Findings Citing § 200.303

Criteria: 2 CFR 200.303 requires nonFederal entities to “establish and maintain effective internal control over the Federal award” to provide reasonable assurance of compliance with Federal statutes, regulations, and the terms and conditions of the award. This includes adequate controls over the accuracy, completeness, and reliability of reporting. Statement of Condition: During reporting testing for Program 14.251, it was noted that the organization does not have a documented internal review or approval process governing the preparation and submission of required Federal reports. Although the HUD grant agreement does not explicitly require a presubmission review, the Federal award is still subject to the internal control requirements of 2 CFR 200.303, which require the entity to maintain effective controls over reporting. Cause: The organization has not formally established, documented, or implemented a comprehensive internal control framework over the reporting process, including supervisory review requirements. Effect or Potential Effect: The absence of a documented and consistently applied review process increases the risk that Federal reports may contain errors, omissions, or unsupported information, which could affect compliance with Federal reporting requirements and reduce the reliability of information used for program oversight. Questioned Costs: $- Recommendation: Management should develop, implement, and document a formal, comprehensive internal review and approval process for all required reports submitted under federal awards. The process should: define supervisory review responsibilities; require documented evidence of review (e.g., signoff, checklist, or electronic approval); and be consistently applied across all reports submitted for federal programs. Management Response: See corrective action plan.

2025-001 U.S Department of Housing and Urban Development Mortgage Insurance Rental Housing CFDA #14.134 Eligibility Significant Deficiency in Internal Control over Compliance Criteria: Complete controls over internal controls require all tenant eligibility requirements to be supported by appropriate documentation. Uniform Guidance 2 CFR 200.303(a) requires non-Federal entities to establish and maintain effective internal control over Federal awards that provides reasonable assurance that the entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls over compliance should ensure that rental assistance is calculated accurately and in accordance with applicable program requirements. Condition: During our testing, one out of 15 tenant files tested received an assistance payment that was higher than allowed. Cause: The Organization’s internal review procedures did not identify the use of the incorrect assistance payment. Effect: The use of incorrect assistance payments increases the risk that the rental subsidy in connection with the Federal program may not be accurate. While no questioned costs were identified, the deficiency represents a breakdown in internal control over compliance. Questioned Costs: $10 Context/Sampling: A nonstatistical sample of 15 tenants out of 99 total were selected for testing. Repeat Finding from Prior Year: No. Recommendation: We recommend Christian Care management strengthen internal controls and oversight over the rental assistance calculations and tenant eligibility documentation to ensure accuracy of all assistance payments. Views of Responsible Officials: Management agrees with the finding.

Finding 2025-001: Rural Rental Housing Loans Assistance Listing Number: 10.415 U.S. Department of Agriculture (Repeat of Finding 2024-001) Compliance Requirement: Eligibility, Program Income Type of finding: Internal Control Over Compliance (significant deficiency) Criteria: The Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards require that the non-Federal entity establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award (2 CFR 200.303(a)). Condition: There were no reviews of the tenant eligibility determinations during the year for the Sierra Vista Alamosa Housing Complex. This complex represents 1 of 3 complexes and 27 of the 111 units included in the Rural Rental Housing Loans program. In addition, seven of the 12 monthly housing assistance payment requests submitted for the Sierra Vista Alamosa Housing Complex were not reviewed. Cause: Management has not implemented an internal control structure that provides for independent review of tenant eligibility determinations or all monthly housing assistance payment requests for the Sierra Vista Alamosa Housing Complex. Effect: Noncompliance with the Rural Rental Housing Loan requirements may exist and not be detected by the Organization. Recommendation: The Organization should strengthen its internal controls with adopted policies and procedures to ensure a review process is established through adequate segregation of duties. The Organization should consider assessing and realigning the duties and responsibilities of the Executive Director, Administrative Assistant, and Alamosa Property Manager to provide for a review process of tenant eligibility determinations and the monthly housing assistance payment requests for the Sierra Vista Alamosa Housing Complex. Grantee’s Response: See corrective action plan.

Criteria: CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. The loan resolution security agreement states the Hospital must set aside a capital asset replacement account which may be established as a bookkeeping account or as a separate bank account. Funds may be deposited in institutions insured by state and federal government or invested in marketable securities backed by the full faith and credit of the United States. Condition: The funds that represented the capital asset replacement fund were commingledwith an existing board-designated CD account. Cause: The Hospital did not maintain a separate bank account or general ledger account for the capital asset replacement fund. Effect: The capital asset replacement funds were commingled with board-designated funds within a certificate of deposit account. Questioned Costs: None reported. Context: Sampling was not used. Recommendation: We recommend that management maintain a separate bank account or general ledger account for the capital asset replacement fund. Views of Responsible Officials and Planned Corrective Action: Management agrees with the funding and will deposit the required capital asset replacement funds in either a separate bank account or general ledger account.

Assistance Listing Number, Federal Agency, and Program Name - 66.616 - U.S. Environmental Protection Agency - Environmental and Climate Justice Community Change Grants Program Federal Award Identification Number and Year - 2024-00E04015 Pass-through Entity - N/A Finding Type - Material weakness Repeat Finding - No Criteria - The Federal Funding Accountability and Transparency Act (FFATA) as mended by Section 6202 of Public Las 110-252 requires recipients of federal awards to report data using the FFATA Subaward Reporting System (FSRS) Tool (pre-March 8, 2025) or SAM.gov (post-March 8, 2025). 2 CFR 200.303 requires that recipients and subrecipients receiving federal awards establish, document, and maintain effective internal control over the federal awards that provide reasonable assurance that the recipient or subrecipient is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition - While the System had controls over accumulating the data for inputs into the portal, it did not have an adequate control in place to ensure transactions subject to FFATA reporting were reviewed for completeness and accuracy upon submission. If Questioned Costs Are Not Determinable, Description of Why Known Questioned Costs Were Undetermined or Otherwise Could Not Be Reported - There were no questioned costs identified. Identification of How Questioned Costs Were Computed - There were no questioned costs identified. Context - The System's internal controls over FFATA reporting were not designed to review submissions of FFATA reports. The System did not have a formal review process to verify the completeness and accuracy of data submitted to SAM.gov, nor did it maintain a reconciliation between the accounting system's subaward records and the information entered into SAM.gov. There were no instances of noncompliance or questioned cost identified related to this lack of control. Cause and Effect - The System has not developed or implemented a review structure over the FFATA reporting process at the time of submission. As a result, the System was at increased risk of submitting inaccurate, incomplete, or untimely FFATA reports. Recommendation - The System should implement controls regarding review of prepared FFATA submissions to ensure that all required subaward data is accurately and timely reported to SAM.gov. Views of Responsible Officials and Planned Corrective Actions - Management concurs with this recommendation. MetroHealth will establish and maintain a log documenting FFATA report submission, with internal reviews of disclosures prior to submission.

Information of the Federal Program: Assistance Listing Number 10.565—Commodity Supplemental Food Program, U.S. Department of Agriculture Pass-Through Entity and Award Number: Minnesota Department of Health, award number 204642. Compliance Requirement: Eligibility Type of Finding: Significant deficiency in internal control over compliance Criteria: 2 CFR 200.303 of Subpart D, "Post Federal Award Requirements Standards for Financial and Program Management," of the Uniform Guidance requires a recipient to establish, document and maintain effective internal control over the federal award that provides reasonable assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award, including eligibility. Condition: We requested eligibility forms for forty participants to review for the signature of site partner personnel indicating review of eligibility information on the form. One of the forty forms were unable to be located upon request. Eligibility information is input in ClientTrack software and the form should also be uploaded. Cause: Signed enrollment forms were not properly scanned into Sharepoint and had likely been disposed of. The signatures on these forms indicated the review by an agency partner that information included on the form is correct. Effect or Potential Effect: An ineligible individual could receive a CSFP box. Questioned Costs: None Context: Signed enrollment forms were not available for one of forty participants selected. Repeat Finding: yes, 2024-001 Recommendation: We recommend that Second Harvest Heartland digitalize their CSFP enrollment forms for convenient access and provide review of the electronically filed form prior to disposal of the paper form. Views of Responsible Officials: Agree.

Information on the Federal Program: Assistance Listing Number 10.565—Commodity Supplemental Food Program, U.S. Department of Agriculture Pass-Through Entities and Award Numbers: Minnesota Department of Health, award number 204642. Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs and Cost Principles Type of Finding: Significant deficiency in internal control over compliance Criteria: 2 CFR 200.303 of Subpart D, "Post Federal Award Requirements Standards for Financial and Program Management," of the Uniform Guidance requires a recipient to establish, document and maintain effective internal control over the federal award that provides reasonable assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award, including Activities Allowed or Unallowed and Allowable Costs and Cost Principles. Condition: Processes and procedures in place to review and submit administrative expenditures did not include a thorough enough review process to agree information to source data. Cause: Expenditures were reviewed before submission, however the review of this information was inadequate as it did not corroborate totals with the source data. Effect or Potential Effect: The Organization could have received reimbursement in excess of incurred expenses. Questioned Costs: None Context: One of the months selected for detail testing was found to have an erroneous submission using the wrong month’s expenditures. However, because the Organization incurred significantly more expenses than for which it was reimbursed during the year, the erroneously reported expenses had not been reimbursed by the funder. Repeat Finding: No Recommendation: We recommend that Second Harvest Heartland review the source data for all future expense reports. Views of Responsible Officials: Agree.

Department of Health and Human Services Temporary Assistance for Needy Families, Passed through Ramsey County, Federal Financial Assistance Listing 93.558, FAST X award 2201MNTANF for the year ending 12/31/2024 Activities Allowed or Unallowed and Allowable Costs/Cost Principles Significant Deficiency in Internal Control over Compliance Criteria: CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Goodwill-Easter Seals Minnesota’s internal control structure should be designed to properly follow the allocation policy for employees’ pay to each grant in accordance with the policy established by Goodwill-Easter Seals Minnesota. Condition: Goodwill-Easter Seals Minnesota has an internal control system designed to detect or prevent improper allocation of employees’ pay to grants in a timely manner in accordance with their established policy, however, during the year for one pay period tested, an error was identified in the process but was not fully corrected. Cause: Goodwill-Easter Seals Minnesota has a process for allocating employee wages based on hours worked. The controls in place did not operate as designed and failed to fully correct an error in the allocation of employee pay to the grant. Effect: One employee had some of their pay allocated improperly and not in accordance with the policy established. Questioned Costs: None reported. Context/Sampling: A nonstatistical sample of eight pay periods out of 26 were selected for testing which accounted for $383,866 of $2,284,613 of federal program expenditures. Repeat Finding from Prior Year: Yes Recommendation: We recommend that management develop a more extensive review over payroll allocation to ensure pay is properly allocated to each grant in accordance with the policy established by Goodwill-Easter Seals Minnesota. Views of Responsible Officials: Management agrees with this finding.

