Findings Citing § 200.303

Criteria: 2 CFR 200.303 requires nonFederal entities to “establish and maintain effective internal control over the Federal award” to provide reasonable assurance of compliance with Federal statutes, regulations, and the terms and conditions of the award. This includes adequate controls over the accuracy, completeness, and reliability of reporting. Statement of Condition: During reporting testing for Program 14.251, it was noted that the organization does not have a documented internal review or approval process governing the preparation and submission of required Federal reports. Although the HUD grant agreement does not explicitly require a presubmission review, the Federal award is still subject to the internal control requirements of 2 CFR 200.303, which require the entity to maintain effective controls over reporting. Cause: The organization has not formally established, documented, or implemented a comprehensive internal control framework over the reporting process, including supervisory review requirements. Effect or Potential Effect: The absence of a documented and consistently applied review process increases the risk that Federal reports may contain errors, omissions, or unsupported information, which could affect compliance with Federal reporting requirements and reduce the reliability of information used for program oversight. Questioned Costs: $- Recommendation: Management should develop, implement, and document a formal, comprehensive internal review and approval process for all required reports submitted under federal awards. The process should: define supervisory review responsibilities; require documented evidence of review (e.g., signoff, checklist, or electronic approval); and be consistently applied across all reports submitted for federal programs. Management Response: See corrective action plan.

2025-001 U.S Department of Housing and Urban Development Mortgage Insurance Rental Housing CFDA #14.134 Eligibility Significant Deficiency in Internal Control over Compliance Criteria: Complete controls over internal controls require all tenant eligibility requirements to be supported by appropriate documentation. Uniform Guidance 2 CFR 200.303(a) requires non-Federal entities to establish and maintain effective internal control over Federal awards that provides reasonable assurance that the entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls over compliance should ensure that rental assistance is calculated accurately and in accordance with applicable program requirements. Condition: During our testing, one out of 15 tenant files tested received an assistance payment that was higher than allowed. Cause: The Organization’s internal review procedures did not identify the use of the incorrect assistance payment. Effect: The use of incorrect assistance payments increases the risk that the rental subsidy in connection with the Federal program may not be accurate. While no questioned costs were identified, the deficiency represents a breakdown in internal control over compliance. Questioned Costs: $10 Context/Sampling: A nonstatistical sample of 15 tenants out of 99 total were selected for testing. Repeat Finding from Prior Year: No. Recommendation: We recommend Christian Care management strengthen internal controls and oversight over the rental assistance calculations and tenant eligibility documentation to ensure accuracy of all assistance payments. Views of Responsible Officials: Management agrees with the finding.

Finding 2025-001: Rural Rental Housing Loans Assistance Listing Number: 10.415 U.S. Department of Agriculture (Repeat of Finding 2024-001) Compliance Requirement: Eligibility, Program Income Type of finding: Internal Control Over Compliance (significant deficiency) Criteria: The Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards require that the non-Federal entity establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award (2 CFR 200.303(a)). Condition: There were no reviews of the tenant eligibility determinations during the year for the Sierra Vista Alamosa Housing Complex. This complex represents 1 of 3 complexes and 27 of the 111 units included in the Rural Rental Housing Loans program. In addition, seven of the 12 monthly housing assistance payment requests submitted for the Sierra Vista Alamosa Housing Complex were not reviewed. Cause: Management has not implemented an internal control structure that provides for independent review of tenant eligibility determinations or all monthly housing assistance payment requests for the Sierra Vista Alamosa Housing Complex. Effect: Noncompliance with the Rural Rental Housing Loan requirements may exist and not be detected by the Organization. Recommendation: The Organization should strengthen its internal controls with adopted policies and procedures to ensure a review process is established through adequate segregation of duties. The Organization should consider assessing and realigning the duties and responsibilities of the Executive Director, Administrative Assistant, and Alamosa Property Manager to provide for a review process of tenant eligibility determinations and the monthly housing assistance payment requests for the Sierra Vista Alamosa Housing Complex. Grantee’s Response: See corrective action plan.

Criteria: CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. The loan resolution security agreement states the Hospital must set aside a capital asset replacement account which may be established as a bookkeeping account or as a separate bank account. Funds may be deposited in institutions insured by state and federal government or invested in marketable securities backed by the full faith and credit of the United States. Condition: The funds that represented the capital asset replacement fund were commingledwith an existing board-designated CD account. Cause: The Hospital did not maintain a separate bank account or general ledger account for the capital asset replacement fund. Effect: The capital asset replacement funds were commingled with board-designated funds within a certificate of deposit account. Questioned Costs: None reported. Context: Sampling was not used. Recommendation: We recommend that management maintain a separate bank account or general ledger account for the capital asset replacement fund. Views of Responsible Officials and Planned Corrective Action: Management agrees with the funding and will deposit the required capital asset replacement funds in either a separate bank account or general ledger account.

Assistance Listing Number, Federal Agency, and Program Name - 66.616 - U.S. Environmental Protection Agency - Environmental and Climate Justice Community Change Grants Program Federal Award Identification Number and Year - 2024-00E04015 Pass-through Entity - N/A Finding Type - Material weakness Repeat Finding - No Criteria - The Federal Funding Accountability and Transparency Act (FFATA) as mended by Section 6202 of Public Las 110-252 requires recipients of federal awards to report data using the FFATA Subaward Reporting System (FSRS) Tool (pre-March 8, 2025) or SAM.gov (post-March 8, 2025). 2 CFR 200.303 requires that recipients and subrecipients receiving federal awards establish, document, and maintain effective internal control over the federal awards that provide reasonable assurance that the recipient or subrecipient is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition - While the System had controls over accumulating the data for inputs into the portal, it did not have an adequate control in place to ensure transactions subject to FFATA reporting were reviewed for completeness and accuracy upon submission. If Questioned Costs Are Not Determinable, Description of Why Known Questioned Costs Were Undetermined or Otherwise Could Not Be Reported - There were no questioned costs identified. Identification of How Questioned Costs Were Computed - There were no questioned costs identified. Context - The System's internal controls over FFATA reporting were not designed to review submissions of FFATA reports. The System did not have a formal review process to verify the completeness and accuracy of data submitted to SAM.gov, nor did it maintain a reconciliation between the accounting system's subaward records and the information entered into SAM.gov. There were no instances of noncompliance or questioned cost identified related to this lack of control. Cause and Effect - The System has not developed or implemented a review structure over the FFATA reporting process at the time of submission. As a result, the System was at increased risk of submitting inaccurate, incomplete, or untimely FFATA reports. Recommendation - The System should implement controls regarding review of prepared FFATA submissions to ensure that all required subaward data is accurately and timely reported to SAM.gov. Views of Responsible Officials and Planned Corrective Actions - Management concurs with this recommendation. MetroHealth will establish and maintain a log documenting FFATA report submission, with internal reviews of disclosures prior to submission.

Finding Number: 2025-002 Federal Program: Ending the HIV Epidemic: A Plan for America Federal Award Identification Number: UT833926 Assistance Listing Number (ALN): 93.686 Federal Awarding Agency: Department of Health & Human Services Compliance Requirement: Activities Allowed or Unallowed & Allowable Costs/Cost Principles Pass-through Entity: Direct Award Repeat Finding: No Prior Audit Finding Number: N/A Material Weakness – Payroll Approvals Criteria 2 CFR § 300.106 gives regulatory effect to U.S. Department of Health & Human Services for 2 CFR § 200.303(a), which requires non-Federal entities to establish and maintain effective internal control over Federal awards. These controls must provide reasonable assurance that awards are managed in compliance with applicable statutes, regulations, and award terms, and should align with standards issued by the Government Accountability Office or the Committee of Sponsoring Organizations of the Treadway Commission. Additionally, 2 CFR § 200.430(g)(1)(i) requires that charges to Federal awards for salaries and wages be supported by records that accurately reflect the work performed and are backed by a system of internal controls ensuring the charges are accurate, allowable, and properly allocated. The City of Columbus’ Department of Public Health policy titled, “Staff Timekeeping for Grant Funded Positions,” Part I, requires all grant funded staff to complete timesheets reflecting total hours worked and grant-related hours. Section D, specifically, requires that timesheets must be signed by and submitted for approval on the Tuesday following the end of a pay period. Timesheets submitted for approval must be approved by either the employees’ supervisor or the director of the program by the Thursday following the end of a pay period. Condition Although the City has established policies consistent with Federal requirements, supervisory review of timesheets was not performed timely in all instances. During testing of the payroll records under AL #93.686 (Ending the HIV Epidemic: A Plan for America), none of the 40 timesheets tested were reviewed within the required timeframe referenced in the Criteria section. Cause Supervisory personnel did not consistently follow established procedures for timely review and approval of timesheets. Effect Failure to follow the established internal control policy and ensuring all timesheets are appropriately reviewed and approved by a knowledgeable supervisor, within the required timeframe referenced in the Criteria section, could result in unallowable costs being allocated to a federal program and could ultimately result in noncompliance and/or a questioned cost. Recommendation The City should reinforce its existing policies with supervisory staff and implement additional procedures, if necessary, to ensure timesheets are reviewed and approved within the required timeframe prior to charging costs to Federal programs. Officials’ Response: Refer to the Corrective Action Plan.

Condition: During our audit, we noted that the Corporation’s internal controls over billing and collections were not operating effectively. Tenant receivables increased by 46% compared to the prior year, indicating delays in the collection of tenant rent. Additionally, deposits in transit totaling $14,701 were included in the bank reconciliation, with amounts outstanding for more than 90 days. Criteria: In accordance with 2 CFR §200.303, management is responsible for establishing and maintaining effective internal controls over federal awards, including processes to ensure timely billing, collection, and safeguarding of cash receipts. This includes regular review of tenant receivable balances, prompt identification of delinquent accounts, and timely deposit of funds. Cause: The control deficiencies appear to be primarily due to frequent staff turnover within the property management side, resulting in inconsistent execution of rent collection and deposit procedures. Effect: The significant increase in tenant receivables and the presence of deposits in transit aged over 90 days indicate ongoing weaknesses in internal controls. These deficiencies impaired the effective management of tenant receivables and necessitated material audit adjustments to properly state cash receipts and reconcile bank balances. Recommendation: The Corporation should implement a formal process to reconcile tenant receivable aging schedules as part of the monthly close. Additionally, tenant rent collections should be deposited at least weekly to ensure timely recording and improved tracking of cash receipts. Management’s Response: Management is in agreement with the auditors’ findings. The managing agent has hired an accounts receivable personnel to ensure rent collections and deposits are processed in a timely and consistent manner.

