor 10,000 Grant Advances (97,963) Accrued Expenses (6,249) Other Current Liabilities 52,841 Lease Liabilities 7,845 Notes Payable (9,710) Net Assets 1,154,733 Total $ 146,081 CriteriaAccounting Standards Codification (ASC) 265 “Presentation of Financial Statements—Communicating Internal Control Related Matters Identified in an Audit” requires that deficiencies in internal control over financial reporting be communicated to those charged with governance when the design or operation of a control does not allow management or employees to prevent or detect misstatements on a timely basis.The correction of material misstatements indicates the existence of a material weakness in internal control over the maintenance of the organization’s financial statements.EffectThe material adjustments and restatements resulted in significant changes to the current year balances and beginning balances of the organization’s unrestricted and restricted net assets. These adjustments could potentially undermine the stakeholders' confidence in the financial information presented by the organization and may lead to difficulties in securing future funding or maintaining current donor relationships.CauseThe material misstatements were caused by a weakness in the development and implementation of internal controls and financial reporting processes, as well as significant turnover in the organization’s management.RecommendationWe recommend the Housing Trust strengthens its internal controls and financial reporting processes to prevent future occurrences of such errors. This could involve adding additional staff, training current accounting staff and implementing more robust review procedures to ensure that all financial reporting is in strict accordance with GAAP. View of Responsible OfficialThe Housing Trust acknowledges the finding. In prior years, however, internal controls were insufficient. There was no formal month-end close or review process, and prior audits relied on outdated balances without verification. Under new leadershipA formal monthly close calendar has been established, with the monthly close to be completed within 10-15 business days.Create a supporting schedule for every balance sheet account. These schedules will be used as part of the monthly reconciliation process and will be certified.A grant receivable roll-forward will be prepared for each grant, compared to QuickBooks, and reconciled monthly.Each development project will have its own subledger, which will be reconciled monthly.A detailed fixed asset register will be maintained and reconciled quarterly.6. To help prevent future restatements, establish a formal journal-entry control process that requires appropriate supporting documentation and approvals.7. Establish a policy requiring documentation and approval for any changes made to beginning balances.8. The CEO and Finance Committee will perform monthly analytical reviews using the balance sheet, profit and loss statement, and actual-to-budget comparisons.9. Establish a reconciliation exception and audit adjustment log to track outstanding issues requiring resolution, including a timeline for resolving each item.Corrective Action Plan Timeline The timeline to complete this is prior to December 31, 2026.Designated Employee Responsible for Corrective Action-Director of Operations-Accounting Specialist2025-003 [2024-003] - GRANT TRACKING AND SEFA RECONCILIATIONFederal Agency: U.S. Department of Housing and Urban Development (HUD)Federal Program: Housing Opportunities for Persons With AIDS (HOPWA)Assistance Listing Number: 14.241Award Number and Period: [NMH240051], [November 1, 2024 – October 31, 2027]Type of Compliance Requirements: Internal Controls Type of Finding: (B) Significant Deficiency in Internal Control Over Financial ReportingKnown Questions Cost: NoneStatement of ConditionDuring our audit, we identified initial differences between expenditures reported on the Schedule of Expenditures of Federal Awards (SEFA) and the general ledger. Management subsequently provided additional supporting schedules and completed a reconciliation of the SEFA to the general ledger. However, the reconciliation required manual effort because one federal award included program income amounts that had not been properly reconciled or corrected, another federal award had expenses that did not belong to the award, and recycled funds were tracked separately partially only from new grant funds in the accounting records. Some of expenses did not have appropriate backup documentation, however, the billing to the grant was correct. Expenses from program income for salaries did not match the timesheets. CriteriaPer 2 CFR 200.302 and 200.510(b), recipients of federal awards must maintain accurate, current, and complete records that adequately identify the source and application of funds. Grant expenditures must be traceable to the financial records and properly classified. Program income, including recycled funds, must be used and tracked in accordance with federal requirements and grantee policies. Specifically, all grants should be tracked separately in the general ledger, and the revenue and expenses should match the reimbursement grants. The SEFA reconciliation should be done thoroughly and discrepancies reconciled or resolved, if that is the case. The policies for recycling the funds should be updated with the financial tracking in the general ledger and update with all grantor recommendations. The HOPWA program policy was updated in July 2025.The recycled funds received/spent should be separately tracked and used per policies and grantor recommendations.EffectThe lack of properly tracking expenditures and recycled funds increases the risk of misstating the SEFA, billing non-allowable or duplicate costs to the grantor, and not meeting timeliness or use restrictions related to program income. This may lead to questioned costs or future audit findings.Recycled funds not properly tracked separately may result in noncompliance with the application of