Department of Health and Human Services Temporary Assistance for Needy Families, Passed through Ramsey County, Federal Financial Assistance Listing 93.558, MFIP award 2201MNTANF for the year ending 12/31/2025 Activities Allowed or Unallowed and Allowable Costs/Cost Principles Significant Deficiency in Internal Control over Compliance Criteria: CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Goodwill-Easter Seals Minnesota’s internal control structure should be designed to properly follow the allocation policy for employees’ pay to each grant in accordance with the policy established by Goodwill-Easter Seals Minnesota. Condition: Goodwill-Easter Seals Minnesota has an internal control system designed to detect or prevent improper allocation of employees’ pay to grants in a timely manner in accordance with their established policy, however, during the year for five pay periods tested, Goodwill-Easter Seals Minnesota failed to identify that one employee’s timecard had incorrectly allocated time to a grant that ended. However, the time was corrected before submission to the grant, but it was not changed on the timecard. Cause: Goodwill-Easter Seals Minnesota has a process for approving timecards which include program codes for allocation to awards. The controls in place did not operate as designed and failed to fully correct an error in five timecards of an employee’s pay to the grant. Effect: One employee had the incorrect program code listed on the approved timecard for five pay periods tested. Questioned Costs: None reported. Context/Sampling: A nonstatistical sample of eight pay periods out of 26 were selected for testing which accounted for $383,866 of $2,284,613 of federal program expenditures. Repeat Finding from Prior Year: Yes Recommendation: We recommend that management develop a more extensive review over timecards to ensure pay is properly allocated to each grant in accordance with the policy established by Goodwill-Easter Seals Minnesota. Views of Responsible Officials: Management agrees with this finding.

Item 2025-001 Eligibility/Program Eligibility Federal Pell Grant Program ALN# 84.063 U.S. Department of Education Grant period – 2025-2026 Award Year Criteria – In accordance with 2 CFR 200.303(a), non-Federal entities must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should follow guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under 34 CFR Part 690 Pell grants are required to be calculated using a distinct set of criteria based on enrollment. Condition – 2 of 40 students tested received overpayments of Pell grants. Errors in clock-to-credit-hour conversions resulted in inaccurate enrollment intensities used in the Pell calculations for these students. Cause – The data file for the clock-to-credit hour conversion was not uploaded into the College's system prior to calculation of the students' enrollment intensity, and the results were not reviewed prior to packaging aid. Effect – Lack of controls resulted in an overpayment of Pell award to both students. The engagement team notes that for these exceptions, the College appropriately updated the file and corrected student aid. The engagement team further notes this only affected students in a current enrollment period in which all funds for the term had not been drawn from the Department of Education. Questioned Costs – The total of all overpayments was $7,821 amount was deemed not material to compliance. Recommendation – We recommend that adequate controls be put in place to review that files are updated by semester and that clock-to-credit hour conversions are reviewed prior to awarding of federal aid. Management’s Response – The College will strengthen the controls in place to ensure that all procedures have been followed prior to calculation and disbursement of financial aid.

Federal Agency: Department of Health and Human Services Federal Program Name: Special Programs for the Aging-Title III, Part C-Nutrition Services Assistance Listing Number: 93.045 Federal Award Identification Number and Year: 316-24-00C1-042, 316-24-00C2-043, 316-25-00C1-042, 316-25-00C2-043 and 316-25-00C3-042 Pass-Through Agency: MN River Agency on Aging Pass-Through Number(s): 316-24-00C1-042, 316-24-00C2-043, 316-25-00C1-042, 316-25-00C2-043 and 316-25-00C3-042 Award Period: January 1, 2024 – December 31, 2024 & January 1, 2025 – December 31, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance and Other Matters Criteria or specific requirement: 2 CFR 200.306 requires that any amounts used for required cost sharing must be verifiable in the subrecipient’s records and allowable under subpart E. 2 CFR 200.303 requires that non-Federal entities must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During our audit testing, we observed discrepancies between the hours reported by volunteers and the hours submitted for the grant at two sites. There were also 3 volunteer logs that could not be located related to two sites. Additionally, there was not documentation of the signoff on the volunteer logs by the site coordinator for two sites. Context: We reviewed 40 volunteer logs for reported hours. Differences in the hours reported were between 0.25 and 0.75 hours. Cause: In 2024, funding cuts led to temporary disruptions, resulting in staff reductions and affecting documentation practices in a particular timeframe. Regarding the hours reported that did not align with the volunteer log, the site coordinator believed the volunteer had underreported their hours and adjusted them accordingly, but there was not documentation of the change. Additionally, there was one instance where a data entry error contributed to the discrepancies. Effect: Hours reported for volunteer time could be incorrect. This grant requires a cost share of 15% be provided and the required cost share of 15% was exceeded so there was not an effect of meeting the required cost share. Repeat Finding: No Recommendation: We recommend additional training to ensure documentation is kept for the volunteer logs and the review. We also recommend documentation for any discrepancies between hours reported vs. the volunteer log. Views of responsible officials: There is no disagreement with the audit finding.

Assistance Listing Number, Federal Agency, and Program Name ALN 20.106, U.S. Department of Transportation Federal Aviation Administration (FAA), Airport Improvement Program (AIP) Federal Award Identification Number and Year 3 48 0064 161 2025 Pass through Entity N/A Finding Type Significant deficiency Repeat Finding No Criteria The Code of Federal Regulations, specifically 2 CFR 200.303, requires grant recipients establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition The controls in place to review the final grant packet, including the grant drawdown template and the drawdown invoice detail, prior to final processing of the drawdown were not operating as designed. Questioned Costs $21,452 If Questioned Costs Are Not Determinable, Description of Why Known Questioned Costs Were Undetermined or Otherwise Could Not Be Reported N/A Identification of How Questioned Costs Were Computed The questioned costs represent the total of all nonconforming costs reduced by the Airport's 25 percent match that were charged to the grant. Context Although the two invoice packets properly identified the $28,603 of non conforming costs out of $25,412,561 incurred, the grant drawdown template that was prepared did not exclude these ineligible costs and the review of the grant drawdown template did not identify the error prior to final processing of the drawdown. Cause and Effect The ineffective control to ensure accuracy of the grant drawdown template prior to final processing of the drawdown resulted in unallowable costs. Recommendation We recommend the Airport ensure internal controls are in place to ensure accurate information is included in the final processing of the drawdown. Views of Responsible Officials and Planned Corrective Actions Treasury will work with PMM and DCC departments to out line a process to ensure accurate reporting of eligible expenses when invoices are re viewed for compliance with grant program requirements. The process will be documented and adhered to once agreed by all departments. A review process for the final drawdown submission will also be adopted to ensure costs that are identified as ineligible are appropriately excluded from the final submission.

Assistance Listing Number, Federal Agency, and Program Name - 10.727, U.S. Department of Agriculture, Inflation Reduction Act Urban & Community Forestry Program Federal Award Identification Number and Year - 24 DG 11094200 194, 2024; 24 CA 11132544 013, 2024 Pass through Entity - U.S. Department of Agriculture (Direct Funded); GreenLatinos Finding Type - Material weakness Repeat Finding - No Criteria - Per 2 CFR 200.303, the recipient must establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should align with the guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States, or the Internal Control-Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition - Management did not have controls in place to ensure documentation evidencing the organization's verification that contractors are not suspended or debarred from participating in a federally funded activity was maintained. Questioned Costs - N/A If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported - N/A Identification of How Questioned Costs Were Computed - N/A Context - While gaining an understanding of Openlands' internal controls, we noted management was unable to provide documentation to support that checks for suspension and debarment occurred before the organization entered into a covered transaction. We were able to verify in our sample testing that management did not enter into contracts with individuals or organizations suspended or debarred from participating in federal programs. Cause and Effect - A lack of controls could result in material noncompliance with federal procurement standards. Recommendation - We recommend management retain documented evidence that checks for suspension and debarment that have occurred before entering into a covered transaction with outside contractors. Views of Responsible Officials and Corrective Action Plan - Management concurs with the finding. We acknowledge that, for the awards issued under the Inflation Reduction Act Urban and Community Forestry Program (Assistance Listing Number 10.727), the required suspension and debarment verification was performed; however, the supporting documentation evidencing this verification was not retained by the responsible department. This represents a documentation lapse rather than a deficiency in internal controls, as Openlands routinely performs suspension and debarment verifications for all applicable vendors, contractors, and subrecipients receiving federal funds in accordance with 2 CFR 200.214. This requirement applies to entities and individuals awarded federally funded contracts or subawards exceeding the micropurchase threshold and excludes routine commercial vendors for indirect administrative costs or purchases under $15,000. Management believes this was an isolated documentation lapse prior to the current audit period when the contractor was selected and is currently in the process of executing an update to internal control policies to ensure these checks are maintained prior to entering into a contract by the responsible department, as well as updating a clause to all standard vendor contracts requiring a self-certification that they are not excluded, debarred, or suspended from entering into covered transactions with the federal government.

2025 001 Activities Allowed or Unallowed and Allowable Costs/Cost Principles Beneficiary Payments U.S. Department of State: Bureau of Population and Refugees and Migration: U.S. Refugee Admissions Program: FY24 MRA Capacity Development Funds (ALN 19.510, award number SPRMCO23CA0361) FY2023 25 Year 3 Reception and Placement Program Affiliate MRA DA+Admin (ALN 19.510, award number SPRMCO24CA0356) FY2023 25 Year 3 Reception and Placement Program Affiliate ERMA DA+Admin (ALN 19.510, award number SPRMCO24CA0357) Statistically valid sample: No, and it was not intended to be. Repeat finding: Not a repeat finding. Finding Type: Significant Deficiency and noncompliance Criteria: 2 CFR section 200.303 requires that non federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non federal entity is managing the federal awards in compliance with federal statues, regulations, and the terms and conditions of federal awards. The specific requirements for activities allowed or unallowed are unique to each federal program and are found in the federal statutes, regulations, and the terms and conditions of the federal award pertaining to the program. 2 CFR Part 200 establishes cost principles for determining costs applicable to federal awards with nonprofit organizations. The Uniform Guidance (2 CFR 200.403) requires that costs charged to federal awards be necessary, reasonable, allocable, adequately documented, and in compliance with the terms and conditions of the federal award. Costs that do not provide a direct programmatic benefit, or where the benefit cannot be reasonably demonstrated or allocated, and are incurred outside the approved scope of the award are not allowable as direct charges. Condition and context: On February 13, 2025, IRC’s Ethics & Compliance Unit (ECU) received a whistleblower report alleging that an IRC Housing Coordinator located in an office in Northern California submitted unauthorized and fraudulent requests for funds, which were uploaded onto USIO bank debit cards, claiming they were expenses for newly resettled IRC clients, and instead using the funds for personal benefit. These USIO cards are intended to be used to cover expenses for newly arrived refugees during the initial 90 day period, including rent, food and other miscellaneous expenses. An internal investigation was initiated in February 2025 which found that the Housing Coordinator had loaded funds onto USIO bank debit cards between May 8, 2023 and February 11, 2025 which were for purposes other than refugees. The investigation concluded that there were unauthorized and fraudulent requests for funds in the amount of $215,639, plus the related indirect costs that were applied on these direct costs of $33,920, for a total of $249,559 related to federal funds expended in 2025 and charged to the grants identified in this finding. The total expenditures in this program included on the 2025 schedule of expenditures of federal awards amount to $42,671,438. This unauthorized and fraudulent requests for funds noted of $249,559 is not included in the total expenditures in this program on the 2025 schedule of expenditures of federal awards as the amounts were recoded to unrestricted funds. IRC communicated this matter to the federal agency in February 2025 when the investigation began and again in September 2025 when the investigation was completed. The expenditures were reallocated to IRC’s unrestricted funds so that the federal grants were not charged. Cause: The internal investigation completed by ECU concluded that the unauthorized and fraudulent requests for funds resulted from the Housing Coordinator’s ability to request the transactions and approve the transactions because he obtained his direct report’s general ledger log in credentials. Additionally, there were several control gaps in the Northern California office, including the following: • There was a lack of safekeeping of blank USIO Cards – this office was not following the established control to keep the blank cards in a locked safe. • USIO cards were not tracked or recorded properly – this office was not always following the established control to have the refugees sign a log book upon receipt of a USIO card. • A lack of oversight from the heads of programs and finance in this office regarding reconciliations between budgeted and actual amounts with irregular transactions being flagged (excessive housing expenses). Effect: The auditee charged certain costs directly to the program that did not meet the requirements noted above, and were therefore, not allowable. Questioned Costs: Questioned costs were $249,559, however, IRC reallocated these costs to IRC’s unrestricted funds, so that the grants were not charged. Recommendation: IRC should design and implement enhanced internal control procedures over the authorization and disbursement of funds to IRC refugee clients through USIO cards to ensure that funding provided is allowable. Additionally, IRC should provide training to employees about sharing their personal credentials to access IRC’s general ledger. Views of Responsible Officials: Management agrees with this finding, which was identified by IRC in February 2025 and raised to KPMG prior to the single audit. Corrective actions related to USIO portal access, office leadership and structure, training and policies, and spot checking have been implemented and will continue through June 2026.