Assistance Listing, Federal Agency, and Program Name 97.044, U.S. Department of Homeland Security, Assistance to Firefighters Grant Federal Award Identification Number and Year EMW 2023 FG 01225, 2023 Pass through Entity N/A Direct funded Finding Type Material weakness and material noncompliance with laws and regulations Repeat Finding No Criteria In accordance with the award agreement, the Township is required to submit financial reports to the federal awarding agency semiannually. The Township elected to report the grant expenditures using the cash basis of accounting, as permitted by the federal awarding agency. Per 2 CFR 200.303(a), nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government issued by the comptroller general of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Township submitted the required reports, but one of the reports submitted did not properly identify the federal expenditures paid during the reporting period. Questioned Costs None If Questioned Costs are not Determinable, Description of Why Known Questioned Costs Were Undetermined or Otherwise Could not be Reported N/A Identification of How Questioned Costs Were Computed N/A Context In the financial report submitted in January 2026 for the period July 1 through December 31, 2025, the Township reported zero expenditures. Contrary to this reporting, the Township incurred and paid $1,156,265 in federal expenditures during the period, which should have been included in the report. Cause and Effect Although the Township had an established control whereby one individual prepared the report and a second individual reviewed it, a misunderstanding of the applicable reporting requirements prevented the review from detecting the reporting error. The Township has subsequently corrected the report to include the appropriate expenditures. Recommendation We recommend that the Township enhance its review process by ensuring all reporting requirements are identified and considered to support an effective review of reported information. Views of Responsible Officials and Corrective Action Plan The Township will implement a reconciliation and review process requiring all reported federal expenditures to be verified against the general ledger and supporting documentation prior to submission. In addition, the Township will correct the identified errors and resubmit the report with accurate federal expenditure information.

Criteria and Condition: Under Uniform Guidance, to be allowable under a federal award, costs must be necessary and reasonable, conform to any limitations or exclusions in the terms and conditions of the award, be consistent with the non Federal entity’s policies, be treated consistently, be determined in accordance with GAAP as applicable, and be adequately documented. Payroll charges to federal awards must be supported by recorded evidence that accurately reflects the work performed, including documentation of hours worked and pay rates used to charge the program. Additionally, 2 CFR 200.303 indicates that non-Federal Entities receiving Federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and terms and conditions of the Federal award. Costs that are not properly supported, or that are unreasonable or noncompliant with award requirements, are subject to being reported as questioned costs. During testing of twenty-five payroll transactions charged to the program, Bridge House was unable to provide adequate supporting documentation for seven items. Five items in the sample lacked evidence of proper supervisory approval of the related time records or payroll charges. In addition, five items were determined to be unallowable expenses under the grant, based on the nature of the costs and/or the lack of support. Several of these exceptions overlapped, such that some sampled items were inadequately documented, lacked required approval, and/or included unallowable costs. Cause: These conditions occurred because Bridge House has not implemented or consistently enforced sufficient internal controls over payroll charges to the grant. Specifically, management did not ensure that (1) required supporting documentation for payroll costs was obtained and maintained for all employees charged to the program, (2) time records and payroll charges were reviewed and formally approved by appropriate supervisors prior to billing, and (3) staff responsible for preparing and reviewing grant payroll charges were adequately trained to identify and exclude unallowable payroll costs. As a result, multiple sampled items lacked adequate documentation, were missing required approvals, and included unallowable expenses, with overlap among these conditions. Context and Effect: Because of these control deficiencies, payroll charges to ALN 21.027 were overstated and/or inadequately supported, resulting in known questioned costs of $945 that may be disallowed by the federal awarding agency or pass through entity. These conditions increase the risk of noncompliance with the Uniform Guidance requirements for allowable costs and documentation for payroll charged to the program. Questioned Costs and Likely Questioned Costs: Based on the specific exceptions identified in our sample, known questioned costs total $954 for the period tested. Using the results of the sample and projecting the errors to the applicable population of payroll charges, we estimate likely questioned costs of $30,991 for the program. Identification of Repeat Findings: This is not a repeat finding. Recommendation: Proper control activities should be implemented to allow for a consistent, accurate, and allowable method to support distribution of personnel charges to federal programs. Management should establish procedures requiring that all hours billed to the grant be supported by approved timesheets that are compared to payroll system hours, with differences investigated and resolved before reimbursement requests are submitted. In addition, a secondary review of grant invoicing templates (by someone independent of preparation) should be performed to verify the accuracy of hours, rates, and period of performance prior to submission.

Finding Number: 2025-001 Program: Child Care and Development Fund Cluster ALN #: 93.575 and 93.596 Pass through Entity: Commonwealth of Massachusetts Department of Early Education and Care Federal Agency: U.S. Department of Health and Human Services Federal Award Year: January 1, 2025 – December 31, 2025 Compliance Requirement: Eligibility Type of finding: Significant Deficiency Criteria According to 2 CFR 200.303, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Young Men’s Christan Association (YMCA) has multiple processes to ensure that children are determined to be eligible for childcare prior to their authorization date. However, the YMCA’s control that was tested over the eligibility process, as documented in the YMCA’s narrative, did not operate as designed. It is the YMCA’s control to review and sign the Fee Agreement and Child Care Subsidy form prior to the child’s start date. Cause In certain cases, authorizations are processed after the family has already had their scheduled meeting with the YMCA staff. The parent/guardian then needs to come back in to sign the forms in person or print, sign and scan back the forms. In these cases, there is a delay and the forms get signed by the YMCA staff after the authorization date. Proper perspective During the audit, we noted that for ten of the forty samples selected, the Fee Agreement and Child Care Subsidy form did not contain the signature of the YMCA prior to the Child’s start date. However, through our compliance procedures we noted all children were eligible, and the proper rate was calculated by the YMCA. Possible asserted effect If fee agreements are not reviewed and agreed upon prior to receiving services, then controls will not operate effectively. Questioned costs None Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding Not a repeat finding. Recommendation We recommend the YMCA implement additional procedures to ensure that all forms are reviewed and signed prior to the child’s placement start date. Views of responsible officials and corrective actions Management acknowledges that, in certain cases, the Fee Agreement and Child Care Subsidy forms were not signed by YMCA staff prior to the child’s start date, as required by YGB’s outlined procedures. We recognize the importance of timely and complete documentation and will reinforce expectations with staff to ensure adherence to this control. At the same time, management respectfully notes that multiple mitigating controls are in place within the eligibility determination and authorization process. These include verification of eligibility criteria, review of supporting documentation, and system-based authorization controls, all of which must be completed before services are approved. Based on these layered controls, management does not believe that this timing issue could reasonably result in federal funds being awarded to ineligible children.

Finding Number: 2025-002 Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Pass-through Entity: City of Boston Federal Agency: U.S. Department of Treasury Federal Award Year: January 1, 2025 –December 31, 2025 Compliance Requirement: Suspension and Debarment Type of finding: Significant Deficiency and noncompliance Criteria Non-federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. “Covered transactions” include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria as specified in 2 CFR 180.220. All non-procurement transactions entered into by a pass-through entity (i.e., subawards to subrecipients), irrespective of award amount, are considered covered transactions, unless they are exempt as provided in 2 CFR 180.215. Additionally, according to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition It is the YMCA’s control to check for suspension and debarment of vendors as part of the procurement process prior to entering into a contract. Checks of suspension and debarment of vendors on SAM.GOV are retained as part of the procurement documentation. Cause The YMCA did not properly document evidence of the control operating effectively. Proper perspective During our testing, we noted that for 1 of 1 selection, the YMCA provided screenshots of the SAM.GOV website showing the vendor was not suspended or debarred. The YMCA communicated to us that they checked the SAM.GOV website prior to entering into the contract with the vendor. However, there was no evidence that the control operated prior to entering into the contract. Therefore, we were unable to determine if the vendor was checked for suspension and debarment prior to entering into the contract. Upon our review of SAM.GOV the vendor is not suspended or debarred. Possible asserted effect The YMCA could enter into contracts with vendors who are suspended or debarred from working under covered transactions. This would then result in noncompliance and unallowable costs. Questioned costs None Statistical sampling That sample was not intended to be, and was not, a statistically valid sample. Repeat finding Not a repeat finding. Recommendation We recommend the YMCA to sign/initial and date the review on the SAM.GOV website before retaining the documentation to evidence the control. Views of responsible officials and corrective actions Management acknowledges the finding of insufficient documentation evidencing that suspension and debarment checks were performed prior to contract execution. While procedures were in place to review vendors against the SAM.gov exclusion list, documentation did not consistently demonstrate the timing of the review. Management confirms that the tested vendor was verified prior to work beginning and was not suspended or debarred at the time of review.

Department of Agriculture Federal Assistance Listing #10.766 Community Facilities Loans and Grants Special Tests and Provisions Material Weakness in Internal Control Over Compliance Criteria – 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition – During our testing, we noted that the reserve account was not separately identified and there was no formal review separate from the preparer over the reserve fund reconciliation for the federal program. Cause – The Organization did not have an adequate internal control policy in place to ensure the reserve account was separately tracked and a documented review and approval over the reserve fund occurred. Effect – The lack of adequate policies governing the review increases the risk that employees participating in the federal award administration may not be able to detect and correct noncompliance in a timely manner. Questioned Costs – None reported. Context – Sampling was not used. The Organization has one reserve account that was tested. Repeat Finding from Prior Years – Yes, 2024-003 Recommendation – We recommend that the Organization enhance internal control policies to ensure that the reserve fund is separately tracked and formal documentation of reviews are present. View of Responsible Officials – Management agrees with the finding.

Identification of the Federal Program Federal Agency: U.S. Department of Health and Human Services, Health Resources and Services Administration (HRSA) Program Name: R&D Cluster Assistance Listing #: 93.859 Pass Through Entity: West Virginia University, University of North Dakota Award Identification: Sanford 21-673 Award Year(s): February 24, 2024–May 23, 2026 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR 200.303 requires that the non-Federal entity must “(a) establish, document and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our audit, we noted that for three of sixteen milestone invoices selected for testing, Sanford did not have documented evidence of review and approval of the study activities submitted to the pass-through entity. Cause: Based on the prior year finding, Management implemented corrective actions during FY 2025; however, certain milestone invoices had already been received prior to implementation of the updated controls and therefore were not subject to the revised review and approval procedures. Effect or Potential Effect: A lack of review and approval of milestone study activities could potentially result in unallowable activities being charged to the federal program. Questioned Costs: $0 Context: The three invoices that lacked evidence of review and approval of the study activities were received during the first two months of 2025, prior to implementation of management’s corrective action plan. Total milestone payments on this grant received during these two months totaled $120,870. Total milestone grant amounts charged to the R&D Cluster were $1,141,432 in FY 2025. The total federal expenditures for the R&D Cluster for FY 2025 were $27,155,088. Identification as a Repeat Finding: This is a repeat finding of 2024-004. Recommendation: We recommend management ensure that the revised review and approval procedures that were put in place are followed. Views of Responsible Officials: As it relates to Research milestone billing for the PASC grant, procedures were revised in 2025 after the 2024 Audit. Upon receipt of invoice and payment from PASC, the Research Billing team will review and provide notification to Research Director and Research Manager via email if the invoice and payment received matches to what is shown as owed in our systems. The Corrective Action Plan from the 2024 Audit was already put into place however this is a repeat finding due to the timing of the 2024 finding.