loan funding. CauseThe issues stemmed from frequent staff turnover and the complexity of accounting for loans and recycled funds across departments. RecommendationWe recommend the Housing Trust:Revise and implement grant management policy and procedures that ensure each grant has a dedicated general ledger account.Require all reimbursement requests to be supported by general ledger detail.Ensure program income and recycled funds are separately tracked in accordance with federal guidelines (separate classes).Establish regular reconciliations between Finance and Program records to maintain consistency.View of Responsible OfficialThe Housing Trust acknowledges the finding. Corrective Action Plan: 1. A master grant register has been created that includes all active grants and federal awards.2. Each grant will have a unique class/project established in QuickBooks to capture payroll and other grant-related expenses. Reports will be generated monthly.3. Each grant will be reconciled monthly.4. Grant reimbursement requests will be supported by appropriate documentation.5. Payroll review procedures have been established to confirm that payroll costs are properly allocated to grants.6. Program income will be tracked separately for all applicable income and expenditures.7. Monthly SEFA reconciliations will be completed for all grants, including grants that do not meet the definition for inclusion in the SEFA.8. A grant reconciliation exception log will be established to track outstanding issues, responsible parties, and timelines for resolution. Corrective Action Plan Timeline- Finalize and adopt new Grant Management Policies: by September 2026- Implement monthly SEFA reconciliations: by September 2026- Complete staff training on program income and federal grant tracking: by September 2026Designated Employee Responsible for Corrective Action-Director of Operations-Accounting SpecialistCurrent Year Findings 2025-004 - Program Income Federal Agency: U.S. Department of Housing and Urban Development (HUD)Federal Program: Housing Opportunities for Persons With AIDS (HOPWA)Assistance Listing Number: 14.241Federal Award: [NMH240051], [November 1, 2024 – October 31, 2027]Compliance Requirement: Program Income Known Questions Cost: None Type of Finding: (F, G) Significant Deficiency in Internal Control Over Compliance of Federal Awards and Instance of Noncompliance related to Federal Awards Statement of Condition During 2025, the Housing Trust received certain repayments of loans originally funded by HOPWA awards. Of this amount, certain amount may have remained unspent or had not been recorded/reconciled in accordance with HUD requirements as of December 31, 2025. Management did not maintain a documented control to identify HOPWA repayment receipts, determine the applicable award requirements, reconcile receipts and expenditures among IDIS, QuickBooks, and the program-income subsidiary record, and document approval of their disposition. Criteria Under 2 CFR 200.307(c), program income earned after a Federal award’s period of performance is subject to Federal requirements only when required by Federal agency regulations or the terms and conditions of the award, and the Federal agency may establish appropriate disposition requirements through closeout. HUD may require HOPWA-funded loan repayments received after the original award period to be recorded as program income.CauseThe Housing Trust had not designed and assigned ownership of a formal program-income and grant-closeout control addressing repayments generated from HOPWA-funded loans after the originating award’s period of performance. Effect Program income may have been subject to incorrect or untimely reporting/use, increasing the risk of noncompliance and misstatement of federal expenditures. Known questioned costs were unknown. RecommendationHousing Trust should implement a documented monthly program-income reconciliation and grant-closeout control that identifies the originating award, applicable HUD disposition requirement, IDIS receipt, QBO classification, eligible use, remaining balance, reviewer approval, and resolution of differences. Evidence of HUD determinations for post-period receipts should be retained with the reconciliation.Views of Responsible Officials: SFCHT acknowledges the finding and notes that the New Mexico HOPWA program is the only documented HUD grant that funds mortgages.Management has established a formal process to identify and track repayments associated with HOPWA-funded loans. Management will maintain a subsidiary program income register that identifies the originating federal award, receipts, applicable HUD disposition requirements, accounting classification, eligible expenditures, and remaining balance. Program income activity will be reconciled monthly among loan-servicing records, QBO, IDIS, and supporting program records. Written HUD determinations regarding post-period repayments will be retained when applicable.Corrective Action Plan TimelineAn onsite meeting with HUD HOPWA representatives is scheduled for September 10, 2026, at the Santa Fe offices. During this meeting, policies and procedures, including the program income policy, will be reviewed and formalized, and a HUD determination log will be established.The HOPWA Program Income Register will be implemented, and repayment schedules for HOPWA loans will be documented in the master loan inventory. Implementation date: July 2026.HOPWA program income will be expended before additional HOPWA IDIS reimbursement requests are approved.A historical review of HOPWA loans and funding sources will be completed. Target date: August 2026.QBO, Portfol, Amerinat, and IDIS will be reconciled monthly. Beginning: July 2026 and ongoing.Post-period repayments and related HUD determinations will be reviewed. Target date: September 2026.Designated Employee Responsible for Corrective Action Director of Operations, with assistance from the Accounting Specialist and HOPWA HUD program staff, as applicable.Signature Title