2025 002 Reporting Federal Funding Accountability and Transparency Act U.S. Department of State: Bureau of Population and Refugees and Migration: Overseas Refugee Assistance Program for Middle East and North Africa: Provision of lifesaving protection & health response for Syrian refugees and vulnerable Lebanese (ALN 19.519, award number SPRMCO24CA0321) Overseas Refugee Assistance Program for South Asia: Comprehensive, Integrated Multi Sector Response for Rohingya Refugees and Host Communities in Cox’s Bazar (Y2) (ALN 19.523, award number SPRMCO24CA0239) U.S. Agency for International Development: USAID Foreign Assistance for Programs Oversees: Improved (Re)integration Services Activity (ALN 98.001, award number 72052224CA00004) Lifesaving Integrated Humanitarian Services in Underserved Areas of Sudan (ALN 98.001, award number 720BHA22GR00218) Statistically valid sample: No, and it was not intended to be. Repeat finding: Yes (2024 001). Finding Type: Significant deficiency and noncompliance Criteria: Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109 282), as amended by Section 6202 of Public Law 110 252, (Transparency Act) that are codified in 2 CFR Parts 25 and 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first tier subawards of $30,000 or more to System for Award Management (SAM.gov). Aspects of the Transparency Act that relate to subaward reporting (1) under grants and cooperative agreements were implemented in OMB in 2 CFR Part 170 and (2) under contracts, by the regulatory agencies responsible for the Federal Acquisition Regulation (FAR at 5 FR 39414 et seq., July 8, 2010). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first tier subawards and contractors (i.e., prime contractors) that award first tier subcontracts. Title 45 U.S. Code of Federal Regulations Part 75 (45 CFR 75), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards for HHS Awards, section 75.2 defines Subaward as an award provided by a pass through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass through entity considers a contract. Further, 45 CFR 75.2 defines Subrecipient as a non federal entity that receives a subaward from a passthrough entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Additionally, per 2 CFR 200.303, non federal entities must establish and maintain effective internal control over federal awards that provide reasonable assurance that the non federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The following subaward data elements to be reported include the following: • Subawardee Name • Subawardee Unique Entity Identifier • Amount of Subaward • Subaward Obligation/Action Date • Date of Report Submission • Subaward Number • Subaward Project Description • Subawardee Names and Compensation of Highly Compensated Officers, if applicable The information is required to be reported in SAM.gov no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made. Condition and context: For ALN 19.519, there were 3 new or amended subawardee agreements entered into during fiscal year 2025 that required FFATA reporting. We selected 2 of these agreements for test work and noted that while all the key data elements were accurately submitted, the information for both agreements was not submitted timely. Both of the agreements were entered into on September 30, 2024 and had a submission due date of October 31, 2024. SAM.gov notes the submission date for both agreements to be August 21, 2025. During our testwork over this program, we noted IRC did not establish control procedures to submit FFATA reports for all subawards on a timely basis. We noted the following exceptions:7 Transactions Tested: 2 Subaward not reported: 0 Report not timely: 2 Subaward amount incorrect: 0 Subaward incorrect key elements: 0 Dollar amount of tested transactions: $403,678 Subaward not reported: $0 Report not timely: $403,678 Subaward amount incorrect: $0 Subaward incorrect key elements: $0 For ALN 19.523, there were 4 new or amended subawardee agreements entered into during fiscal year 2025 that required FFATA reporting. We selected 2 of these agreements for test work and noted that while all the key data elements were accurately submitted, the information for both agreements was not submitted timely. Both of the agreements were entered into on September 1, 2024 and had a submission due date of October 31, 2024. SAM.gov notes the submission dates to be December 4, 2025 and December 8, 2025. During our testwork over this program, we noted IRC did not establish control procedures to submit FFATA reports for all subawards on a timely basis. We noted the following exceptions: Transactions Tested: 2 Subaward not reported: 0 Report not timely: 2 Subaward amount incorrect: 0 Subaward incorrect key elements: 0 Dollar amount of tested transactions: $759,550 Subaward not reported: $0 Report not timely: $759,550 Subaward amount incorrect: $0 Subaward incorrect key elements: $0 For ALN 98.001, there were 23 new or amended subawardee agreements entered into during fiscal year 2025 that required FFATA reporting. We selected 5 for test work and noted that while all the key data elements were accurately submitted, the information for 4 of these agreements was not submitted timely. Two of these agreements were entered into on November 1, 2024, one was entered into on November 22, 2024 and the last was entered into on December 1, 2024. The submission due dates for these agreements were December 31, 2024 and January 31, 2025. SAM.gov notes the submission dates for three of these agreements to be December 18, 2025, and for the one agreement entered into on November 22, 2024, the submission date was noted to be January 7, 2025. During our testwork over this program, we noted IRC did not establish control procedures to submit FFATA reports for all subawards on a timely basis. We noted the following exceptions: Transactions Tested: 5 Subaward not reported: 0 Report not timely: 4 Subaward amount incorrect: 0 Subaward incorrect key elements: 0 Dollar amount of tested transactions: $302,280 Subaward not reported: $0 Report not timely: $291,135 Subaward amount incorrect: $0 Subaward incorrect key elements: $0 Cause: Following the federal system migration, the USG FFATA reporting platform within SAM.GOV no longer displayed or made readily retrievable the submission date associated with individual FFATA. Effect: Delayed reporting can lead to reduced transparency, hindering public access to information about how federal funds are being used. Questioned Costs: None. Recommendation: IRC should continue to communicate to all field office personnel responsible for FFATA submissions the importance of timely reporting and maintaining appropriate documentation to evidence timely reporting. We recommend adding another level of review from headquarters to ensure reporting is taking place once a subawardee agreement is finalized and documenting that review in writing. Additionally, we recommend that IRC take screen shots during the submission process and maintain these with the subawardee agreements. This will evidence the submission in SAM.gov, specifically evidencing the submission date. Views of Responsible Officials: While Management maintains it acted in good faith to ensure all FFATA submissions are provided timely, the new FFATA reporting platform issues made it difficult for IRC to substantiate the dates of submission. IRC did contact FSD.gov to confirm what form of evidence would be considered sufficient in the absence of visible system date stamps. FSD.gov was unable to provide specific confirmation and instead directed IRC to published guidance https://www.fsd.gov/gsafsd_sp/en/under the federal funding accountability and transparency act how acknowledging existing “implementation challenges”. This guidance shifts the focus of compliance validation from system generated timestamps to whether the recipient acted in good faith to comply with reporting obligations. Relying on this, IRC’s internal control framework did not include a secondary documentation mechanism to independently evidence submission dates in the event that system functionality limited visibility. However, IRC remains committed to full FFATA compliance and will incorporate additional steps to strengthen the compliance documentation trail.