Condition: During our testing of program eligibility for the TANF program, we tested a nonstatistical sample of 40 participant files. For two participants, eligibility determinations could not be located. Additionally, for seven participants, eligibility determinations provided were either not dated or dated after fiscal year end (December 31, 2025). As a result, we were unable to determine whether eligibility had been properly documented prior to the participant beginning the program, as required. Criteria: Under 2 CFR §200.300(b), non Federal entities must comply with federal statutes, regulations, and the terms and conditions of federal awards. Eligibility is a compliance requirement identified in the Compliance Supplement for the TANF program. Additionally, 2 CFR §200.303 requires non Federal entities to establish and maintain effective internal control over federal awards to provide reasonable assurance that the entity is administering federal awards in compliance with program requirements. Adequate documentation supporting participant eligibility must be retained in accordance with 2 CFR §200.334. Cause: The finding resulted from a lack of formal controls over the review, documentation, and retention of TANF eligibility determinations. Specifically, there were no documented procedures to ensure eligibility determinations were completed, dated timely, and retained prior to participant enrollment. Effect: Because eligibility documentation was missing or not timely for nine participants, we were unable to verify compliance with TANF eligibility requirements. This resulted in questioned costs of $4,474 related to benefits provided to participants whose eligibility could not be substantiated. Questioned Costs: $4,474 Recommendation: We recommend that management establish formal procedures to ensure TANF eligibility determinations are completed, reviewed, and dated prior to participant enrollment and that all supporting documentation is retained in accordance with federal requirements. Additionally, management should consider implementing a documented review process to verify eligibility files are complete before benefits are provided.

Condition: The auditee did not submit three out of four required quarterly Federal Financial Reports SF-425. Criteria: The grant agreement with the U.S. Department of Agriculture stipulates that the auditee is required to file quarterly Federal Financial Reports SF-425. Further, 2 CFR 200.303 requires the auditee to establish and maintain effective internal controls over compliance. Cause: Staff turnover caused certain administrative tasks to be more challenging, which hindered internal controls over compliance with the requirement to file quarterly reports. Effect: The auditee failed to submit three out of four required quarterly Federal Financial Report SF-425, resulting in potential noncompliance with the requirements of the federal award. Recommendation: We recommend the auditee establish, document, and maintain procedures and controls to ensure the required quarterly reports are submitted timely. Management’s Response: See management's response dated May 25, 2026.

2025-001 Finding – Internal controls over compliance Federal Program: Housing Voucher Cluster; Section 8 Housing Choice Voucher Program - Assistance Listing #14.155 and Mainstream Vouchers – Assistance Listing #14.879 Federal Agency: U.S. Department of Housing and Urban Development Award Period: 2025 Finding resolution status In process Information on universe and population size The issue with the Authority’s system of internal control over compliance represents a significant deficiency in internal control. The total population of all Housing Choice Voucher (HCV) files subject to testing was 448. Of these 448 tenant files, we selected 25 items to test and noted 1 exception during our testing. Sample size information A non‑statistical sample of 25 tenant files were selected for testing. One error was identified. Identification as a repeat finding This was not a repeat finding. Criteria 2 CFR §200.303 requires non-Federal entities to establish and maintain effective internal controls over Federal programs that provide reasonable assurance of compliance with applicable requirements. HUD guidance requires that income determinations, including excluded amounts such as loans, be supported by adequate documentation retained in tenant files. Statement of condition During our review of tenant files, one file included a reported lump-sum payment of $6,700 that was treated as a loan and excluded from income. However, the Authority did not obtain or retain supporting documentation, such as a loan agreement or third-party verification, to substantiate the exclusion. Cause The Authority’s internal controls over compliance did not ensure that staff obtained and retained documentation for excluded income items. Effect Without effective controls over documentation, there is an increased risk that income determinations may not be properly supported, which could result in noncompliance with HUD requirements and inaccurate housing assistance calculations. Auditor non-compliance code S – Internal control deficiencies Questioned costs $0 Views of responsible officials Management acknowledges the deficiency and plans to strengthen controls over income verification and documentation retention. Context This was an isolated instance affecting one tenant file and does not appear to be a systemic issue. Recommendation We recommend that the Authority enhance internal controls to require documentation of all excluded income amounts, including supervisory review to ensure compliance with HUD requirements. Auditor’s summary of auditee’s comments on the findings and recommendations Management agrees with the finding and recommendation. Response indicator Agree Completion date September 30, 2026 Response Management agrees with the finding.

2025-004 LACK OF WRITTEN FEDERAL POLICIES AND PROCEDURES REQUIRED BY UNIFORM GUIDANCE Type of Finding: Material noncompliance Federal Program: Coronavirus State and Local Fiscal Recovery Funds (ALN# 21.027) Compliance Requirement: All Criteria - Per 2 CFR §200.303 and related sections (including §§200.305 and 200.318-320), non-federal entities expending federal awards must establish and maintain effective internal controls and must document policies and procedures governing compliance with applicable federal statutes, regulations, and terms of award. Condition - The Village has not developed or implemented the written policies and procedures required under the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance). Required documentation is absent in areas such as internal controls over compliance, cash management, procurement, and allowable costs. A similar issue was noted and reported last year as 2024-005. Cause - The Village has not formally developed Uniform Guidance-compliant policies due to limited administrative resources and competing operational priorities. Effect - The absence of formal written policies and procedures increases the risk of inconsistent or noncompliant treatment of federal expenditures. Without documented controls and expectations, the Village may fail to detect or prevent noncompliance with federal requirements in key grant administration areas. Questioned Costs - None Recommendation - We recommend that the Village adopt written policies and procedures addressing the specific requirements outlined in the Uniform Guidance. These policies should include, but not be limited to, internal controls over compliance, procurement, cash management, subrecipient monitoring (if applicable), and allowable cost determinations. Management should ensure that these policies are communicated and periodically reviewed. Views of Responsible Officials: Management agrees with the finding and will take appropriate steps to remedy noted finding.

Finding 2025-001: Research and Development Cluster Cash Management Draw Approvals Federal Agency: Department of Health and Human Services Criteria: 2 CFR 200.303 requires the recipient to establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance the award is managed in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The Foundation has established independent review and approval of drawdown requests by the CEO/Controller as key control over draw requests. Condition: The Foundation did not consistently follow its established controls requiring independent review and approval of drawdown reimbursement requests prior to submission. During our testing of drawdown request controls within the Research and Development Cluster, we noted that 4 of 66 drawdown reimbursement requests tested (the entire population of drawdown requests) were submitted without documentation of independent review and approval. Based on the requests tested, the amounts submitted were accurate supported, and no instances of noncompliance were identified. Cause: The exceptions appear to have resulted from oversight in the review process, which led to drawdown requests being submitted before approval was documented. Additionally, the exceptions occurred during a period in which the Foundation was transitioning finance personnel responsibilities. Effect: Certain drawdown requests were submitted before the Foundation’s key control was evidenced as having been performed. Repeat Finding: N/A Questioned Costs: None Recommendation: We recommend the Foundation strengthen procedures to ensure all drawdown requests are reviewed and approved by the appropriate independent party prior to submission and that evidence of such review is consistently maintained. Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding. See attached corrective action plan.

Criteria or Specific Requirement According to §200.303 Internal controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context During our testing, we noted 1 sample where the Organization overpaid an individual which resulted in costs being erroneously allocated to the grant. Effect Noncompliance results in potential for incorrect payroll costs allocated to federal grants. Questioned Costs Known: $2,166 Cause Management oversight and improper payroll calculation. An employee was overpaid during their final payroll at the Organization. Recommendation We recommend the Organization update their termination procedures to verify that final payrolls are being calculated correctly and update their grant allocation process to ensure accurate wage rates are used to calculate the allocations. Views of Responsible Officials Management has updated the payroll termination process to include a documented review before payroll is finalized. The finance team will review final payroll calculations for terminated employees after HR provides the termination details and payout calculation. Payroll changes and review steps are documented as part of the bi-weekly payroll update emails.

2025-001 – Eligibility Federal Agency: U.S. Department of Housing and Urban Development Federal Program: 14.195 Section 8 Project-Based Cluster Condition: As part of our testing of Warren Gardens Housing Cooperative Company, Inc.’s, (the Cooperative) internal control over compliance for eligibility, we noted that the Cooperative did not follow their internal controls regarding income recalculations for two out of thirty-seven applications reviewed. The issues did not result in disqualification of the individuals to receive benefits, however these issues did impact the participants’ amount of benefits being provided. Criteria: 2 CFR 200.303 indicates that non-Federal entities receiving Federal awards must establish and maintain effective internal controls over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. Cause: The Cooperative did not properly follow its internal controls. Effect: The Cooperative did not properly calculate the income level for two participants in accordance with its internal controls. Context: Two out of thirty-seven applications sampled. Our sample was not a statistically valid sample. This was not a repeat finding from a prior period. Questioned Costs: None. Recommendations: Management should ensure that the Cooperative’s internal controls in place are properly followed. Management Response: Management acknowledges the finding and has updated and corrected the tenant files. Moving forward, management will strengthen procedures over tenant documents and income calculations.

Federal Agency: U.S. Department of Housing and Urban Development Federal Program Name: Community Project Funding (CPF) Program Assistance Listing Number: 14.251 Federal Award Identification Number and Year: B-22-CP-MN-0492, 2025 Award Period: January 1, 2025 – December 31, 2025 Type of Finding: Material Weakness in Internal Control over Compliance Criteria or specific requirement: The Uniform Guidance (2 CFR §200.303) requires non‑federal entities to establish and maintain effective internal control over federal awards that provides reasonable assurance the entity is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the award. For the Community Project Funding program, reporting is a compliance requirement and includes submission of required performance and financial reports. Condition: The City did not maintain documentation demonstrating that required reports for the Community Project Funding program were reviewed by someone other than the preparer prior to submission, including the DRGR Performance Report and the DRGR Financial Report. Questioned costs: None. Context: Reporting is a compliance requirement for the Community Project Funding program and includes submission of multiple reports during the award period. The City’s internal control over compliance related to reporting consists of review of reports prior to submission. Instances were identified where evidence of such review was not documented. Cause: Due to limited staffing levels, the City Administrator/Finance Director is responsible for both preparing and reviewing required program reports. As a result, independent review and documentation of report approval is limited. Effect: Lack of documented review of required reports increases the risk that errors or noncompliance in program reporting may occur and not be identified prior to submission, which could result in noncompliance with federal reporting requirements. Repeat Finding: No. Recommendation: We recommend the City implement procedures to ensure appropriate internal controls over compliance related to reporting, including documentation of review and approval of all required reports by someone other than the preparer prior to submission. Views of responsible officials: There is no disagreement with the audit finding. City management acknowledges that limited staffing and experience constrain segregation of duties; however, the City will evaluate and implement procedures to improve documentation of review and approval of required reports for the Community Project Funding program.

Information of the Federal Program: Assistance Listing Number 10.565—Commodity Supplemental Food Program, U.S. Department of Agriculture Pass-Through Entity and Award Number: Minnesota Department of Health, award number 204642. Compliance Requirement: Eligibility Type of Finding: Significant deficiency in internal control over compliance Criteria: 2 CFR 200.303 of Subpart D, "Post Federal Award Requirements Standards for Financial and Program Management," of the Uniform Guidance requires a recipient to establish, document and maintain effective internal control over the federal award that provides reasonable assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award, including eligibility. Condition: We requested eligibility forms for forty participants to review for the signature of site partner personnel indicating review of eligibility information on the form. One of the forty forms were unable to be located upon request. Eligibility information is input in ClientTrack software and the form should also be uploaded. Cause: Signed enrollment forms were not properly scanned into Sharepoint and had likely been disposed of. The signatures on these forms indicated the review by an agency partner that information included on the form is correct. Effect or Potential Effect: An ineligible individual could receive a CSFP box. Questioned Costs: None Context: Signed enrollment forms were not available for one of forty participants selected. Repeat Finding: yes, 2024-001 Recommendation: We recommend that Second Harvest Heartland digitalize their CSFP enrollment forms for convenient access and provide review of the electronically filed form prior to disposal of the paper form. Views of Responsible Officials: Agree.