Controls over Reporting Recommendation: The City should strengthen its internal controls over federal reporting by establishing formal procedures to monitor reporting deadlines, assigning responsibility for report preparation and review, maintaining a reporting calendar, and performing periodic supervisory reviews to ensure all required reports are submitted accurately and timely. Management Response: Management concurs with the recommendation. The Management Analyst will ensure accurate and timely grant reporting. Anticipated Completion Date: September 30, 2026 Responsible Party: GIna Sherman, Management Analyst

Finding 2025-001: Reporting – Community Development Block Grant/State’s Program and Non- Entitlement Grants in Hawaii Name of Contact Person: Ashley Carson, Chief Counsel Management’s Views and Corrective Action Plan: The Legal & Compliance Department is responsible for the submission of the Annual Performance Report for the Recovery Housing Program and agree with the finding. For 2025, MaineHousing was experiencing an error in HUD’s Disaster Recovery Grant Reporting (DRGR) system with submission of the report and reached out to HUD for assistance. HUD was non-responsive to the first two requests for assistance, and a third request was not made until after the report filing deadline. HUD responded to the third request and assisted by providing technical assistance which allowed the report to be submitted. The report was not filed in a timely manner due to the DRGR system errors and the elapsed time between follow-ups with HUD. As system errors for DRGR are a common issue, the following corrective action will ensure that MaineHousing is proactive in the submission of Annual Performance Report for Recovery Housing. The Annual Performance Report for the Recovery Housing Program is due on October 30th. No later than September 15th each year, MaineHousing will attempt to verify any issues with the DRGR system ahead of the reporting deadline and immediately reach out to HUD for technical assistance with any issues found. MaineHousing will gather the information for the Recovery Housing Annual Performance Report at least 45 days ahead of the October 30th deadline (if available) and attempt submission of that report no later than October 5th. If errors occur in DRGR in submitting the report, MaineHousing will immediately contact HUD and continue to follow up weekly until the issue is resolved, attempting other modes of contact if HUD is unresponsive. If the report cannot be submitted in a timely manner, MaineHousing will request that HUD confirm in writing that late submission is acceptable given the circumstances. Proposed Completion Date: Completed

Significant Deficiency Finding No. 2025-004: Reporting Views of Responsible Officials and Planned Corrective Action The Organization concurred with the prior year (2024-004) and current year renumbered recommendation (2025-004), acknowledging that the unexpected resignation of the former independent auditor (January 2023), and the domino effect of a delay in securing a new independent auditor (April 2023) and completion of single audits continued to challenge the Organization through the fiscal year ended June 30, 2025. The Organization notes the following: A. Status and Progress of Single Audits 1. Single Audit as of fiscal year ended (FYE) June 30, 2022, filed in the Federal Audit Clearinghouse (FAC) on February 20, 2025. 2. Single Audit as of FYE June 30, 2023, filed in the FAC on March 9, 2026. 3. Single Audit as of FYE June 30, 2024, filed in the FAC on June 20, 2026. 4. Single Audit as of FYE June 30, 2025, projected for filing in the FAC no later than September 30, 2026. Note: Once the FYE June 30, 2025, single audit is filed, the Organization will no longer be delinquent in filing its single audit in the FAC. 5. Single Audit as of FYE June 30, 2026, engagement letter signed with scheduled field work to commence after the June 30, 2025, FAC filing (e.g., November 2026); with a projected on-time FAC filing no later than March 31, 2027, in compliance with 2 CFR §200.514 – Standards and scope of audit; and 2 CFR §200.512 – Report submission via Form SF-SAC: Data Collection Form, nine months after year end of the audit period. B. Policy, Process and Communications re: Single Audits, the Organization implemented the following policy, process and communications practices: 1. Financial Policies: Internal Control Environment Policy, Implementation of Significant Accounting Policies. 2. Process: Review and Approve Audit Report, including Financial Statements. 3. Communication of the status of the single audit(s) via Memo to the Board occurred in February, March, May, June and August 2026; and as a continuing practice will be completed for each Board meeting.Finding No. 2025-004: Reporting Contact Person(s) Responsible for Corrective Action: Sheri Daniels, Ed.D., Chief Executive Officer, Marisa Wilson, Director of Administrative Operations and Sylvia Hussey, Ed.D., Chief of Staff.