REFERENCE: 2025-101 CFDA NUMBER: 10.558 – CHILD AND ADULT CARE FOOD PROGRAM U.S. DEPARTMENT OF AGRICULTURE - FOOD AND NUTRITION - 2025 PASSED THROUGH ARIZONA STATE DEPARTMENT OF EDUCATION GRANT NUMBER 6AZ300003 QUESTIONED COSTS N/A CONDITION The following errors were noted during testing of FDCH Site Claims and 18 Day Care Home provider files for the months of May 2025 and September 2025: 1. For 1 of 18 provider files tested, menus were clerically inaccurate and did not support the meals claimed in September 2025. 2. For 1 of 18 provider files tested, meals were claimed for the incorrect meal type. Afternoon Snacks were claimed rather than Evening Snacks. This error occurred during September 2025. 3. For 1 of 18 provider files tested, meals were incorrectly disallowed when a credible meal component was provided. This error occurred in May 2025. 4. For 1 of 18 provider files tested, meals were claimed when a child was not in attendance. This error occurred in May 2025. 5. For 2 of 18 provider files tested, although 3 monitoring visits were completed, documentation was not available to demonstrate that 2 of the visits were unannounced. 6. For 2 of 18 provider files tested, the five-day reconciliation on a sponsor monitoring visit was not completed. For 1 provider's visit the reconciliation was only completed for 4 days, and for the other provider there was no indication of the number of children signed in for any of the 5 days tested. These errors resulted in the following revised meal counts: These variances resulted in an under payment (known questioned costs) of $100. However, after projecting the various types of errors over six meal categories for the entire year, likely under reported costs totaled $5,531. CRITERIA In accordance with the Arizona Department of Education, Day Care Home Compliance Manual, Revised June 2019, Chapter 10, Meal Requirements, Section 10.7 Other Meal Requirements, in order to claim a meal, the provider must abide by the following criteria: • The provider must serve a fully reimbursable meal that meets the meal pattern requirements and are supported by complete and up to date attendance, meal count, and menu records; • The child must be present and participate in the meal service; • All meal components must be served together; • The meal must be fully consumed on the premises in a congregate setting. Meals sent home with a child due to the parent picking up the child during meal service cannot be claimed; • Meal must be served during approved meal service time; • The provider can be reimbursed for a maximum of two meals and one snack or two snacks and one meal per child, per day; • Only children who are enrolled can be claimed and the number of children cannot exceed the allowable ratio; • Payment may be made for meals served to provider’s own child(ren) or foster children only when:  Their child(ren) are enrolled and participating in the child care program during the time of the meal service;  At least one enrolled, non-resident child is present and participating in the child care program;  The provider meets the family size income standards for free or reduced price meals; • Seconds may be served but are not reimbursable; and • If a school age child receives a breakfast, lunch or afterschool snack at school, a provider may not claim the same meal. In accordance with 7 CFR, Subtitle B, Chapter II, Subchapter A, Part 226, Subpart E Operational Provisions, §226.16 (d)(4)(ii) Reconciliation of meal counts. Reviews must examine the meal counts recorded by the facility for five consecutive days during the current and/or prior claiming period. For each day examined, reviewers must use enrollment and attendance records (except in those outside-school-hours care centers, at-risk afterschool care centers, and emergency shelters where enrollment records are not required) to determine the number of participants in care during each meal service and attempt to reconcile those numbers to the numbers of breakfasts, lunches, suppers, and/or snacks recorded in the facility's meal count for that day. Based on that comparison, reviewers must determine whether the meal counts were accurate. If there is a discrepancy between the number of participants enrolled or in attendance on the day of review and prior meal counting patterns, the reviewer must attempt to reconcile the difference and determine whether the establishment of an overclaim is necessary. In accordance with 7 CFR, Subtitle B, Chapter II, Subchapter A, Part 226, Subpart E Operational Provisions, §226.16 (d)(4)(iii), Frequency and type of required facility reviews. Sponsoring organizations must review each facility three times each year, except as described in paragraph (d)(4)(iv) of this section. In addition: (A) At least two of the three reviews must be unannounced; (B) At least one unannounced review must include observation of a meal service; (C) At least one review must be made during each new facility's first four weeks of Program operations; (D) Not more than six months may elapse between reviews; (E) The timing of unannounced reviews must be varied so that they are unpredictable to the facility; and (F) All types of meal service must be subject to review and sponsoring organizations must vary the meal service reviewed. In accordance with the Uniform Guidance, Compliance Supplement, Part 6 – Internal Control, 2 CFR section 200.303 requires that recipients and subrecipients receiving federal awards establish, document and maintain effective internal control over the federal awards that provides reasonable assurance that the recipient or subrecipient is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. EFFECT Program requirements were not complied with. Additionally, meal reimbursements were clerically inaccurate and the providers were incorrectly reimbursed. CAUSE Although the internal controls were adequately designed, there were deficiencies in the execution of the controls. Most menu errors occurred on paper menus, which have a higher risk of errors. RECOMMENDATION AND BENEFIT Menus should be reviewed to ensure all eligible meals are claimed, and provider meal count sheets should be reviewed for clerical accuracy and completion prior to the preparation of the reimbursement claim. Additionally, monitoring visits should be reviewed to ensure that all required information is properly included, including completion f the five day reconciliations and indication if the review is unannounced and . These reviews should be documented. This will help ensure that program requirements are complied with and only eligible meals served to eligible participants are claimed for reimbursement. VIEWS OF RESPONSIBLE OFFICIALS See Corrective Action Plan.

2025-001 Internal Control over Compliance and Compliance with the Reporting Compliance Requirement (Significant Deficiency) Information on the Federal Program: United States Agency for International Development Assistance Listing Number: 98.001 Assistance Listing Name: USAID Foreign Assistance for Programs Overseas Direct Award Numbers Award Period 720BHA23GR00031 February 1, 2023 through January 31, 2026 72068324GR00002 September 7, 2024 through December 31, 2024 Criteria or Specific Requirement: In accordance with §200.303(a), Internal Controls, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109-282), as amended by Section 6202 of Public Law 110-252, that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Subaward Reporting in SAM.gov. The prime awardee is required to file a FFATA sub-award report by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. Condition: We performed testing over CRS’s compliance with specific FFATA reporting requirements. Of the eight sub-award reports selected for testing, two of the reports with sub-award amounts totaling $313,190 were not submitted within the required timeframe. Specifically, the two FFATA reports were filed between 64 and 66 days later than the required filing date. Questioned Costs: There are no known or likely questioned costs. Context: This is a condition based on testing of CRS’s compliance with specified requirements. The samples were selected using a non-statistical sampling method. Cause: Although CRS has existing internal control policies and procedures ensuring appropriate filing of sub-award information in SAM.gov, the country offices failed to file the FFATA reports on time. Effect: Failure to report subrecipient information in a timely manner can result in lack of transparency and accountability, which is contrary to the intent of FFATA. Such non-compliance also increases the risk of loss of future awards if compliance with award terms is not met. Repeat Finding: No. Recommendation: We recommend that management ensure that all FFATA reports are filed in a timely manner. In addition, management should strengthen the existing internal controls and conduct refresher training to CRS country office personnel emphasizing timely submission of FFATA reports. Views of Responsible Officials: CRS management agrees with the finding and recommendations and will enhance the processes around timely submission of FFATA reports.

Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Head Start Federal Assistance Listing Number: 93.600 Award Period: June 1, 2024 to June 30, 2025, August 1, 2024 to July 31, 2025, July 1, 2025 to May 31, 2026, August 1, 2025 to July 31, 2026 Type of Finding:  Significant Deficiency in Internal Control over Major Federal Programs and Other Matters Criteria or Specific Requirement: The organization must train all governing body and policy council members within 180 days of the beginning of the term of a new governing body or council. Under 2 CFR section 200.303, a non-federal entity must establish and maintain effective internal controls over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing we noted one new board member did not have support verifying they received the appropriate training. This individual was a past employee who would have received the training while employed but no support was retained to support that the training was done. Questioned Costs: N/A Context: No documentation was retained to support that a new board member had proper training. Cause: Individual was a past employee who would have received the training while employed but not support was retained to support that the training was done. Effect: Potential for a board member to not have the proper knowledge and understanding of how to provide adequate oversight of the Head Start program. Repeat Finding: No Recommendation: Ensure support is retained to show all new board members received training within 180 days. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

Finding 2025-009 – Reporting (Material Weakness and Noncompliance)(Repeat Finding) Identification of the Federal Program: Community Development Block Grants, ALN 14.218, Department of Housing and Urban Development (CDBG) and Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Department of the Treasury (CRF). Criteria: 2 CFR 200.328-330 establish the requirements of nonfederal entities for financial and performance reporting that include timely and accurate reporting. 2 CFR 200.303 requires nonfederal entities to establish, document and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Typical control procedures for reporting include having a supervisor review the submitted report and ensuring the work is performed and documented in a way that confirms the accuracy and completeness of all data and information included. Condition: We selected five reports for the two grant programs to test for compliance and controls over reporting requirements. No documentation of review or approval of the reports was available. For CDBG, 2 quarterly cash reports and the FY24 Consolidated Annual Performance and Evaluation Report (CAPER) were tested, one cash report was late. Cause: The City did not retain documentation of a review and approval of federal reports submitted. Effect: The City did not have appropriate controls in place over documentation of reporting requirements. Questioned Costs: None reported. Recommendation: We recommend the City strengthen its policies and procedures over the grant reporting process to ensure controls are properly implemented and working effectively. Views of Responsible Officials: The City agrees with the finding. See Management’s View and Corrective Action Plan included at the end of the report.

ESTABLISH, DOCUMENT, AND MAINTAIN EFFECTIVE INTERNAL CONTROL OVER THE FEDERAL AWARD THAT PROVIDES REASONABLE ASSURANCE THAT THE RECIPIENT OR SUBRECIPIENT IS MANAGING THE FEDERAL AWARD IN COMPLIANCE WITH FEDERAL STATUTES, REGULATIONS, AND THE TERMS AND CONDITIONS OF THE FEDERAL AWARD. THESE INTERNAL CONTROLS SHOULD ALIGN WITH THE GUIDANCE IN “STANDARDS FOR INTERNAL CONTROL IN THE FEDERAL GOVERNMENT” ISSUED BY THE COMPTROLLER GENERAL OF THE UNITED STATES OR THE “INTERNAL CONTROL-INTEGRATED FRAMEWORK” ISSUED BY THE COMMITTEE OF SPONSORING ORGANIZATIONS OF THE TREADWAY COMMISSION (COSO), 2 CFR 200.303.

Condition: During our testing of controls over payroll, we identified three instances of payroll summary reports lacking an indication of review and approval. Criteria: The Uniform Guidance 2 CFR 200.303 requires auditees to establish and maintain effective internal control over federal awards that provides reasonable assurance that the awards are being managed in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The Organization should have a system of internal control in place to provide reasonable assurance that payroll summary reports are accurate and are being reviewed. Cause: The Organization has experienced significant turnover in HR positions and has had the Executive Director and Finance Manager take on these duties, along with their normal duties, until a replacement can be found. Effect: In the absence of review, payroll errors may go undetected, potentially resulting in inaccurate payroll records and payments. The possibility of fraud or noncompliance occurring and not being prevented or detected and corrected is present. Context: During our testing of a sample of six payroll summary reports, we noted an instance of a lack of review and approval. We then expanded the sample to 12 payroll summary reports, identifying one further instance of lack of review and approval, at which point the sample was again expanded to 24. A third instance was identified during the testing over the expanded sample, at which point testing ceased, and we determined that we could not rely on controls. The control deficiency did not result in a material impact on the program and did not reach the threshold for reporting questioned costs. Repeat of Prior Year Finding: No Auditor’s Recommendation: We recommend that payroll summary reports be reviewed and approved prior to completing the payroll process. If the Executive Director is unavailable, another staff member should review and approve the reports so the payroll process can be completed. View of Management: Management agrees with the finding. A response can be found in the Corrective Action Plan.

2025-001 – Internal Control over Compliance and Compliance with Reporting Information on the Major Federal Program: Federal Agency: Department of Interior Program Name: National Park Service Second Century Endowment and Appropriation Assistance Listing Number: 15.U01 Award Number: H.R. 4680/P.L. 114-289 Award Period: October 1, 2024 to September 30, 2025 Criteria – The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with the requirements 2 CFR §1402.300(b), a non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of the Federal Funding and Accountability Act (FFATA), which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR part 25, Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR part 170, Reporting Subaward and Executive Compensation Information. In accordance with 2 CFR Part 170, Appendix A, under FFATA, the Foundation is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System. Condition – During our testing of reporting, we selected five subrecipient awards. For all samples tested, the Foundation did not comply with the mandatory FFATA report filing requirements. Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 5 5 5 Not applicable – no report was submitted Not applicable – no report was submitted Dollar Amount of Tested 2025 Subawards Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $ 319,000 $ 319,000 $ 319,000 Not applicable – no report was submitted Not applicable – no report was submitted Cause - The Foundation did not have adequate policies and procedures in place to ensure compliance with the FFATA filing requirements. Effect or Potential Effect - Failure to comply with the reporting requirements of the Uniform Guidance could result in noncompliance and awarding agency taking administrative action. Questioned Costs – None. Context - This is a condition identified based upon our review of the Foundation’s compliance with specified requirements. The sample was selected based on a non-statistical basis. The prevalence of these finding is detailed in the condition section above. Repeat Finding – This is a repeat finding from prior year. This was reported as finding 2024-001 in the 2024 report. Recommendation – BDO noted management’s actions to continuously work with federal grantor/agencies to address the prior year finding. However, the Foundation’s grant agreement does not have a Federal Award Identification Number (FAIN) which is a requirement to comply with FFATA reporting, therefore management is still unable to file the required FFATA reporting. BDO recommends that the Foundation continue to work with federal grantor/agencies to determine the required information and immediately comply with the FFATA requirements. Views of Responsible Officials – The Foundation’s management has been given a legal opinion from counsel that the Appropriation and the Endowment are exempt from the Uniform Guidance and the Single Audit. As such, will continue to work with Department of Interior to remedy this situation. The planned corrective actions are presented in the Foundation’s management’s corrective action plan attached as Appendix C.