Information on the Federal Program: Assistance Listing Number 10.565—Commodity Supplemental Food Program, U.S. Department of Agriculture Pass-Through Entities and Award Numbers: Minnesota Department of Health, award number 204642. Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs and Cost Principles Type of Finding: Significant deficiency in internal control over compliance Criteria: 2 CFR 200.303 of Subpart D, "Post Federal Award Requirements Standards for Financial and Program Management," of the Uniform Guidance requires a recipient to establish, document and maintain effective internal control over the federal award that provides reasonable assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award, including Activities Allowed or Unallowed and Allowable Costs and Cost Principles. Condition: Processes and procedures in place to review and submit administrative expenditures did not include a thorough enough review process to agree information to source data. Cause: Expenditures were reviewed before submission, however the review of this information was inadequate as it did not corroborate totals with the source data. Effect or Potential Effect: The Organization could have received reimbursement in excess of incurred expenses. Questioned Costs: None Context: One of the months selected for detail testing was found to have an erroneous submission using the wrong month’s expenditures. However, because the Organization incurred significantly more expenses than for which it was reimbursed during the year, the erroneously reported expenses had not been reimbursed by the funder. Repeat Finding: No Recommendation: We recommend that Second Harvest Heartland review the source data for all future expense reports. Views of Responsible Officials: Agree.

Department of Health and Human Services Temporary Assistance for Needy Families, Passed through Ramsey County, Federal Financial Assistance Listing 93.558, FAST X award 2201MNTANF for the year ending 12/31/2024 Activities Allowed or Unallowed and Allowable Costs/Cost Principles Significant Deficiency in Internal Control over Compliance Criteria: CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Goodwill-Easter Seals Minnesota’s internal control structure should be designed to properly follow the allocation policy for employees’ pay to each grant in accordance with the policy established by Goodwill-Easter Seals Minnesota. Condition: Goodwill-Easter Seals Minnesota has an internal control system designed to detect or prevent improper allocation of employees’ pay to grants in a timely manner in accordance with their established policy, however, during the year for one pay period tested, an error was identified in the process but was not fully corrected. Cause: Goodwill-Easter Seals Minnesota has a process for allocating employee wages based on hours worked. The controls in place did not operate as designed and failed to fully correct an error in the allocation of employee pay to the grant. Effect: One employee had some of their pay allocated improperly and not in accordance with the policy established. Questioned Costs: None reported. Context/Sampling: A nonstatistical sample of eight pay periods out of 26 were selected for testing which accounted for $383,866 of $2,284,613 of federal program expenditures. Repeat Finding from Prior Year: Yes Recommendation: We recommend that management develop a more extensive review over payroll allocation to ensure pay is properly allocated to each grant in accordance with the policy established by Goodwill-Easter Seals Minnesota. Views of Responsible Officials: Management agrees with this finding.

Department of Health and Human Services Temporary Assistance for Needy Families, Passed through Ramsey County, Federal Financial Assistance Listing 93.558, MFIP award 2201MNTANF for the year ending 12/31/2025 Activities Allowed or Unallowed and Allowable Costs/Cost Principles Significant Deficiency in Internal Control over Compliance Criteria: CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Goodwill-Easter Seals Minnesota’s internal control structure should be designed to properly follow the allocation policy for employees’ pay to each grant in accordance with the policy established by Goodwill-Easter Seals Minnesota. Condition: Goodwill-Easter Seals Minnesota has an internal control system designed to detect or prevent improper allocation of employees’ pay to grants in a timely manner in accordance with their established policy, however, during the year for five pay periods tested, Goodwill-Easter Seals Minnesota failed to identify that one employee’s timecard had incorrectly allocated time to a grant that ended. However, the time was corrected before submission to the grant, but it was not changed on the timecard. Cause: Goodwill-Easter Seals Minnesota has a process for approving timecards which include program codes for allocation to awards. The controls in place did not operate as designed and failed to fully correct an error in five timecards of an employee’s pay to the grant. Effect: One employee had the incorrect program code listed on the approved timecard for five pay periods tested. Questioned Costs: None reported. Context/Sampling: A nonstatistical sample of eight pay periods out of 26 were selected for testing which accounted for $383,866 of $2,284,613 of federal program expenditures. Repeat Finding from Prior Year: Yes Recommendation: We recommend that management develop a more extensive review over timecards to ensure pay is properly allocated to each grant in accordance with the policy established by Goodwill-Easter Seals Minnesota. Views of Responsible Officials: Management agrees with this finding.

Item 2025-001 Eligibility/Program Eligibility Federal Pell Grant Program ALN# 84.063 U.S. Department of Education Grant period – 2025-2026 Award Year Criteria – In accordance with 2 CFR 200.303(a), non-Federal entities must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should follow guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under 34 CFR Part 690 Pell grants are required to be calculated using a distinct set of criteria based on enrollment. Condition – 2 of 40 students tested received overpayments of Pell grants. Errors in clock-to-credit-hour conversions resulted in inaccurate enrollment intensities used in the Pell calculations for these students. Cause – The data file for the clock-to-credit hour conversion was not uploaded into the College's system prior to calculation of the students' enrollment intensity, and the results were not reviewed prior to packaging aid. Effect – Lack of controls resulted in an overpayment of Pell award to both students. The engagement team notes that for these exceptions, the College appropriately updated the file and corrected student aid. The engagement team further notes this only affected students in a current enrollment period in which all funds for the term had not been drawn from the Department of Education. Questioned Costs – The total of all overpayments was $7,821 amount was deemed not material to compliance. Recommendation – We recommend that adequate controls be put in place to review that files are updated by semester and that clock-to-credit hour conversions are reviewed prior to awarding of federal aid. Management’s Response – The College will strengthen the controls in place to ensure that all procedures have been followed prior to calculation and disbursement of financial aid.

Federal Agency: Department of Health and Human Services Federal Program Name: Special Programs for the Aging-Title III, Part C-Nutrition Services Assistance Listing Number: 93.045 Federal Award Identification Number and Year: 316-24-00C1-042, 316-24-00C2-043, 316-25-00C1-042, 316-25-00C2-043 and 316-25-00C3-042 Pass-Through Agency: MN River Agency on Aging Pass-Through Number(s): 316-24-00C1-042, 316-24-00C2-043, 316-25-00C1-042, 316-25-00C2-043 and 316-25-00C3-042 Award Period: January 1, 2024 – December 31, 2024 & January 1, 2025 – December 31, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance and Other Matters Criteria or specific requirement: 2 CFR 200.306 requires that any amounts used for required cost sharing must be verifiable in the subrecipient’s records and allowable under subpart E. 2 CFR 200.303 requires that non-Federal entities must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During our audit testing, we observed discrepancies between the hours reported by volunteers and the hours submitted for the grant at two sites. There were also 3 volunteer logs that could not be located related to two sites. Additionally, there was not documentation of the signoff on the volunteer logs by the site coordinator for two sites. Context: We reviewed 40 volunteer logs for reported hours. Differences in the hours reported were between 0.25 and 0.75 hours. Cause: In 2024, funding cuts led to temporary disruptions, resulting in staff reductions and affecting documentation practices in a particular timeframe. Regarding the hours reported that did not align with the volunteer log, the site coordinator believed the volunteer had underreported their hours and adjusted them accordingly, but there was not documentation of the change. Additionally, there was one instance where a data entry error contributed to the discrepancies. Effect: Hours reported for volunteer time could be incorrect. This grant requires a cost share of 15% be provided and the required cost share of 15% was exceeded so there was not an effect of meeting the required cost share. Repeat Finding: No Recommendation: We recommend additional training to ensure documentation is kept for the volunteer logs and the review. We also recommend documentation for any discrepancies between hours reported vs. the volunteer log. Views of responsible officials: There is no disagreement with the audit finding.

Assistance Listing Number, Federal Agency, and Program Name ALN 20.106, U.S. Department of Transportation Federal Aviation Administration (FAA), Airport Improvement Program (AIP) Federal Award Identification Number and Year 3 48 0064 161 2025 Pass through Entity N/A Finding Type Significant deficiency Repeat Finding No Criteria The Code of Federal Regulations, specifically 2 CFR 200.303, requires grant recipients establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition The controls in place to review the final grant packet, including the grant drawdown template and the drawdown invoice detail, prior to final processing of the drawdown were not operating as designed. Questioned Costs $21,452 If Questioned Costs Are Not Determinable, Description of Why Known Questioned Costs Were Undetermined or Otherwise Could Not Be Reported N/A Identification of How Questioned Costs Were Computed The questioned costs represent the total of all nonconforming costs reduced by the Airport's 25 percent match that were charged to the grant. Context Although the two invoice packets properly identified the $28,603 of non conforming costs out of $25,412,561 incurred, the grant drawdown template that was prepared did not exclude these ineligible costs and the review of the grant drawdown template did not identify the error prior to final processing of the drawdown. Cause and Effect The ineffective control to ensure accuracy of the grant drawdown template prior to final processing of the drawdown resulted in unallowable costs. Recommendation We recommend the Airport ensure internal controls are in place to ensure accurate information is included in the final processing of the drawdown. Views of Responsible Officials and Planned Corrective Actions Treasury will work with PMM and DCC departments to out line a process to ensure accurate reporting of eligible expenses when invoices are re viewed for compliance with grant program requirements. The process will be documented and adhered to once agreed by all departments. A review process for the final drawdown submission will also be adopted to ensure costs that are identified as ineligible are appropriately excluded from the final submission.

Assistance Listing Number, Federal Agency, and Program Name - 10.727, U.S. Department of Agriculture, Inflation Reduction Act Urban & Community Forestry Program Federal Award Identification Number and Year - 24 DG 11094200 194, 2024; 24 CA 11132544 013, 2024 Pass through Entity - U.S. Department of Agriculture (Direct Funded); GreenLatinos Finding Type - Material weakness Repeat Finding - No Criteria - Per 2 CFR 200.303, the recipient must establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should align with the guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States, or the Internal Control-Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition - Management did not have controls in place to ensure documentation evidencing the organization's verification that contractors are not suspended or debarred from participating in a federally funded activity was maintained. Questioned Costs - N/A If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported - N/A Identification of How Questioned Costs Were Computed - N/A Context - While gaining an understanding of Openlands' internal controls, we noted management was unable to provide documentation to support that checks for suspension and debarment occurred before the organization entered into a covered transaction. We were able to verify in our sample testing that management did not enter into contracts with individuals or organizations suspended or debarred from participating in federal programs. Cause and Effect - A lack of controls could result in material noncompliance with federal procurement standards. Recommendation - We recommend management retain documented evidence that checks for suspension and debarment that have occurred before entering into a covered transaction with outside contractors. Views of Responsible Officials and Corrective Action Plan - Management concurs with the finding. We acknowledge that, for the awards issued under the Inflation Reduction Act Urban and Community Forestry Program (Assistance Listing Number 10.727), the required suspension and debarment verification was performed; however, the supporting documentation evidencing this verification was not retained by the responsible department. This represents a documentation lapse rather than a deficiency in internal controls, as Openlands routinely performs suspension and debarment verifications for all applicable vendors, contractors, and subrecipients receiving federal funds in accordance with 2 CFR 200.214. This requirement applies to entities and individuals awarded federally funded contracts or subawards exceeding the micropurchase threshold and excludes routine commercial vendors for indirect administrative costs or purchases under $15,000. Management believes this was an isolated documentation lapse prior to the current audit period when the contractor was selected and is currently in the process of executing an update to internal control policies to ensure these checks are maintained prior to entering into a contract by the responsible department, as well as updating a clause to all standard vendor contracts requiring a self-certification that they are not excluded, debarred, or suspended from entering into covered transactions with the federal government.