Condition During testing of cash disbursements, the audit team was unable to locate adequate supporting documentation for selected transactions sufficient to determine whether the costs charged were allowable and the activities were allowed under the applicable federal award(s). Documentation such as invoices, receipts, contracts, approvals, or evidence linking the expenditure to an allowable activity could not be located or provided by the Institute. Criteria Per 2 CFR § 200.403, costs charged to a federal award must be necessary, reasonable, and adequately documented. Per 2 CFR § 200.302 and § 200.334, non-federal entities must maintain financial records, including source documentation (e.g., invoices, receipts, canceled checks, time and effort records) that support the allowability, allocability, and reasonableness of costs charged to federal awards, and these records must be retained and readily accessible for a minimum of three years. Additionally, 2 CFR § 200.404 and § 200.405 require that costs be allocable and consistently applied to allowable program activities. Cause The Institute's recordkeeping and document retention practices did not ensure that supporting documentation for cash disbursements was consistently maintained, organized, or readily retrievable. This may be attributable to insufficient internal controls over document retention, lack of a centralized filing/records system, or turnover in staff responsible for maintaining disbursement records. Effect Without adequate supporting documentation, the Institute cannot demonstrate that disbursed funds were used for allowable costs and allowed activities in accordance with the terms of the federal award(s). This exposes the Institute to the risk of questioned costs, disallowed expenditures, required repayment to the funding agency, and potential findings of noncompliance in future audits. It also limits the Institute's ability to demonstrate accountability and stewardship over federal funds. Recommendation We recommend that the Institute strengthen internal controls over cash disbursements to ensure supporting documentation (invoices, receipts, approvals, and evidence of allowable activity) is obtained and retained for every transaction prior to disbursement. The Institute should implement a centralized, organized recordkeeping system (physical or electronic) for disbursement documentation, with clear responsibility assigned for maintenance and retrieval. The Institute should also provide training to relevant staff on documentation retention requirements under 2 CFR Part 200. Management’s Response Management agrees with the finding and recommendation. The Institute recognizes that complete and readily retrievable supporting documentation is necessary to demonstrate the allowability, allocability, and reasonableness of costs charged to all awards. Management will strengthen its cash disbursement and record-retention procedures to ensure invoices, receipts, approvals, contracts, and other applicable supporting documentation are maintained for each transaction. Action Taken The Institute implemented a centralized electronic recordkeeping process for cash disbursement documentation and assigned responsibility for maintaining and retrieving supporting records. Documentation supporting the expenditure and applicable approvals are retained with the transaction records. Relevant staff have been instructed on documentation and record-retention requirements applicable to federal awards. Management will hold an annual training at the beginning of the new fiscal year available to all ERI employees.

2025-003 – WRITTEN POLICIES AND PROCEDURES REQUIRED BY THE UNIFORM GUIDANCE (REPEAT) Corrective Action Plan: Management developed written policies and procedures related to federal awards, which were formally adopted by the City Council at the June 18, 2025 Council meeting. Responsible Party(ies): • City Council • City Manager • Deputy City Manager / Finance Director Anticipated Completion Date: June 18, 2025.

Internal control deficiency and noncompliance over procurement. Banner has a policy for the procurement of federally funded goods and services that fully complies with the Uniform Guidance standards, prescribed by the Office of Management and Budget, for managing federal awards. This policy was not followed when evaluating and selecting the general contractor for a Wyoming Medical Center construction project that was being partially funded (~25%) with federal funds. Specifically, proposals were not obtained through public advertising. The costs charged to the program were for allowable activities; however, the procurement was not conducted in accordance with federal procurement requirements. To ensure all protocols and controls are followed in compliance with Uniform Guidance standards, Banner will implement a process to notify all appropriate parties when federal funds are received or granted and provide education to key constituents on Uniform Guidance standards. Additionally, formal documentation supporting the rationale for selecting general contractors will be enhanced. Since this project is ongoing into 2026, this will be a duplicate finding on the 2026 Uniform Guidance audit. Contact: Elizabeth Montemayor, Chief Financial Officer – Banner Research Expected completion date: December 31, 2026