Department of Housing and Urban Development - Direct Project - Community Development Block Grant- ALN 14.218- Program Year 2025 (B-20-UC-11-0018 FY 2021, B-20-UW-12-0018 FY 2020, B-22-UC-12-0018 FY 2022, B23-UC-12-0018 FY 2023, B-24-UC-12-0018 FY 2024, FR-6512-N-01 FY 2024) Criteria — 2 CFR section 200.303 – Internal Controls of the Uniform Guidance states that the non‐federal entity must: (a) Establish and maintain effective internal controls over Federal award that provides reasonable assurance that the non‐Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition — There was no evidence of the controls in place to review and approve reports prior to submission. The lack of internal control is a systemic issue over reporting. Cause/Effect—There is no evidence of the internal control requiring review and approval prior to submission of the cash on hand quarterly report and the FFATA reports prior to submission. If the internal controls are not in place the reports might not be accurately and timely filed, which could cause a delay in payment or loss of funding. Questioned Costs– None noted. Reported finding is for noncompliance in the reporting compliance requirement that does not affect the amount expended or received from the Federal award. Auditor’s Recommendation – Develop an internal control process with evidence of a review of reports prior to submission. CRI also recommends that the County develop a process to track all grant reports required by ALN#/CSFA# and by contract. This system would provide a repository of all the required reporting which the county could use to verify reports are filed timely and accurately. Management Response – See Corrective Action Plan Letter.

Interest Earned on Federal Funds. Criteria: 2 CFR 200.303 provides that non-federal entities must establish and maintain effective internal controls to provide reasonable assurance of compliance with Uniform Guidance. 2 CFR Section 200.305 sets forth the requirements for the return of interest earned on federal funds. Recipients of federal grants are required to establish internal controls to minimize the time that elapses between the receipt of federal funds from the grantor, and the payment of those funds to vendors who provide goods or services. Interest earnings that exceed $500 per year from excess cash balances must be paid to the federal grantor. Condition: CASIS did not calculate interest earnings on the federal cash balance to determine if any earnings should be repaid to the grantor. Cause: CASIS does not have a policy to monitor federal cash balances for cash management requirements, including the calculation of interest earnings. Effect: CASIS did not take steps to reduce the time elapsing from the date it received federal funds to the date it spent the funds on program costs. The lapse resulted in interest earned on federal funds. Questioned Costs: Fontana calculated that CASIS earned approximately $17,000 of interest on the federal funds balance for the fiscal year ended September 30, 2025. Interest earnings on federal funds of more than $500 must be returned to the grantor. Perspective: Interest was not calculated or returned to the grantor for fiscal year ended September 30, 2025. Recommendation: Fontana recommends that CASIS: o Implement controls to minimize the time between receipt of funds from the granting agency and disbursement of those funds. o Compute interest earned on advance funds and remit amounts in excess of $500 to the grantor when required.

Finding 2025-001: Significant Deficiency in Internal Control Over Compliance and Non-Material Non-Compliance Federal Awarding Agency: U.S. Department of Housing and Urban Development (HUD) Department: Department of Housing and Community Development (DHCD) Program name: Housing Voucher Cluster ALN: 14.879 Compliance Requirement: Special Test-Housing Quality Standards (HQS) Inspection and Enforcement Prior Year Finding Number: N/A Criteria or Specific Requirements: Per 24 CFR 982.404 “The public housing Organization (PHA) must not make any housing assistance payments (HAP) for a dwelling unit that fails to meet the HQS, unless the owner corrects the defect within the period specified by the PHA and the PHA verifies the correction. If a defect is life threatening, the owner must correct the defect within no more than 24 hours. For other defects, the owner must correct the defect within no more than 30 calendar days (or any PHA-approved extension)”. Additionally, per 24 CFR 982.405 “The PHA must inspect the unit at least biennially during assisted occupancy to ensure that the unit continues to meet the HQS”. Per 2 CFR section 200.303, non-Federal entities receiving Federal awards must establish and maintain internal control designed to ensure reasonably compliance with Federal statutes, regulations, and terms and conditions of the Federal award. Condition: During our testing of sixty (60) inspections, we noted the following: - One instance where a unit failed its inspection and re-inspection was not performed or scheduled within the required timeframe. The Organization also failed to abate the housing assist payments (HAP) or terminate the HAP contract for this unit in a timely manner. Additionally, for this unit the inspection was not performed on the required biennial basis. Questioned Costs: We identified $984 in known and $54,962 in likely questioned costs as a result of our sampling and testing procedures. Cause: The Organization did not follow the internal controls, policies and procedures in place to ensure inspections and re-inspections of units are performed on a timely basis. Context: This is a condition based on testing of the Organization’s compliance with specified requirements. The prevalence of the finding is detailed in the Condition section above. The samples were selected using a nonstatistical method. Effect: The Organization’s control environment over HQS enforcements did not ensure that re-inspections were performed timely or documented within the system or that HAP abatements occurred in a timely manner. As a result, the Organization was not in compliance with the HQS enforcement requirements as of September 30, 2025. Non-compliance with these requirements creates a risk that the Organization may provide federal funds to tenants of ineligible units. Recommendation: We recommend the Organization review their system functionality to determine whether an electronic process for scheduling and follow-up or comprehensive reporting can be identified to improve efficiency and eliminate the potential for human error. If an electronic process or comprehensive reporting is not available, or cannot fully cover the deficiency, we recommend the Organization look into measures to streamline their current internal controls, policies and procedures to eliminate non-compliance. Potential examples include adding an inspection checklist, having the inspection supervisor review and schedule upcoming inspections in advance, building room into the schedule for life-threatening re-inspections, having the inspection supervisor ensure that each scheduled inspection is timely documented in the system, etc. Repeat Finding: No Views of responsible officials: Organization management agrees with the finding and recommendations set forth within. Refer to management’s corrective action plan for additional information.

2025-004 Suspension and Debarment 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds US Department of Treasury Passed through Florida Department of Environmental Protection 2024 Funding Criteria: 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal controls. Documentation of the check for suspension or debarment needs to be retained. Condition: Review of checking for suspension and debarment was not done prior to contracting with the vendor. Cause of condition: The City did not consistently complete reviews for all vendors to ensure that the vendors were not suspended and debarred before projects had. Perspective (context): For 5 of the 8 vendors selected, suspension and debarment was not checked prior to paying the vendor. The sample was not statistically valid. Potential effect of condition: Good or services could be contracted with a suspended or debarred vendor, creating questioned costs. Questioned Costs: None noted. Reported finding is a deficiency in internal control. Recommendation: The City should require all vendors to provide certification of their status before a contract or purchase order is completed with the vendor and the City should obtain new certificates annually to ensure the vendors status has not changed. Management’s response on planned corrective action: Management agrees with the recommendation. The City has implemented procedures requiring all departments to obtain vendor certification of status prior to executing a contract or issuing a purchase order. Over the past year, we have worked diligently to educate departments on the importance of obtaining and maintaining proper vendor certifications to ensure compliance with applicable requirements. We will continue to reinforce this expectation and monitor compliance, including obtaining updated certifications annually to ensure vendor status has not changed.

2025-005 Lack of Report Review 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds US Department of Treasury 2021 Funding Criteria: 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal controls. Reports should be subject to independent review to verify completeness, validity and timeliness of submission. Condition: There was no documented review by the City Manager of the annual report submitted to the Us Treasury department prior to submittal. Cause of condition: The annual report to the US Treasury was not reviewed prior to submittal. Perspective (context): The one annual report was not reviewed. Potential effect of condition: Review could contain errors, could be submitted incomplete or late. Questioned Costs: None noted. Reported finding is a deficiency in internal control. Recommendation: The City should have controls in place to ensure all reports are reviewed prior to submittal. Management’s response on planned corrective action: Management agrees that reports should be reviewed prior to submission and notes that the City does have controls in place to ensure appropriate review procedures are performed. In this instance, the report was prepared and submitted by the City Manager, and due to limitations within the Federal Government’s online reporting system, there was not a built-in approval workflow available to document the review process.

Finding: 2025-001. Insufficient Controls Over Monitoring Federal Expenditures and SEFA Preparation Federal Agency: Federal Highway Administration Pass-through Agency: Texas Department of Transportation Assistance Listing Number: 20.205 Federal Program Name: Highway Planning and Construction Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: 2 CFR §200.303 requires entities to establish and maintain effective internal control over Federal awards that provides reasonable assurance the entity is managing the awards in compliance with Federal statutes, regulations, and the terms and conditions of the awards. 2 CFR §200.501 requires a Single Audit when a non-Federal entity expends $1,000,000 or more in Federal awards during the current fiscal year (or $750,000 during the prior year). 2 CFR §200.510(b) requires the preparation of a complete and accurate Schedule of Expenditures of Federal Awards (SEFA). Applicable GAAP requires recognition of grant revenue and related receivables when allowable expenditures are incurred. Condition: The City incurred reimbursable federal expenditures in the prior year but did not submit reimbursement requests or record the related receivable and revenue. As a result, certain federal expenditures were omitted from the SEFA, and total federal expenditures were understated below the $750,000 threshold for a Single Audit in the prior year. Cause: Grant administration is decentralized across multiple departments, and formal controls were not in place to reconcile grant expenditures to reimbursement requests or to monitor total federal expenditures and review the SEFA for completeness. Effect: Grant revenue and related receivables were understated, and the prior year SEFA was incomplete. As a result, the City did not include this grant award in the Single Audit in the prior year as required by Uniform Guidance. Questioned costs: N/A Context: N/A Repeat finding reference: N/A Recommendation: The City should strengthen oversight of federal grant activity by implementing procedures to monitor federal expenditures and ensure the SEFA is complete and accurate. This may include centralizing grant oversight within the finance function or designating a responsible grant administrator. Procedures should include periodic reconciliations of grant expenditures to reimbursement requests and a formal year-end review of total federal expenditures and the SEFA, with coordination between the finance function and departments administering federal programs. Personnel involved in grant administration should receive training on Uniform Guidance requirements. View of Responsible Officials Management’s response and corrective action plan are included in the accompanying corrective action plan.