2025 001 Activities Allowed or Unallowed and Allowable Costs/Cost Principles Beneficiary Payments U.S. Department of State: Bureau of Population and Refugees and Migration: U.S. Refugee Admissions Program: FY24 MRA Capacity Development Funds (ALN 19.510, award number SPRMCO23CA0361) FY2023 25 Year 3 Reception and Placement Program Affiliate MRA DA+Admin (ALN 19.510, award number SPRMCO24CA0356) FY2023 25 Year 3 Reception and Placement Program Affiliate ERMA DA+Admin (ALN 19.510, award number SPRMCO24CA0357) Statistically valid sample: No, and it was not intended to be. Repeat finding: Not a repeat finding. Finding Type: Significant Deficiency and noncompliance Criteria: 2 CFR section 200.303 requires that non federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non federal entity is managing the federal awards in compliance with federal statues, regulations, and the terms and conditions of federal awards. The specific requirements for activities allowed or unallowed are unique to each federal program and are found in the federal statutes, regulations, and the terms and conditions of the federal award pertaining to the program. 2 CFR Part 200 establishes cost principles for determining costs applicable to federal awards with nonprofit organizations. The Uniform Guidance (2 CFR 200.403) requires that costs charged to federal awards be necessary, reasonable, allocable, adequately documented, and in compliance with the terms and conditions of the federal award. Costs that do not provide a direct programmatic benefit, or where the benefit cannot be reasonably demonstrated or allocated, and are incurred outside the approved scope of the award are not allowable as direct charges. Condition and context: On February 13, 2025, IRC’s Ethics & Compliance Unit (ECU) received a whistleblower report alleging that an IRC Housing Coordinator located in an office in Northern California submitted unauthorized and fraudulent requests for funds, which were uploaded onto USIO bank debit cards, claiming they were expenses for newly resettled IRC clients, and instead using the funds for personal benefit. These USIO cards are intended to be used to cover expenses for newly arrived refugees during the initial 90 day period, including rent, food and other miscellaneous expenses. An internal investigation was initiated in February 2025 which found that the Housing Coordinator had loaded funds onto USIO bank debit cards between May 8, 2023 and February 11, 2025 which were for purposes other than refugees. The investigation concluded that there were unauthorized and fraudulent requests for funds in the amount of $215,639, plus the related indirect costs that were applied on these direct costs of $33,920, for a total of $249,559 related to federal funds expended in 2025 and charged to the grants identified in this finding. The total expenditures in this program included on the 2025 schedule of expenditures of federal awards amount to $42,671,438. This unauthorized and fraudulent requests for funds noted of $249,559 is not included in the total expenditures in this program on the 2025 schedule of expenditures of federal awards as the amounts were recoded to unrestricted funds. IRC communicated this matter to the federal agency in February 2025 when the investigation began and again in September 2025 when the investigation was completed. The expenditures were reallocated to IRC’s unrestricted funds so that the federal grants were not charged. Cause: The internal investigation completed by ECU concluded that the unauthorized and fraudulent requests for funds resulted from the Housing Coordinator’s ability to request the transactions and approve the transactions because he obtained his direct report’s general ledger log in credentials. Additionally, there were several control gaps in the Northern California office, including the following: • There was a lack of safekeeping of blank USIO Cards – this office was not following the established control to keep the blank cards in a locked safe. • USIO cards were not tracked or recorded properly – this office was not always following the established control to have the refugees sign a log book upon receipt of a USIO card. • A lack of oversight from the heads of programs and finance in this office regarding reconciliations between budgeted and actual amounts with irregular transactions being flagged (excessive housing expenses). Effect: The auditee charged certain costs directly to the program that did not meet the requirements noted above, and were therefore, not allowable. Questioned Costs: Questioned costs were $249,559, however, IRC reallocated these costs to IRC’s unrestricted funds, so that the grants were not charged. Recommendation: IRC should design and implement enhanced internal control procedures over the authorization and disbursement of funds to IRC refugee clients through USIO cards to ensure that funding provided is allowable. Additionally, IRC should provide training to employees about sharing their personal credentials to access IRC’s general ledger. Views of Responsible Officials: Management agrees with this finding, which was identified by IRC in February 2025 and raised to KPMG prior to the single audit. Corrective actions related to USIO portal access, office leadership and structure, training and policies, and spot checking have been implemented and will continue through June 2026.

2025 002 Reporting Federal Funding Accountability and Transparency Act U.S. Department of State: Bureau of Population and Refugees and Migration: Overseas Refugee Assistance Program for Middle East and North Africa: Provision of lifesaving protection & health response for Syrian refugees and vulnerable Lebanese (ALN 19.519, award number SPRMCO24CA0321) Overseas Refugee Assistance Program for South Asia: Comprehensive, Integrated Multi Sector Response for Rohingya Refugees and Host Communities in Cox’s Bazar (Y2) (ALN 19.523, award number SPRMCO24CA0239) U.S. Agency for International Development: USAID Foreign Assistance for Programs Oversees: Improved (Re)integration Services Activity (ALN 98.001, award number 72052224CA00004) Lifesaving Integrated Humanitarian Services in Underserved Areas of Sudan (ALN 98.001, award number 720BHA22GR00218) Statistically valid sample: No, and it was not intended to be. Repeat finding: Yes (2024 001). Finding Type: Significant deficiency and noncompliance Criteria: Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109 282), as amended by Section 6202 of Public Law 110 252, (Transparency Act) that are codified in 2 CFR Parts 25 and 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first tier subawards of $30,000 or more to System for Award Management (SAM.gov). Aspects of the Transparency Act that relate to subaward reporting (1) under grants and cooperative agreements were implemented in OMB in 2 CFR Part 170 and (2) under contracts, by the regulatory agencies responsible for the Federal Acquisition Regulation (FAR at 5 FR 39414 et seq., July 8, 2010). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first tier subawards and contractors (i.e., prime contractors) that award first tier subcontracts. Title 45 U.S. Code of Federal Regulations Part 75 (45 CFR 75), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards for HHS Awards, section 75.2 defines Subaward as an award provided by a pass through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass through entity considers a contract. Further, 45 CFR 75.2 defines Subrecipient as a non federal entity that receives a subaward from a passthrough entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Additionally, per 2 CFR 200.303, non federal entities must establish and maintain effective internal control over federal awards that provide reasonable assurance that the non federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The following subaward data elements to be reported include the following: • Subawardee Name • Subawardee Unique Entity Identifier • Amount of Subaward • Subaward Obligation/Action Date • Date of Report Submission • Subaward Number • Subaward Project Description • Subawardee Names and Compensation of Highly Compensated Officers, if applicable The information is required to be reported in SAM.gov no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made. Condition and context: For ALN 19.519, there were 3 new or amended subawardee agreements entered into during fiscal year 2025 that required FFATA reporting. We selected 2 of these agreements for test work and noted that while all the key data elements were accurately submitted, the information for both agreements was not submitted timely. Both of the agreements were entered into on September 30, 2024 and had a submission due date of October 31, 2024. SAM.gov notes the submission date for both agreements to be August 21, 2025. During our testwork over this program, we noted IRC did not establish control procedures to submit FFATA reports for all subawards on a timely basis. We noted the following exceptions:7 Transactions Tested: 2 Subaward not reported: 0 Report not timely: 2 Subaward amount incorrect: 0 Subaward incorrect key elements: 0 Dollar amount of tested transactions: $403,678 Subaward not reported: $0 Report not timely: $403,678 Subaward amount incorrect: $0 Subaward incorrect key elements: $0 For ALN 19.523, there were 4 new or amended subawardee agreements entered into during fiscal year 2025 that required FFATA reporting. We selected 2 of these agreements for test work and noted that while all the key data elements were accurately submitted, the information for both agreements was not submitted timely. Both of the agreements were entered into on September 1, 2024 and had a submission due date of October 31, 2024. SAM.gov notes the submission dates to be December 4, 2025 and December 8, 2025. During our testwork over this program, we noted IRC did not establish control procedures to submit FFATA reports for all subawards on a timely basis. We noted the following exceptions: Transactions Tested: 2 Subaward not reported: 0 Report not timely: 2 Subaward amount incorrect: 0 Subaward incorrect key elements: 0 Dollar amount of tested transactions: $759,550 Subaward not reported: $0 Report not timely: $759,550 Subaward amount incorrect: $0 Subaward incorrect key elements: $0 For ALN 98.001, there were 23 new or amended subawardee agreements entered into during fiscal year 2025 that required FFATA reporting. We selected 5 for test work and noted that while all the key data elements were accurately submitted, the information for 4 of these agreements was not submitted timely. Two of these agreements were entered into on November 1, 2024, one was entered into on November 22, 2024 and the last was entered into on December 1, 2024. The submission due dates for these agreements were December 31, 2024 and January 31, 2025. SAM.gov notes the submission dates for three of these agreements to be December 18, 2025, and for the one agreement entered into on November 22, 2024, the submission date was noted to be January 7, 2025. During our testwork over this program, we noted IRC did not establish control procedures to submit FFATA reports for all subawards on a timely basis. We noted the following exceptions: Transactions Tested: 5 Subaward not reported: 0 Report not timely: 4 Subaward amount incorrect: 0 Subaward incorrect key elements: 0 Dollar amount of tested transactions: $302,280 Subaward not reported: $0 Report not timely: $291,135 Subaward amount incorrect: $0 Subaward incorrect key elements: $0 Cause: Following the federal system migration, the USG FFATA reporting platform within SAM.GOV no longer displayed or made readily retrievable the submission date associated with individual FFATA. Effect: Delayed reporting can lead to reduced transparency, hindering public access to information about how federal funds are being used. Questioned Costs: None. Recommendation: IRC should continue to communicate to all field office personnel responsible for FFATA submissions the importance of timely reporting and maintaining appropriate documentation to evidence timely reporting. We recommend adding another level of review from headquarters to ensure reporting is taking place once a subawardee agreement is finalized and documenting that review in writing. Additionally, we recommend that IRC take screen shots during the submission process and maintain these with the subawardee agreements. This will evidence the submission in SAM.gov, specifically evidencing the submission date. Views of Responsible Officials: While Management maintains it acted in good faith to ensure all FFATA submissions are provided timely, the new FFATA reporting platform issues made it difficult for IRC to substantiate the dates of submission. IRC did contact FSD.gov to confirm what form of evidence would be considered sufficient in the absence of visible system date stamps. FSD.gov was unable to provide specific confirmation and instead directed IRC to published guidance https://www.fsd.gov/gsafsd_sp/en/under the federal funding accountability and transparency act how acknowledging existing “implementation challenges”. This guidance shifts the focus of compliance validation from system generated timestamps to whether the recipient acted in good faith to comply with reporting obligations. Relying on this, IRC’s internal control framework did not include a secondary documentation mechanism to independently evidence submission dates in the event that system functionality limited visibility. However, IRC remains committed to full FFATA compliance and will incorporate additional steps to strengthen the compliance documentation trail.