Planned Corrective Action: The next subsequent Project and Expenditure report to be filed for this program will include the expenditures incurred for the period of 1/1/2025-3/31/2025 that were previously unreported. A second person will review subsequent reports for this program for accuracy prior to submission to reduce the risk of non-compliance with program rules. Anticipated Completion Date: April 30th, 2026 Person Responsible for Corrective Action: Patrick Luddy (Director of Finance, Town of Swampscott, MA) Patrick Luddy

The EBR Head Start Program follows the established financial policies, procedures, and approval processes administered through the City of Baton Rouge and Parish of East Baton Rouge. EBR Head Start does not maintain a separate set of finance procedures independent of the City-Parish. Rather, the program operates within the existing City-Parish framework. These processes include the review, approval, and monitoring of activities necessary to support compliance with applicable Federal requirements. The finding identified an opportunity for the Head Start Program to demonstrate how it applies and maintains evidence of these existing controls within the department. The Department of Transportation and Drainage will assess and improve its current guidelines and procedures for ensuring record-keeping compliance with all applicable federal requirements. Although currently being enforced, these remedies will include the following processes: Ensure applicable federal statute requirements are included in the contract advertisement, proposal and bid documents; Identifying and documenting when a contract can be sole sourced; Collecting and storing compliance documentation before, during and after contract execution; Internal audit for compliance; and additional controls identified during discussions between the Department of Transportation and Drainage and its consultants. While internal controls were informally in place for Airport, the department-wide documentation demonstrating the design and operating effectiveness of controls was not formalized. To address this and ensure full compliance with 2 CFR 200.303, management has initiated the following corrective actions: Development and formal adoption of comprehensive, written policies and procedures that explicitly define internal controls over each applicable compliance requirement, utilizing recognized frameworks such as COSO or the Green Book; Implementing a centralized or coordinated approach for maintaining internal control documentation to ensure consistency and guarantee that evidence of control activities is readily accessible; Establish a process for periodic reviews to verify that all applicable compliance documentation is complete, current, and aligned with federal requirements; Relevant staff and departmental personnel will undergo training on these formalized policies to reinforce expectations for documenting internal controls in accordance with Uniform Guidance. The Department of Environmental Services will assess and improve its current guidelines and procedures for documenting internal controls over federal awards and ensuring compliance with applicable federal requirements. These improvements will include developing formal department-level procedures, identifying and maintaining required compliance documentation, establishing consistent record-retention practices, periodically reviewing documentation for completeness and accuracy, providing guidance to appropriate staff, and implementing any additional controls identified as necessary to comply with 2 CFR Part 200.303. Expected Implementation Date: December 2026 Contact person: Kelly LeDuff, Executive Director/Community Development, Federal Programs & Outreach Mike Edwards, Director of Aviation, Baton Rouge Metropolitan Airport Fred Raiford, Director, Transportation and Drainage Adam Smith, Director, Environmental Services

THE COALITION WILL MAINTAIN A CENTRALIZED GRANT REGISTER IDENTIFYING EACH AWARD NUMBER, PROJECT CODE, BEGINNING DATE, ENDING DATE, AND APPROVED PERIOD OF PERFORMANCE. FINANCE WILL USE THE REGISTER DURING MONTHLY CLOSE AND GRANT REVIEW TO VERIFY THAT PAYROLL AND NON-PAYROLL EXPENDITURES ARE CHARGED TO THE CORRECT ACTIVE GRANT/PROJECT. BEFORE AND AFTER AN AWARD END DATE, FINANCE WILL REVIEW PROJECT ACTIVITY FOR COSTS POSTED OUTSIDE THE APPROVED PERIOD, CONFIRM WHETHER ANY PRE-AWARD OR CLOSEOUT COST IS AUTHORIZED, AND RECLASSIFY MISCODED TRANSACTIONS BEFORE GRANT REPORTING IS FINALIZED. NEW AWARD/PROJECT CODES WILL BE ESTABLISHED AND COMMUNICATED BEFORE COSTS ARE CHARGED TO A SUCCESSOR AWARD. IN ADDITION, AFTER THE MONTHLY CLOSE PROCESS IS COMPLETE, FINANCE WILL DISTRIBUTE GRANT STATEMENTS TO ADMINISTRATION TO REVIEW EXPENDITURES AND REMAINING GRANT BALANCES FOR REASONABLENESS. THIS PROVIDES AN ADDITIONAL LAYER OF OVERSIGHT TO VERIFY THAT GRANT-RELATED EXPENSES HAVE BEEN RECORDED ACCURATELY.