Reviews of Grant Reports U.S. Department of Treasury ALN 21.027 - COVID 19 Coronavirus State and Local Fiscal Recovery Funds Contract No. Y5177 2021 Funding Criteria: 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal controls. Reports should be subject to independent review to verify completeness, validity and timeliness of submission. Condition: There was no documented review by an independent individual for the reports submitted to the US Treasury department prior to submittal. Cause: The City did not have a process in place to document the review of reports to the US Treasury was prior to submittal. Effect: Reports submitted to the Florida Department of State may be incomplete, include errors, or be submitted late. Perspective: There was no evidence of review provided for the reports submitted during Fiscal Year 2025. Questioned Costs: None, reported finding is a deficiency in internal control. Recommendation: The City should have controls in place to ensure all reports are reviewed prior to submittal and the review is documented. Management Response: Management agrees with the finding. Management will implement procedures to document independent review of all reports submitted to the U.S. Treasury to ensure completeness, accuracy, and timeliness.

2025-002 DISALLOWED COSTS ALN 97.083 Staffing for Adequate Fire and Emergency Response (SAFER) Grant Program U.S. Department of Homeland Security Federal Emergency Management Agency (FEMA) Federal Award No. EMW-2022-FF-00868 2024/2025 Funding Criteria: 2 CFR 200.303(a) requires non-federal entities to establish and maintain effective internal controls over federal awards. The award terms allow for reimbursement of personnel costs including wages, the employer portion of payroll taxes, and fringe benefits (health insurance, life insurance, and retirement benefits. Compensation for a firefighter’s normal, contracted work schedule is reimbursable, but overtime costs are not eligible for reimbursement by the SAFER grant award (including overtime for holdovers, extra shifts, to attend training, etc.). Only costs for overtime that the fire department routinely pays as a part of the base salary or a firefighter’s regularly scheduled and contracted shift hours, in order to comply with the Fair Labor Standards Act (FLSA), are eligible. Semi-annual financial reporting is required of all grant award recipients (per the award agreement terms). Condition: There was no independent review of reimbursement requests or semi-annual financial reports prior to submission to the grantor. Reimbursement requests included disallowed costs related to overtime (associated fringe benefits expense) but not the overtime itself. Additionally, semi-annual financial reports were based on reimbursement requests which resulted in reporting errors. Cause: There was no independent review of reimbursement requests or semi-annual financial reports prior to submission to the grantor. Effect: Lack of review increases the likelihood that reports are incomplete, inaccurate, or not submitted timely. Reimbursement requests and financial reports included errors and the City was inadvertently reimbursed for disallowable costs Questioned Costs: Known questioned costs are $10,551. Questioned costs computed through recalculation of fiscal year 2025 reimbursement requests. Perspective: Disallowed costs impacted all fiscal year 2025 reimbursement requests and semi-annual financial reports. Recommendation: Independent review of program reimbursement requests and reports should be consistently performed and documented prior to submission the grantor. Management Response: The City agrees with this finding and will establish internal procedures for review of program reimbursement requests before submission to the grantor. The Grant Compliance Manager will prepare the reimbursement requests and semi-annual reports and provide to the Director of Finance for review and approval prior to submission. This corrective action will take effect immediately.

2025-001 REPORTING ALN 20.106 Airport Improvement Program U.S. Department of Transportation Federal Aviation Administration Federal Award No. 3-12-0046-064-2024 2024/2025 Funding Criteria: 2 CFR 200.303(a) requires non-federal entities to establish and maintain effective internal controls over federal awards. The award terms require submission of quarterly construction and inspection reports within 30 days of the end of each Federal fiscal quarter. Condition: A quarterly report was not submitted for the period January 2025 – March 2025. Cause: The staff member who typically prepared the report was out on medical leave during this period. Effect: The Airport, a component unit of the City, was out of compliance with award requirements which could jeopardize its ability to be reimbursed for this award or obtain additional awards in the future. Questioned Costs: None. Reported finding is for noncompliance in the reporting compliance requirement that does not affect the amount expended or received for the federal award. Perspective: All other quarterly reports sampled were appropriately submitted timely. When we brought this issue to the attention of management they submitted the quarterly report late. Recommendation: The Airport, a component unit of the City, should develop a process to ensure reports are submitted timely for all awards including re-assigning tasks when personnel are on leave. Management Response: Airport management has set up a process whereby the quarterly reports are reviewed by another team member to ensure the reports are completed and submitted in the time frame required by the Federal Aviation Administration. This review will be completed by the Accounting Manager who understands the importance of submitting the information and, if they are not completed, will complete and submit the reports. Any issues or omissions observed by the Accounting Manager with submitting the required reports will be reported to the Director of Finance and Administration for further follow-up with the staff member who is primarily responsible for this task.

2025-001 Compliance and Internal Controls over Reporting (Significant Deficiency) Assistance Listing Number 17.259 – Workplace Innovation and Opportunity Act Cluster / WIOA Youth Activities 2024-2025 Funding U.S. Department of Labor Passed through Texas Workforce Commission / Houston Galveston Area Council Contract No. 206-25 Criteria: Under 2 CFR Section 200.303(a), the recipient and subrecipient must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, per the Subrecipient Contract Scope of Work 13.1, a monthly report to the Board and H-GAC contract liaison is due by the 10th of each month. Monthly reports are required to be submitted to the grantor to properly track grant progress, which allows the grantor to determine if further action is needed to fulfill the purpose of the grant. Condition: Monthly reports for October 2024, December 2024 and May 2025 were not submitted timely. SER-Jobs’ established controls over the reporting process did not work effectively to detect and/or correct non-compliance over the reporting process. Cause: Monthly reports were submitted late due to delays in accounting period close, which delayed the submission process to include the financial information in the required reports. Effect: Failure to submit the required reports as stipulated in the scope of work by the grantor may constitute a breach of contract and potential loss of funding. Questioned Costs: None. Perspective: 3 out of the 4 reports selected for our testing were not submitted timely. Repeat Finding: No Recommendation: Ser-Jobs should establish procedures to ensure that controls related to reporting are consistently implemented which should include prompt completion of the accounting period close to allow for timely submissions. Views of Responsible Officials: We concur with the recommendation, please see Corrective Action Plan.

2025-001: Accounting Records and Documentation (Significant Deficiency) Federal Program: Child Nutrition Cluster – School Breakfast Program (AL No. 10.553) and National School Lunch Program (AL No. 10.555) Condition: During our audit of compliance with federal program requirements, we noted that the District did not consistently maintain accounting records and supporting documentation for Child Nutrition Program reimbursement transactions in a manner that ensured timely accessibility for audit testing. Certain reimbursement requests and related supporting documentation were not readily available during audit fieldwork. As a result, we were required to perform expanded audit procedures, including additional reconciliations and alternative testing, to obtain sufficient appropriate audit evidence supporting the reported reimbursement amounts. Criteria: Uniform Guidance (2 CFR §200.302 and §200.303) requires nonfederal entities to maintain accurate, complete, and adequately supported financial records and to establish effective internal controls to ensure compliance with federal program requirements. Cause: The deficiency appears to be attributable to weaknesses in the District’s documentation retention, organization, and supervisory review procedures related to Child Nutrition reimbursement reporting. Effect: Although documentation was not fully sufficient at the outset of audit testing, expanded audit procedures allowed us to obtain reliable support for the reimbursement amounts tested. No questioned costs or audit differences were identified as a result of this condition. Testing of reimbursement activity disclosed no variances between amounts reported and amounts received, based on a tested population totaling $793,987.13. Recommendation: We recommend that the District strengthen its internal controls over the preparation, review, organization, and retention of Child Nutrition Program reimbursement documentation to ensure that complete and accurate supporting records are maintained and readily available for audit and monitoring purposes. Views of Responsible Officials: The District’s management concurs with the finding and plans to implement procedures to improve the completeness and accessibility of accounting records and supporting documentation related to federal program reimbursements.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Suspension and Debarment, Reporting, Special Tests and Provisions – Information Technology – User Access Federal Agency: U.S. Department of Agriculture (USDA) Federal Program Title: Food Distribution Cluster Texas 1944 Water Treaty Grant ALN: 10.565, 10.568, 10.560 10.126 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Food Distribution Cluster 246TX816Y8105, 256TX816Y7105, 246TX818Y8613, 238TX000I1003, 246TX816Q2204 October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025, November 3, 2023 - November 2, 2024, May 23, 2023 - June 30, 2025, October 1, 2023 - September 30, 2024 Texas 1944 Water Treaty Grant FSA25GRA0012028 March 19, 2025 - March 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Department of Agriculture (TDA) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of user termination controls, we identified two instances, out of a sample of 14 terminated users, in which access was not removed within the timeframe required by TDA’s System Administrator separation process (i.e., application access removed on the date of the ticket/same day of termination and network access within one business day): Application (TX‑UNPS): User A was terminated on 06/13/2025. Network access was removed on 06/16/2025 (within one business day), but TX‑UNPS application access remained active until 06/19/2025 (removed after four business days), which does not meet the same‑day requirement for application access. Network: User B was terminated on 09/13/2024. Network access was removed on 09/17/2024 (removed after one business day due to weekend/holiday schedule), which does not meet the requirement for removal within one business day. Questioned costs: None. Context: See “Condition.” Cause: The delays appear to be the result of breakdowns in the coordination between HR separation processes and IT access revocation procedures, including delays in communication or gaps in the automated termination workflow. Effect: Failure to remove user access promptly increases the risk of: • Unauthorized access to confidential or sensitive information; • Potential manipulation, loss, or misuse of program data; • Increased exposure to operational and security risks. Although no misuse of access was identified, the presence of active credentials after termination represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend that TDA: • Strengthen coordination between HR and IT functions to ensure immediate notification upon employee separation. • Implement automated workflows that disable all user access promptly upon termination. • Conduct periodic reconciliations of HR separation lists against active user accounts to detect and remove any lingering access. • Enhance monitoring controls, including reporting dashboards or alerts triggered when access is not removed within a defined timeframe. Views of responsible officials: TDA agrees with the finding. TDA acknowledges that improvements can be made to the separation process.