REFERENCE: 2025-101 CFDA NUMBER: 10.558 – CHILD AND ADULT CARE FOOD PROGRAM U.S. DEPARTMENT OF AGRICULTURE - FOOD AND NUTRITION - 2025 PASSED THROUGH ARIZONA STATE DEPARTMENT OF EDUCATION GRANT NUMBER 6AZ300003 QUESTIONED COSTS N/A CONDITION The following errors were noted during testing of FDCH Site Claims and 18 Day Care Home provider files for the months of May 2025 and September 2025: 1. For 1 of 18 provider files tested, menus were clerically inaccurate and did not support the meals claimed in September 2025. 2. For 1 of 18 provider files tested, meals were claimed for the incorrect meal type. Afternoon Snacks were claimed rather than Evening Snacks. This error occurred during September 2025. 3. For 1 of 18 provider files tested, meals were incorrectly disallowed when a credible meal component was provided. This error occurred in May 2025. 4. For 1 of 18 provider files tested, meals were claimed when a child was not in attendance. This error occurred in May 2025. 5. For 2 of 18 provider files tested, although 3 monitoring visits were completed, documentation was not available to demonstrate that 2 of the visits were unannounced. 6. For 2 of 18 provider files tested, the five-day reconciliation on a sponsor monitoring visit was not completed. For 1 provider's visit the reconciliation was only completed for 4 days, and for the other provider there was no indication of the number of children signed in for any of the 5 days tested. These errors resulted in the following revised meal counts: These variances resulted in an under payment (known questioned costs) of $100. However, after projecting the various types of errors over six meal categories for the entire year, likely under reported costs totaled $5,531. CRITERIA In accordance with the Arizona Department of Education, Day Care Home Compliance Manual, Revised June 2019, Chapter 10, Meal Requirements, Section 10.7 Other Meal Requirements, in order to claim a meal, the provider must abide by the following criteria: • The provider must serve a fully reimbursable meal that meets the meal pattern requirements and are supported by complete and up to date attendance, meal count, and menu records; • The child must be present and participate in the meal service; • All meal components must be served together; • The meal must be fully consumed on the premises in a congregate setting. Meals sent home with a child due to the parent picking up the child during meal service cannot be claimed; • Meal must be served during approved meal service time; • The provider can be reimbursed for a maximum of two meals and one snack or two snacks and one meal per child, per day; • Only children who are enrolled can be claimed and the number of children cannot exceed the allowable ratio; • Payment may be made for meals served to provider’s own child(ren) or foster children only when:  Their child(ren) are enrolled and participating in the child care program during the time of the meal service;  At least one enrolled, non-resident child is present and participating in the child care program;  The provider meets the family size income standards for free or reduced price meals; • Seconds may be served but are not reimbursable; and • If a school age child receives a breakfast, lunch or afterschool snack at school, a provider may not claim the same meal. In accordance with 7 CFR, Subtitle B, Chapter II, Subchapter A, Part 226, Subpart E Operational Provisions, §226.16 (d)(4)(ii) Reconciliation of meal counts. Reviews must examine the meal counts recorded by the facility for five consecutive days during the current and/or prior claiming period. For each day examined, reviewers must use enrollment and attendance records (except in those outside-school-hours care centers, at-risk afterschool care centers, and emergency shelters where enrollment records are not required) to determine the number of participants in care during each meal service and attempt to reconcile those numbers to the numbers of breakfasts, lunches, suppers, and/or snacks recorded in the facility's meal count for that day. Based on that comparison, reviewers must determine whether the meal counts were accurate. If there is a discrepancy between the number of participants enrolled or in attendance on the day of review and prior meal counting patterns, the reviewer must attempt to reconcile the difference and determine whether the establishment of an overclaim is necessary. In accordance with 7 CFR, Subtitle B, Chapter II, Subchapter A, Part 226, Subpart E Operational Provisions, §226.16 (d)(4)(iii), Frequency and type of required facility reviews. Sponsoring organizations must review each facility three times each year, except as described in paragraph (d)(4)(iv) of this section. In addition: (A) At least two of the three reviews must be unannounced; (B) At least one unannounced review must include observation of a meal service; (C) At least one review must be made during each new facility's first four weeks of Program operations; (D) Not more than six months may elapse between reviews; (E) The timing of unannounced reviews must be varied so that they are unpredictable to the facility; and (F) All types of meal service must be subject to review and sponsoring organizations must vary the meal service reviewed. In accordance with the Uniform Guidance, Compliance Supplement, Part 6 – Internal Control, 2 CFR section 200.303 requires that recipients and subrecipients receiving federal awards establish, document and maintain effective internal control over the federal awards that provides reasonable assurance that the recipient or subrecipient is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. EFFECT Program requirements were not complied with. Additionally, meal reimbursements were clerically inaccurate and the providers were incorrectly reimbursed. CAUSE Although the internal controls were adequately designed, there were deficiencies in the execution of the controls. Most menu errors occurred on paper menus, which have a higher risk of errors. RECOMMENDATION AND BENEFIT Menus should be reviewed to ensure all eligible meals are claimed, and provider meal count sheets should be reviewed for clerical accuracy and completion prior to the preparation of the reimbursement claim. Additionally, monitoring visits should be reviewed to ensure that all required information is properly included, including completion f the five day reconciliations and indication if the review is unannounced and . These reviews should be documented. This will help ensure that program requirements are complied with and only eligible meals served to eligible participants are claimed for reimbursement. VIEWS OF RESPONSIBLE OFFICIALS See Corrective Action Plan.

2025-001 Internal Control over Compliance and Compliance with the Reporting Compliance Requirement (Significant Deficiency) Information on the Federal Program: United States Agency for International Development Assistance Listing Number: 98.001 Assistance Listing Name: USAID Foreign Assistance for Programs Overseas Direct Award Numbers Award Period 720BHA23GR00031 February 1, 2023 through January 31, 2026 72068324GR00002 September 7, 2024 through December 31, 2024 Criteria or Specific Requirement: In accordance with §200.303(a), Internal Controls, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109-282), as amended by Section 6202 of Public Law 110-252, that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Subaward Reporting in SAM.gov. The prime awardee is required to file a FFATA sub-award report by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. Condition: We performed testing over CRS’s compliance with specific FFATA reporting requirements. Of the eight sub-award reports selected for testing, two of the reports with sub-award amounts totaling $313,190 were not submitted within the required timeframe. Specifically, the two FFATA reports were filed between 64 and 66 days later than the required filing date. Questioned Costs: There are no known or likely questioned costs. Context: This is a condition based on testing of CRS’s compliance with specified requirements. The samples were selected using a non-statistical sampling method. Cause: Although CRS has existing internal control policies and procedures ensuring appropriate filing of sub-award information in SAM.gov, the country offices failed to file the FFATA reports on time. Effect: Failure to report subrecipient information in a timely manner can result in lack of transparency and accountability, which is contrary to the intent of FFATA. Such non-compliance also increases the risk of loss of future awards if compliance with award terms is not met. Repeat Finding: No. Recommendation: We recommend that management ensure that all FFATA reports are filed in a timely manner. In addition, management should strengthen the existing internal controls and conduct refresher training to CRS country office personnel emphasizing timely submission of FFATA reports. Views of Responsible Officials: CRS management agrees with the finding and recommendations and will enhance the processes around timely submission of FFATA reports.

Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Head Start Federal Assistance Listing Number: 93.600 Award Period: June 1, 2024 to June 30, 2025, August 1, 2024 to July 31, 2025, July 1, 2025 to May 31, 2026, August 1, 2025 to July 31, 2026 Type of Finding:  Significant Deficiency in Internal Control over Major Federal Programs and Other Matters Criteria or Specific Requirement: The organization must train all governing body and policy council members within 180 days of the beginning of the term of a new governing body or council. Under 2 CFR section 200.303, a non-federal entity must establish and maintain effective internal controls over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing we noted one new board member did not have support verifying they received the appropriate training. This individual was a past employee who would have received the training while employed but no support was retained to support that the training was done. Questioned Costs: N/A Context: No documentation was retained to support that a new board member had proper training. Cause: Individual was a past employee who would have received the training while employed but not support was retained to support that the training was done. Effect: Potential for a board member to not have the proper knowledge and understanding of how to provide adequate oversight of the Head Start program. Repeat Finding: No Recommendation: Ensure support is retained to show all new board members received training within 180 days. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

Finding 2025-009 – Reporting (Material Weakness and Noncompliance)(Repeat Finding) Identification of the Federal Program: Community Development Block Grants, ALN 14.218, Department of Housing and Urban Development (CDBG) and Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Department of the Treasury (CRF). Criteria: 2 CFR 200.328-330 establish the requirements of nonfederal entities for financial and performance reporting that include timely and accurate reporting. 2 CFR 200.303 requires nonfederal entities to establish, document and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Typical control procedures for reporting include having a supervisor review the submitted report and ensuring the work is performed and documented in a way that confirms the accuracy and completeness of all data and information included. Condition: We selected five reports for the two grant programs to test for compliance and controls over reporting requirements. No documentation of review or approval of the reports was available. For CDBG, 2 quarterly cash reports and the FY24 Consolidated Annual Performance and Evaluation Report (CAPER) were tested, one cash report was late. Cause: The City did not retain documentation of a review and approval of federal reports submitted. Effect: The City did not have appropriate controls in place over documentation of reporting requirements. Questioned Costs: None reported. Recommendation: We recommend the City strengthen its policies and procedures over the grant reporting process to ensure controls are properly implemented and working effectively. Views of Responsible Officials: The City agrees with the finding. See Management’s View and Corrective Action Plan included at the end of the report.

ESTABLISH, DOCUMENT, AND MAINTAIN EFFECTIVE INTERNAL CONTROL OVER THE FEDERAL AWARD THAT PROVIDES REASONABLE ASSURANCE THAT THE RECIPIENT OR SUBRECIPIENT IS MANAGING THE FEDERAL AWARD IN COMPLIANCE WITH FEDERAL STATUTES, REGULATIONS, AND THE TERMS AND CONDITIONS OF THE FEDERAL AWARD. THESE INTERNAL CONTROLS SHOULD ALIGN WITH THE GUIDANCE IN “STANDARDS FOR INTERNAL CONTROL IN THE FEDERAL GOVERNMENT” ISSUED BY THE COMPTROLLER GENERAL OF THE UNITED STATES OR THE “INTERNAL CONTROL-INTEGRATED FRAMEWORK” ISSUED BY THE COMMITTEE OF SPONSORING ORGANIZATIONS OF THE TREADWAY COMMISSION (COSO), 2 CFR 200.303.

Condition: During our testing of controls over payroll, we identified three instances of payroll summary reports lacking an indication of review and approval. Criteria: The Uniform Guidance 2 CFR 200.303 requires auditees to establish and maintain effective internal control over federal awards that provides reasonable assurance that the awards are being managed in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The Organization should have a system of internal control in place to provide reasonable assurance that payroll summary reports are accurate and are being reviewed. Cause: The Organization has experienced significant turnover in HR positions and has had the Executive Director and Finance Manager take on these duties, along with their normal duties, until a replacement can be found. Effect: In the absence of review, payroll errors may go undetected, potentially resulting in inaccurate payroll records and payments. The possibility of fraud or noncompliance occurring and not being prevented or detected and corrected is present. Context: During our testing of a sample of six payroll summary reports, we noted an instance of a lack of review and approval. We then expanded the sample to 12 payroll summary reports, identifying one further instance of lack of review and approval, at which point the sample was again expanded to 24. A third instance was identified during the testing over the expanded sample, at which point testing ceased, and we determined that we could not rely on controls. The control deficiency did not result in a material impact on the program and did not reach the threshold for reporting questioned costs. Repeat of Prior Year Finding: No Auditor’s Recommendation: We recommend that payroll summary reports be reviewed and approved prior to completing the payroll process. If the Executive Director is unavailable, another staff member should review and approve the reports so the payroll process can be completed. View of Management: Management agrees with the finding. A response can be found in the Corrective Action Plan.

2025-001 – Internal Control over Compliance and Compliance with Reporting Information on the Major Federal Program: Federal Agency: Department of Interior Program Name: National Park Service Second Century Endowment and Appropriation Assistance Listing Number: 15.U01 Award Number: H.R. 4680/P.L. 114-289 Award Period: October 1, 2024 to September 30, 2025 Criteria – The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with the requirements 2 CFR §1402.300(b), a non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of the Federal Funding and Accountability Act (FFATA), which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR part 25, Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR part 170, Reporting Subaward and Executive Compensation Information. In accordance with 2 CFR Part 170, Appendix A, under FFATA, the Foundation is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System. Condition – During our testing of reporting, we selected five subrecipient awards. For all samples tested, the Foundation did not comply with the mandatory FFATA report filing requirements. Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 5 5 5 Not applicable – no report was submitted Not applicable – no report was submitted Dollar Amount of Tested 2025 Subawards Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $ 319,000 $ 319,000 $ 319,000 Not applicable – no report was submitted Not applicable – no report was submitted Cause - The Foundation did not have adequate policies and procedures in place to ensure compliance with the FFATA filing requirements. Effect or Potential Effect - Failure to comply with the reporting requirements of the Uniform Guidance could result in noncompliance and awarding agency taking administrative action. Questioned Costs – None. Context - This is a condition identified based upon our review of the Foundation’s compliance with specified requirements. The sample was selected based on a non-statistical basis. The prevalence of these finding is detailed in the condition section above. Repeat Finding – This is a repeat finding from prior year. This was reported as finding 2024-001 in the 2024 report. Recommendation – BDO noted management’s actions to continuously work with federal grantor/agencies to address the prior year finding. However, the Foundation’s grant agreement does not have a Federal Award Identification Number (FAIN) which is a requirement to comply with FFATA reporting, therefore management is still unable to file the required FFATA reporting. BDO recommends that the Foundation continue to work with federal grantor/agencies to determine the required information and immediately comply with the FFATA requirements. Views of Responsible Officials – The Foundation’s management has been given a legal opinion from counsel that the Appropriation and the Endowment are exempt from the Uniform Guidance and the Single Audit. As such, will continue to work with Department of Interior to remedy this situation. The planned corrective actions are presented in the Foundation’s management’s corrective action plan attached as Appendix C.

Department of Housing and Urban Development - Direct Project - Community Development Block Grant- ALN 14.218- Program Year 2025 (B-20-UC-11-0018 FY 2021, B-20-UW-12-0018 FY 2020, B-22-UC-12-0018 FY 2022, B23-UC-12-0018 FY 2023, B-24-UC-12-0018 FY 2024, FR-6512-N-01 FY 2024) Criteria — 2 CFR section 200.303 – Internal Controls of the Uniform Guidance states that the non‐federal entity must: (a) Establish and maintain effective internal controls over Federal award that provides reasonable assurance that the non‐Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition — There was no evidence of the controls in place to review and approve reports prior to submission. The lack of internal control is a systemic issue over reporting. Cause/Effect—There is no evidence of the internal control requiring review and approval prior to submission of the cash on hand quarterly report and the FFATA reports prior to submission. If the internal controls are not in place the reports might not be accurately and timely filed, which could cause a delay in payment or loss of funding. Questioned Costs– None noted. Reported finding is for noncompliance in the reporting compliance requirement that does not affect the amount expended or received from the Federal award. Auditor’s Recommendation – Develop an internal control process with evidence of a review of reports prior to submission. CRI also recommends that the County develop a process to track all grant reports required by ALN#/CSFA# and by contract. This system would provide a repository of all the required reporting which the county could use to verify reports are filed timely and accurately. Management Response – See Corrective Action Plan Letter.

Interest Earned on Federal Funds. Criteria: 2 CFR 200.303 provides that non-federal entities must establish and maintain effective internal controls to provide reasonable assurance of compliance with Uniform Guidance. 2 CFR Section 200.305 sets forth the requirements for the return of interest earned on federal funds. Recipients of federal grants are required to establish internal controls to minimize the time that elapses between the receipt of federal funds from the grantor, and the payment of those funds to vendors who provide goods or services. Interest earnings that exceed $500 per year from excess cash balances must be paid to the federal grantor. Condition: CASIS did not calculate interest earnings on the federal cash balance to determine if any earnings should be repaid to the grantor. Cause: CASIS does not have a policy to monitor federal cash balances for cash management requirements, including the calculation of interest earnings. Effect: CASIS did not take steps to reduce the time elapsing from the date it received federal funds to the date it spent the funds on program costs. The lapse resulted in interest earned on federal funds. Questioned Costs: Fontana calculated that CASIS earned approximately $17,000 of interest on the federal funds balance for the fiscal year ended September 30, 2025. Interest earnings on federal funds of more than $500 must be returned to the grantor. Perspective: Interest was not calculated or returned to the grantor for fiscal year ended September 30, 2025. Recommendation: Fontana recommends that CASIS: o Implement controls to minimize the time between receipt of funds from the granting agency and disbursement of those funds. o Compute interest earned on advance funds and remit amounts in excess of $500 to the grantor when required.

Finding 2025-001: Significant Deficiency in Internal Control Over Compliance and Non-Material Non-Compliance Federal Awarding Agency: U.S. Department of Housing and Urban Development (HUD) Department: Department of Housing and Community Development (DHCD) Program name: Housing Voucher Cluster ALN: 14.879 Compliance Requirement: Special Test-Housing Quality Standards (HQS) Inspection and Enforcement Prior Year Finding Number: N/A Criteria or Specific Requirements: Per 24 CFR 982.404 “The public housing Organization (PHA) must not make any housing assistance payments (HAP) for a dwelling unit that fails to meet the HQS, unless the owner corrects the defect within the period specified by the PHA and the PHA verifies the correction. If a defect is life threatening, the owner must correct the defect within no more than 24 hours. For other defects, the owner must correct the defect within no more than 30 calendar days (or any PHA-approved extension)”. Additionally, per 24 CFR 982.405 “The PHA must inspect the unit at least biennially during assisted occupancy to ensure that the unit continues to meet the HQS”. Per 2 CFR section 200.303, non-Federal entities receiving Federal awards must establish and maintain internal control designed to ensure reasonably compliance with Federal statutes, regulations, and terms and conditions of the Federal award. Condition: During our testing of sixty (60) inspections, we noted the following: - One instance where a unit failed its inspection and re-inspection was not performed or scheduled within the required timeframe. The Organization also failed to abate the housing assist payments (HAP) or terminate the HAP contract for this unit in a timely manner. Additionally, for this unit the inspection was not performed on the required biennial basis. Questioned Costs: We identified $984 in known and $54,962 in likely questioned costs as a result of our sampling and testing procedures. Cause: The Organization did not follow the internal controls, policies and procedures in place to ensure inspections and re-inspections of units are performed on a timely basis. Context: This is a condition based on testing of the Organization’s compliance with specified requirements. The prevalence of the finding is detailed in the Condition section above. The samples were selected using a nonstatistical method. Effect: The Organization’s control environment over HQS enforcements did not ensure that re-inspections were performed timely or documented within the system or that HAP abatements occurred in a timely manner. As a result, the Organization was not in compliance with the HQS enforcement requirements as of September 30, 2025. Non-compliance with these requirements creates a risk that the Organization may provide federal funds to tenants of ineligible units. Recommendation: We recommend the Organization review their system functionality to determine whether an electronic process for scheduling and follow-up or comprehensive reporting can be identified to improve efficiency and eliminate the potential for human error. If an electronic process or comprehensive reporting is not available, or cannot fully cover the deficiency, we recommend the Organization look into measures to streamline their current internal controls, policies and procedures to eliminate non-compliance. Potential examples include adding an inspection checklist, having the inspection supervisor review and schedule upcoming inspections in advance, building room into the schedule for life-threatening re-inspections, having the inspection supervisor ensure that each scheduled inspection is timely documented in the system, etc. Repeat Finding: No Views of responsible officials: Organization management agrees with the finding and recommendations set forth within. Refer to management’s corrective action plan for additional information.

2025-004 Suspension and Debarment 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds US Department of Treasury Passed through Florida Department of Environmental Protection 2024 Funding Criteria: 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal controls. Documentation of the check for suspension or debarment needs to be retained. Condition: Review of checking for suspension and debarment was not done prior to contracting with the vendor. Cause of condition: The City did not consistently complete reviews for all vendors to ensure that the vendors were not suspended and debarred before projects had. Perspective (context): For 5 of the 8 vendors selected, suspension and debarment was not checked prior to paying the vendor. The sample was not statistically valid. Potential effect of condition: Good or services could be contracted with a suspended or debarred vendor, creating questioned costs. Questioned Costs: None noted. Reported finding is a deficiency in internal control. Recommendation: The City should require all vendors to provide certification of their status before a contract or purchase order is completed with the vendor and the City should obtain new certificates annually to ensure the vendors status has not changed. Management’s response on planned corrective action: Management agrees with the recommendation. The City has implemented procedures requiring all departments to obtain vendor certification of status prior to executing a contract or issuing a purchase order. Over the past year, we have worked diligently to educate departments on the importance of obtaining and maintaining proper vendor certifications to ensure compliance with applicable requirements. We will continue to reinforce this expectation and monitor compliance, including obtaining updated certifications annually to ensure vendor status has not changed.

2025-005 Lack of Report Review 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds US Department of Treasury 2021 Funding Criteria: 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal controls. Reports should be subject to independent review to verify completeness, validity and timeliness of submission. Condition: There was no documented review by the City Manager of the annual report submitted to the Us Treasury department prior to submittal. Cause of condition: The annual report to the US Treasury was not reviewed prior to submittal. Perspective (context): The one annual report was not reviewed. Potential effect of condition: Review could contain errors, could be submitted incomplete or late. Questioned Costs: None noted. Reported finding is a deficiency in internal control. Recommendation: The City should have controls in place to ensure all reports are reviewed prior to submittal. Management’s response on planned corrective action: Management agrees that reports should be reviewed prior to submission and notes that the City does have controls in place to ensure appropriate review procedures are performed. In this instance, the report was prepared and submitted by the City Manager, and due to limitations within the Federal Government’s online reporting system, there was not a built-in approval workflow available to document the review process.