Cash Management, Eligibility, Matching and Earmarking, Period of Performance, Suspension and Debarment, Reporting, Subrecipient Monitoring, Special Tests and Provisions – Information Technology – Change Management Federal Agency: U.S. Department of Justice Federal Program Title: Crime Victim Assistance ALN: 16.575 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 15POVC-25-GG-00366-ASSI, 15POVC-24-GG-00728-ASSI, 15POVC-23-GG- 00468-ASSI, 15POVC-22-GG-00468-ASSI, 2020-V2-GX-0040 October 1, 2024 – September 30, 2028, October 1, 2023 – September 30, 2027, October 1, 2022 – September 30, 2026, October 1, 2021 – September 30, 2025, October 1, 2020 – September 30, 2025, October 1, 2019 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Office of the Governor must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During our review of information technology general controls related to network change management, we noted that the organization does not have a formal, documented change control process governing changes and approvals to the network hardware components and systems. As a result, network changes may not be consistently documented, reviewed, or formally approved. For purposes of this control, network changes include any additions, modifications, or removals affecting the network infrastructure, including but not limited to: • Network hardware (e.g., routers, switches, firewalls, wireless devices) • Network device configurations • Network related software, firmware, or operating system components Questioned costs: None. Context: See “Condition.” Cause: Management is aware of this matter and a draft policy initiative is already underway and targeted for completion during fiscal year 2026. Effect: In the absence of a formal documented change management process, there is an increased risk that unauthorized or untested network changes could adversely impact the confidentiality, integrity, or availability of systems and data. Repeat Finding: No Recommendation: We recommend that management finalize and implement the formal, documented network change management process to ensure all changes to network hardware, configurations, and related software are properly requested, reviewed, approved, tested, and documented. Views of responsible officials: A formal but not documented process has been utilized which requires CIO approval of all changes. A Project was instigated in 2024 to formalize and embed the verbal process into a written process with auditable execution logs. The project is in its final stages

Reporting – Financial, Performance and Special Reporting Federal Agency: U.S. Department of Labor (DOL) Federal Program Title: Unemployment Insurance (UI) ALN: 17.225 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: UI372522255A48, UI380082260A48, UI382492255A48, 23A03UI0389351, 23A60UR000007, 23A60UB000060, 24A55UI000051, 24A55UT000017, 24A60UR000091, 24A60UD000038, 25A55UE000005, 25A60UB000137, 25A60UB000149, 25A60UB000176, 25A60UB000187, 25A60UD000047, 25A55UI000094, 25A55UT000066, 25A60UR000102 October 1, 2021 – December 31, 2024, January 1, 2022 – September 30, 2024, January 1, 2022 – March 31, 2025, October 1, 2022 – December 31, 2025, January 1, 2023 – September 30, 2025, April 1, 2023 – May 22, 2025, October 1, 2023 – December 31, 2026, October 1, 2023 – September 30, 2024, January 1, 2024 – September 30, 2026, May 17, 2024 – May 17, 2027, July 1, 2024 – December 31, 2025, July 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2025, July 9, 2024 – July 9, 2027, October 1, 2024 – December 31, 2027, October 1, 2024 – September 30, 2025, January 1, 2025 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: "Per 2 CFR §200.303(a), Texas Workforce Commission (TWC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of financial, performance, and special reporting, we identified gaps in TWC’s documentation and oversight of its reporting processes. Specifically, for the ETA 2112 – UI Financial Transaction Summary, we tested three monthly reports, and none contained evidence of review or approval prior to submission. Similarly, for the ETA 9050 – Time Lapse of All First Payments Except Workshare and the ETA 9052 – Nonmonetary Determination Time Lapse Detection performance reports, we tested three monthly submissions for each report type, and all lacked documentation demonstrating that a formal accuracy and completeness review was performed. In addition, our testing of two quarterly ETA 2208A – Quarterly UI Above-Base Reports identified a lack of segregation of duties. For both reports tested, the individual responsible for preparing the report also performed the review function. Questioned costs: None. Context: See “Condition.” Cause: The absence of documented reviews and approvals appears to result from insufficient internal controls over the reporting process, including unclear staff responsibilities. These control gaps contributed to inconsistent application of review procedures and allowed instances where documentation of required oversight did not occur or was performed by the same individual responsible for report preparation. Repeat Finding: No Recommendation: TWC should strengthen internal controls over the reporting process by establishing clear roles and responsibilities for the preparation, review, and approval of all required ETA reports. Management should ensure that each report undergoes a documented, independent review to verify accuracy and completeness before submission. Additionally, TWC should provide targeted training to staff on reporting requirements and internal control expectations to reinforce consistent application of review procedures and prevent situations where the preparer and reviewer are the same individual. Views of responsible officials: Management agrees on the importance of the ETA reports and the accuracy of the information in the reports.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Reporting – Information Technology – User Access Federal Agency: U.S. Department of Veterans Affairs Federal Program Title: Veteran's State Nursing Home Care ALN: 64.015 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: N/A Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), The General Land Office (GLO) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During our assessment of access controls, we noted that while GLO performs user access reviews for accounts with privileged (elevated) access to the network. No periodic user access review is performed for all network users (non‑privileged/general users) within the audit period. As a result, there is no documented verification that standard user accounts retain only appropriate, job‑related access. Questioned costs: None. Context: See “Condition.” Cause: The condition appears to result from policy and process gaps that focus review efforts primarily on privileged accounts, coupled with the absence of a formalized, agency‑wide schedule and procedure for reviewing all network users’ access and retaining evidence of those reviews. Effect: Failure to conduct and document periodic access reviews for all network users increases the risk that: • Excessive or outdated access persists undetected; • Unauthorized access to systems or data may occur; • Potential security, operational, and compliance exposures are elevated. No instances of misuse were identified during our procedures; however, the lack of comprehensive reviews represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend that GLO: • Establish a formal, documented access review program that covers all network users (privileged and non‑privileged) on at least an annual cadence. • Implement standardized templates and a central repository to capture review date, reviewer, population, exceptions identified, and remediation actions taken. • Periodically monitor adherence to the review schedule and report completion status and exceptions to management governance (e.g., IT leadership or an information security committee). Views of responsible officials: Management of the Texas General Land Office (GLO), Information Technology Services (ITS) Department, concurs with the audit finding and agrees that formalizing and documenting a periodic user access review process for all non-privileged network users will further strengthen the agency’s internal control framework and cybersecurity posture in alignment with 2 CFR §200.303 and applicable federal internal control standards.

Procurement and Suspension and Debarment Federal Agency: U.S. Environmental Protection Agency Federal Program Title: Drinking Water State Revolving Fund (DWSRF) ALN: 66.468 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2521902915 September 1, 2024 - August 31, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: "Per 2 CFR §200.303(a), Texas Commission on Environmental Quality (TCEQ) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR §200.318, the recipient or subrecipient must maintain and use documented procedures for procurement transactions under a federal award or subaward, including for acquisition of property or services. These documented procurement procedures must be consistent with State, local, and tribal laws and regulations and the standards identified in §§ 200.317 through 200.327. Per 2 CFR §200.214, recipients and subrecipients are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, as well as 2 CFR part 180. The regulations in 2 CFR part 180 restrict making Federal awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from receiving or participating in Federal awards. Condition: Audit procedures included a review of five procurements conducted during the fiscal year to assess whether TCEQ adhered to required procurement procedures and performed vendor eligibility verifications prior to entering into covered transactions. For one procurement, totaling $16,175, the required procurement processes were not followed, and the necessary vendor compliance checks, including verification of suspension and debarment status, were not completed before executing the transaction. Questioned costs: None. Context: See “Condition.” Cause: The procurement was initiated directly by the program area without notifying or coordinating with the Procurement and Contracts Section. Program staff proceeded with the purchase under the assumption that procurement involvement was unnecessary because the selected vendor was the sole provider of the required item. As a result, established procurement procedures and vendor compliance verification processes were not followed. Effect: Failure to follow procurement procedures and complete proper vendor compliance checks prior to entering into a covered transaction may lead to entering contracts with suspended or debarred vendors that could result in noncompliance and questioned costs. Repeat Finding: No Recommendation: TCEQ should provide targeted training to program staff on federal procurement requirements, including the necessity of coordinating all purchases through the P&C Section and completing required vendor compliance checks. Training should emphasize procedures for sole‑source or limited‑source procurements and reinforce staff responsibilities under 2 CFR procurement and internal control standards. Regular refresher sessions and documented guidance will help ensure consistent understanding and adherence to required procurement practices across all program areas. Views of responsible officials: The Financial Administration Division (FAD) will implement the audit’s recommendations. FAD will reinforce the guidance provided through continuous training, documentation, and improved internal controls.

Cash Management, Eligibility, Level of Effort, Earmarking, Period of Performance, Subrecipient Monitoring – Information Technology – User Access Federal Agency: U.S. Department of Education (USDE) Federal Program Title: Career and Technical Education - Basic Grants to States ALN: 84.048 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: V048A220043, V048A230043, V048A240043 July 1, 2022 - September 30, 2023, July 1, 2023 - September 30, 2024, July 1, 2024 - September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Higher Education Coordinating Board (THECB) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of access controls, we noted that while THECB performs user access reviews for individuals with network access, the reviews were not documented. The absence of documented evidence prevents verification that the reviews were completed, who performed them, when they were performed, and whether identified issues were appropriately resolved. Questioned costs: None. Context: See “Condition.” Cause: The lack of documented access reviews appears to result from informal review processes and insufficient procedures requiring reviewers to maintain written evidence of the review. Additionally, there may be no standardized template or centralized repository for retention of such documentation. Effect: Without documentation of the network access review, THECB cannot demonstrate that: • Reviews were performed within the applicable audit period • Access rights were validated for appropriateness • Unauthorized or outdated access was identified and removed This lack of documentation increases the risk of unauthorized system access, potential misuse of systems or data, and noncompliance with federal internal control requirements. Repeat Finding: No Recommendation: We recommend that THECB: • Develop and implement a standardized documentation process for all user access reviews, including a required template documenting review date, reviewer identity, scope, results, and remediation actions. • Maintain all documentation in a centralized repository accessible to IT management and audit personnel. • Implement periodic monitoring to ensure reviews are performed timely and documentation is consistently retained. • Consider using automated access review tools to support completeness, timeliness, and auditability of reviews. Views of responsible officials: THECB ITS agrees with the finding.

Reporting – ACF-196R Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXTANF October 1, 2023 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR §265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. The ACF-204 report (Annual Report on State Maintenance-of-Effort Programs) must be completed and submitted in accordance with the requirements at 45 CFR §265.9(c). The report includes several line items that contain critical information, including “Total State MOE Expenditures.” Input for the Total State MOE expenditures line item is provided by the Texas Education Agency (TEA), the Texas Workforce Commission (TWC), and HHSC. The MOE amounts in the ACF-204 report are to agree to the amounts in the final ACF-196R report. For the FY2024 ACF-196R report, the contributing agencies reported State MOE expenditures on various line items including but not limited to: HHSC – Line 6a (Basic Assistance (excluding Relative Foster Care Maintenance Payments and Adoption and Guardianship Subsidies) TEA – Line 11b (Pre-Kindergarten/Head Start) Condition: All key line items in the FY 2024 ACF‑204 report were tested and agreed to supporting documentation without exception. However, the Total State Maintenance of Effort (MOE) Expenditures reported in the ACF‑204 by HHSC and the Texas Education Agency (TEA) did not reconcile to the amounts reported in the ACF‑196R as shown below: Amounts reported in the ACF‑204 were accurate and supported; the variances occurred because the ACF‑196R reflected higher MOE expenditures than those reported on the ACF‑204. Questioned costs: None. Context: See “Condition.” Cause: The variance in line 11b was due to miscommunication between the relevant HHSC personnel regarding revisions to an initial submission. The variance in line 6a was due to the HHSC Federal Reporting Team incorrectly including period 1 of 2025 in the MOE calculation. The agency did not perform a complete reconciliation between the ACF‑204 and ACF‑196R prior to submission, resulting in inconsistent MOE reporting across the required reports. Effect: Inaccurate or inconsistent reporting of MOE expenditures increases the risk of noncompliance with federal reporting requirements under 2 CFR §200.302 (financial management) and 2 CFR §200.329 (performance and financial reporting). These discrepancies may impair the federal awarding agency’s ability to evaluate program performance, assess State MOE compliance, and rely on the accuracy of reported financial information. Repeat Finding: No. Recommendation: HHSC should strengthen their financial reporting controls to ensure consistency between the ACF‑204 and ACF‑196R reports. Specifically, the agency should implement a formal reconciliation process that: • Compares all MOE expenditure amounts reported on the ACF‑204 to those reported on the ACF‑196R prior to submission; • Requires documented review and approval of the reconciliation by management; and • Ensures any discrepancies are researched, resolved, and corrected before the reports are finalized. Views of responsible officials: HHSC concurs with the recommendation.