Finding: 2025-001. Insufficient Controls Over Monitoring Federal Expenditures and SEFA Preparation Federal Agency: Federal Highway Administration Pass-through Agency: Texas Department of Transportation Assistance Listing Number: 20.205 Federal Program Name: Highway Planning and Construction Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: 2 CFR §200.303 requires entities to establish and maintain effective internal control over Federal awards that provides reasonable assurance the entity is managing the awards in compliance with Federal statutes, regulations, and the terms and conditions of the awards. 2 CFR §200.501 requires a Single Audit when a non-Federal entity expends $1,000,000 or more in Federal awards during the current fiscal year (or $750,000 during the prior year). 2 CFR §200.510(b) requires the preparation of a complete and accurate Schedule of Expenditures of Federal Awards (SEFA). Applicable GAAP requires recognition of grant revenue and related receivables when allowable expenditures are incurred. Condition: The City incurred reimbursable federal expenditures in the prior year but did not submit reimbursement requests or record the related receivable and revenue. As a result, certain federal expenditures were omitted from the SEFA, and total federal expenditures were understated below the $750,000 threshold for a Single Audit in the prior year. Cause: Grant administration is decentralized across multiple departments, and formal controls were not in place to reconcile grant expenditures to reimbursement requests or to monitor total federal expenditures and review the SEFA for completeness. Effect: Grant revenue and related receivables were understated, and the prior year SEFA was incomplete. As a result, the City did not include this grant award in the Single Audit in the prior year as required by Uniform Guidance. Questioned costs: N/A Context: N/A Repeat finding reference: N/A Recommendation: The City should strengthen oversight of federal grant activity by implementing procedures to monitor federal expenditures and ensure the SEFA is complete and accurate. This may include centralizing grant oversight within the finance function or designating a responsible grant administrator. Procedures should include periodic reconciliations of grant expenditures to reimbursement requests and a formal year-end review of total federal expenditures and the SEFA, with coordination between the finance function and departments administering federal programs. Personnel involved in grant administration should receive training on Uniform Guidance requirements. View of Responsible Officials Management’s response and corrective action plan are included in the accompanying corrective action plan.

Reviews of Grant Reports U.S. Department of Treasury ALN 21.027 - COVID 19 Coronavirus State and Local Fiscal Recovery Funds Contract No. Y5177 2021 Funding Criteria: 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal controls. Reports should be subject to independent review to verify completeness, validity and timeliness of submission. Condition: There was no documented review by an independent individual for the reports submitted to the US Treasury department prior to submittal. Cause: The City did not have a process in place to document the review of reports to the US Treasury was prior to submittal. Effect: Reports submitted to the Florida Department of State may be incomplete, include errors, or be submitted late. Perspective: There was no evidence of review provided for the reports submitted during Fiscal Year 2025. Questioned Costs: None, reported finding is a deficiency in internal control. Recommendation: The City should have controls in place to ensure all reports are reviewed prior to submittal and the review is documented. Management Response: Management agrees with the finding. Management will implement procedures to document independent review of all reports submitted to the U.S. Treasury to ensure completeness, accuracy, and timeliness.

2025-002 DISALLOWED COSTS ALN 97.083 Staffing for Adequate Fire and Emergency Response (SAFER) Grant Program U.S. Department of Homeland Security Federal Emergency Management Agency (FEMA) Federal Award No. EMW-2022-FF-00868 2024/2025 Funding Criteria: 2 CFR 200.303(a) requires non-federal entities to establish and maintain effective internal controls over federal awards. The award terms allow for reimbursement of personnel costs including wages, the employer portion of payroll taxes, and fringe benefits (health insurance, life insurance, and retirement benefits. Compensation for a firefighter’s normal, contracted work schedule is reimbursable, but overtime costs are not eligible for reimbursement by the SAFER grant award (including overtime for holdovers, extra shifts, to attend training, etc.). Only costs for overtime that the fire department routinely pays as a part of the base salary or a firefighter’s regularly scheduled and contracted shift hours, in order to comply with the Fair Labor Standards Act (FLSA), are eligible. Semi-annual financial reporting is required of all grant award recipients (per the award agreement terms). Condition: There was no independent review of reimbursement requests or semi-annual financial reports prior to submission to the grantor. Reimbursement requests included disallowed costs related to overtime (associated fringe benefits expense) but not the overtime itself. Additionally, semi-annual financial reports were based on reimbursement requests which resulted in reporting errors. Cause: There was no independent review of reimbursement requests or semi-annual financial reports prior to submission to the grantor. Effect: Lack of review increases the likelihood that reports are incomplete, inaccurate, or not submitted timely. Reimbursement requests and financial reports included errors and the City was inadvertently reimbursed for disallowable costs Questioned Costs: Known questioned costs are $10,551. Questioned costs computed through recalculation of fiscal year 2025 reimbursement requests. Perspective: Disallowed costs impacted all fiscal year 2025 reimbursement requests and semi-annual financial reports. Recommendation: Independent review of program reimbursement requests and reports should be consistently performed and documented prior to submission the grantor. Management Response: The City agrees with this finding and will establish internal procedures for review of program reimbursement requests before submission to the grantor. The Grant Compliance Manager will prepare the reimbursement requests and semi-annual reports and provide to the Director of Finance for review and approval prior to submission. This corrective action will take effect immediately.

2025-001 REPORTING ALN 20.106 Airport Improvement Program U.S. Department of Transportation Federal Aviation Administration Federal Award No. 3-12-0046-064-2024 2024/2025 Funding Criteria: 2 CFR 200.303(a) requires non-federal entities to establish and maintain effective internal controls over federal awards. The award terms require submission of quarterly construction and inspection reports within 30 days of the end of each Federal fiscal quarter. Condition: A quarterly report was not submitted for the period January 2025 – March 2025. Cause: The staff member who typically prepared the report was out on medical leave during this period. Effect: The Airport, a component unit of the City, was out of compliance with award requirements which could jeopardize its ability to be reimbursed for this award or obtain additional awards in the future. Questioned Costs: None. Reported finding is for noncompliance in the reporting compliance requirement that does not affect the amount expended or received for the federal award. Perspective: All other quarterly reports sampled were appropriately submitted timely. When we brought this issue to the attention of management they submitted the quarterly report late. Recommendation: The Airport, a component unit of the City, should develop a process to ensure reports are submitted timely for all awards including re-assigning tasks when personnel are on leave. Management Response: Airport management has set up a process whereby the quarterly reports are reviewed by another team member to ensure the reports are completed and submitted in the time frame required by the Federal Aviation Administration. This review will be completed by the Accounting Manager who understands the importance of submitting the information and, if they are not completed, will complete and submit the reports. Any issues or omissions observed by the Accounting Manager with submitting the required reports will be reported to the Director of Finance and Administration for further follow-up with the staff member who is primarily responsible for this task.

Year Finding Originated: 2025 Title and Assistance Listing Number of Federal Program: Staffing for Adequate Fire and Emergency Response 97.083 Federal Award Identification Number and Year: EMW-2022-FF-00974 Name of Federal Agency: Department of Homeland Security Questioned Costs: $13,801 Criteria: Per 2 CFR § 200.305, non-Federal entities must minimize the time between the transfer of federal funds and the disbursement of those funds for program purposes. Federal regulations and the SAFER grant terms require that reimbursement requests be based on allowable expenditures that have been incurred by the District. Additionally, 2 CFR § 200.303 requires non-Federal entities to establish and maintain effective internal controls over Federal awards to ensure compliance with Federal statutes, regulations, and terms and conditions of the Federal awards. Condition: During testing of SAFER reimbursement requests, one reimbursement request contained an error in the benefits calculation formula, resulting in the employer insurance costs being included twice in the request. The District received funds in excess of allowable costs incurred during the reimbursement period due to the calculation error. The District’s control designed to prevent such errors, management review and approval of SAFER reimbursement requests prior to submission, did not operate effectively. Although reimbursement requests are prepared and submitted by District personnel, documentation supporting management’s review and approval of the reimbursement calculations was not maintained, and the error in the reimbursement calculation was not detected prior to submission. Cause: The reimbursement request was prepared using a manual spreadsheet containing a formula error that duplicated certain benefit costs. The District’s reviewed procedures were not formally documented or designed to ensure the accuracy of reimbursement calculations prior to submission. Effect: The District requested and received federal funds in excess of allowable expenditures incurred during the reimbursement period. Additionally, the lack of effective review controls increases the risk that reimbursement requests may contain errors or unsupported amounts. Recommendation: We recommend that the District strengthen controls over reimbursement calculations and implement review procedures to ensure reimbursement requests are based solely on allowable costs incurred prior to submission. Views of responsible officials: See management’s response to finding on Page 59.

Year Finding Originated: 2025 Title and Assistance Listing Number of Federal Program: Staffing for Adequate Fire and Emergency Response 97.083 Federal Award Identification Number and Year: EMW-2022-FF-00974 Name of Federal Agency: Department of Homeland Security Questioned Costs: $0 Criteria: Per 2 CFR § 200.303(a), the non-Federal entity must establish, document, and maintain effective internal control over Federal awards to ensure compliance with federal statutes, regulations, and terms and conditions of the federal awards. Condition: During testing of reporting requirements for the SAFER grant, the District could not provide documentation evidencing management review and approval of required federal reports prior to submission. Discussions with management indicated that reports were prepared and submitted by District personnel; however, formal documentation evidencing management review and approval was not maintained. Cause: The District relied on informal communication and oversight rather than detailed review procedures to ensure required federal reports are accurately prepared prior to submission. Effect: While no instances of noncompliance were noted, the lack of documented controls in practice increases the risk that future required reports could be incomplete, inaccurate, or untimely. Recommendation: We recommend that the District enhance and document internal controls over financial reporting, including a detailed review and approval process for required federal reports prior to submission, including maintaining documentation evidencing such review. Views of responsible officials: See management’s response to finding on Page 59.

2025-004 Reporting ALN 21.027 Coronavirus State and Local Fiscal Funds US Department of the Treasury Fiscal Year 2025 Funding Grant Y5314 Criteria: 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal controls. Reports should be subject to independent review to verify completeness, validity, and timeliness of submission. Condition: The City’s controls over reports issued to U.S. Treasury failed to operate correctly as the underlying data contained errors which were noted on the report issued to the US Treasury. Cause of the condition: The City did not have a proper review of the underlying data for the reports sent to the US Treasury as the underlying data caused the reports to be incorrect. Potential effect of condition: Reports submitted could contain errors or could be incomplete. Questioned costs: None noted. Reported finding is a deficiency in internal control. Recommendation: The City should review the underlying data along with the report to ensure the report agrees with the support and the underlying data is correct. Management Response: Management recognizes the importance of accurate and complete reporting to the U.S. Treasury. While procedures were in place, the review of underlying data was not sufficient to ensure accuracy and completeness prior to submission. The issue was limited to a single report and was corrected in the subsequent U.S. Treasury reporting cycle in accordance with program requirements. To prevent recurrence, management has enhanced its review procedures over grant reporting to include reconciliation of underlying data and validation checks for inconsistencies prior to report submission. Additionally, a secondary level of review will be performed to ensure reports are complete and accurate before submission to the U.S. Treasury.