Special Tests and Provisions – Child Support Non-Cooperation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXTANF, 2501TXTANF October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 U.S.C 608 (a)(2), if the agency responsible for administering the State plan approved under part D determines that an individual is not cooperating with the State in establishing paternity or in establishing, modifying, or enforcing a support order with respect to a child of the individual, and the individual does not qualify for any good cause or other exception established by the State pursuant to section 654(29) of this title, then the State: (1) shall deduct from the assistance that would otherwise be provided to the family of the individual under the State program funded under this part an amount equal to not less than 25 percent of the amount of such assistance; and (2) may deny the family any assistance under the State program. The State’s policy is to reduce benefits 100% for non-cooperation. HHSC policy requires that when the Office of the Attorney General (OAG) identifies a TANF recipient who has failed to cooperate with child support requirements, OAG must notify HHSC within seven days of the non‑cooperation date. Upon receipt, HHSC must apply the sanction within five working days. Condition: A sample of 40 TANF beneficiaries who were reported as non‑cooperating with program requirements during fiscal year 2025 was selected for testing. Two instances of untimely sanction application were identified: • One case in which HHSC reduced benefits one month late, resulting in an overpayment of $320. • One case in which HHSC reduced benefits two months late, resulting in an overpayment of $890. Questioned costs: $1,210 Context: See “Condition.” Cause: HHSC’s internal controls did not consistently ensure timely processing of sanctions upon receipt of non‑cooperation referrals from OAG. Existing monitoring and workflow procedures were insufficient to detect or prevent delays in applying benefit reductions. Effect: Failure to apply sanctions within required timeframes can lead to inaccurate benefit issuance, questioned costs, and weakened program integrity. Repeat Finding: No. Recommendation: HHSC should strengthen internal controls over the processing of TANF non‑cooperation sanctions to ensure timely application in accordance with program requirements. Specifically, HHSC should: • Implement an automated or workflow‑based tracking mechanism to monitor the timeliness of sanctions received from OAG. • Provide refresher training to eligibility staff on timely sanction procedures and the importance of preventing improper payments. Views of responsible officials: HHSC concurs with the recommendation.

Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXTANF, 2501TXTANF October 1, 2023 – September 30, 2024 and October 1, 2024 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Workforce Commission (TWC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §261.60(a)-(c), a State must report the actual hours that an individual participates in an activity. It is not sufficient to report the hours an individual is scheduled to participate in an activity. For unsubsidized employment, subsidized employment, and on-the-job training, the State may report projected actual hours of employment participation for up to six months based on current, documented actual hours of work. Any time the State receives information that the client's actual hours of work have changed, or no later than the end of any six-month period, the agency must re-verify the client's current actual average hours of work and may report these projected actual hours of participation for another six-month period. Condition: Audit procedures included independently recalculating average work participation hours for a sample of 40 TANF cases and comparing those results to the hours reported to the U.S. Department of Health and Human Services on the ACF‑199 report. For one of the 40 cases tested, the recalculated average work hours did not agree with the hours reported on the ACF‑199. This discrepancy resulted in a net overstatement of 9 hours on the ACF‑199 report. Questioned costs: No. Context: See “Condition.” Cause: The variance in reported hours for the affected case resulted from a system processing error by the third‑party vendor. During extraction from the WorkInTexas (WIT) system, TWC’s case management system, and file creation for transmission to HHSC, certain hour entries were inadvertently duplicated, leading to the double‑counting of participation hours and, consequently, an overstatement in the ACF‑199 reporting. Effect: Inaccurate reporting of work participation hours affects the reliability of the State’s TANF data submitted to the federal government and may compromise the accuracy of the State’s calculated work participation rates. Such reporting inaccuracies increase the risk of noncompliance with federal work verification requirements and may expose the State to potential penalties if similar errors are systemic or not promptly addressed. Repeat Finding: No. Recommendation: TWC, in coordination with the system vendor, should strengthen controls over the extraction, translation, and transmission of work participation hour data used in the ACF‑199 report. Specifically, TWC should: • Require the third-party vendor to implement system safeguards that prevent the duplication of hour entries during data extraction from the WIT system and subsequent file creation. • Establish automated validation checks to detect anomalies such as duplicate lines, unexpected variances, or irregular hour totals prior to ingesting vendor files into TWC systems. • Enhance supervisory review procedures to ensure that data received from third‑party vendors is reconciled to source records and verified for completeness and accuracy before inclusion in federal reporting. Views of responsible officials: TWC’s Divisions of Workforce Development, Information Technology, and Information, Innovation and Insight agree with the recommendations.

Cash Management – Cash Management Improvement Act Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Low-Income Home Energy Assistance Program (LIHEAP) ALN: 93.568 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2301TXLIEA, 2301TXLIEE, 2401TXLIEA, 2401TXLIEI, 2501TXLIEA, 2501TXLIEI October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 31 CFR §205.20, states use clearance patterns to project when funds are paid out, given a known dollar amount and a known date of disbursement. A state must ensure that clearance patterns meet the following standards: (a) A clearance pattern must be auditable. (b) A clearance pattern must accurately represent the flow of Federal funds under the Federal assistance programs to which it is applied. (c) A clearance pattern must include seasonal or other periodic variations in clearance activity. (d) A clearance pattern must be based on at least three consecutive months of disbursement data, unless additional data is required to accurately represent the flow of Federal funds. (e) If a State uses statistical sampling to develop a clearance pattern, the sample size must be sufficient to ensure a 96 percent confidence interval no more than plus or minus 0.25 weighted days above or below the estimated mean. (f) A clearance pattern must extend, at a minimum, until 99 percent of the dollars in a disbursement have been paid out for Federal assistance program purposes. (g) We and a State may agree to other procedures, such as estimates to project when funds are paid out when the dollar amount and/or the timing of disbursements are not known. Condition: The LIHEAP program is included in the Treasury-State Agreement effective for the fiscal year ending August 31, 2025, and it meets the threshold for inclusion under the Cash Management Improvement Act (CMIA). As such, TDHCA is required to prepare Period 1 clearance pattern calculations supported by verifiable disbursement data to ensure federal funds are drawn in accordance with the program’s required average clearance pattern of three days. TDHCA did not prepare a Period 1 clearance pattern calculation for LIHEAP based on at least three consecutive months of disbursement data as required. Although the Treasury-State Agreement specifies a three‑day average clearance pattern for the program, TDHCA did not maintain or provide documentation supporting how this clearance pattern was developed. As a result, the clearance pattern was not auditable, and we were unable to determine whether TDHCA’s practices for drawing federal funds aligned with the CMIA requirements. Questioned costs: None. Context: See “Condition.” Cause: Management noted their clearance pattern reflected their established funding techniques and prior reports; therefore, they overlooked the specific Treasury-State Agreement documentation requirements. Effect: Although we were able to perform testing over TDHCA’s cash management practices for LIHEAP and concluded that no federal interest was earned as a result of timing differences, the absence of a documented Period 1 clearance pattern calculation prevented us from validating the accuracy of the three‑day clearance pattern prescribed in the Treasury–State Agreement. Without an auditable calculation, TDHCA cannot demonstrate that the established clearance pattern is supported by actual disbursement data, which limits assurance that the methodology used for federal draws fully complies with CMIA requirements. Repeat Finding: No Recommendation: TDHCA should establish and implement procedures to ensure that a Period 1 clearance pattern calculation is completed and retained for LIHEAP in accordance with CMIA and Treasury–State Agreement requirements. This calculation should be based on at least three consecutive months of actual disbursement data and documented in a manner that is readily auditable. TDHCA should also provide training to staff responsible for CMIA compliance to ensure they are aware of the requirement to prepare and maintain this calculation. Views of responsible officials: The Texas Department of Housing and Community Affairs acknowledges and agrees with the finding.

Reporting – Quarterly Performance and Management Report Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Low-Income Home Energy Assistance Program (LIHEAP) ALN: 93.568 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2501TXLIEI October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §96.82(a), each grantee which is a State or an insular area which receives an annual allotment of at least $200,000 shall submit to the Department, as part of its LIHEAP grant application, the data required by section 2605(c)(1)(G) of Public Law 97-35 (42 U.S.C. 8624(c)(1)(G)) for the 12-month period corresponding to the Federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance. Key Line Items containing critical information include: 1. Section 1 – Total Households Assisted 2. Section 2 – Performance Management 3. Section 3 – Estimated Use of Funds 4. Section 4 – LIHEAP Program Implementation and Support Condition: As part of our testing of the Quarterly Performance and Management Report for award 2501TXLIEI, we selected 2 of the 4 reports submitted during the fiscal year. During our review, we identified a discrepancy in the quarter 1 report (October 1 – December 31). The report stated that $159,463,428 in LIHEAP funds had been obligated by funding source in Section 3 – Estimated Use of Funds; however, supporting documentation reflected obligated funds totaling $174,447,109, resulting in a variance of $(14,983,681). Questioned costs: None. Context: See “Condition.” Cause: An error was made when TDHCA staff entered the amount of funds obligated into the report, and existing internal controls did not detect the error before the report was submitted to U.S. Department of Health and Human Services (HHS) Effect: Inaccurate reporting may lead to misstated financial information at the federal level, hinder management’s ability to make informed decisions, and could affect federal oversight and monitoring of program activity. These discrepancies increase the risk of noncompliance with federal reporting requirements and may impact the integrity of cumulative statewide LIHEAP reporting. Repeat Finding: No Recommendation: We recommend that TDHCA strengthen its review and reconciliation procedures for quarterly LIHEAP reporting to ensure that amounts reported are fully supported by accurate and complete documentation. This should include implementing a formal review process that requires verification of reported obligation amounts against source records prior to submission, as well as enhanced training for staff responsible for report preparation. Views of responsible officials: The Texas Department of Housing and Community Affairs acknowledges and agrees with the finding.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Period of Performance, Reporting, Subrecipient Monitoring – Information Technology – User Access Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant ALN: 93.558 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Temporary Assistance for Needy Families 2401TXTANF, 2501TXTANF October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025 Social Services Block Grant 2301TXSOSR, 2401TXSOSR, 2501TXSOSR October 1, 2022 - September 30, 2024, October 1, 2023 - September 30, 2025, October 1, 2025 - September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), the Department of Family and Protective Services (DFPS) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of user access termination controls, we identified two instances, out of a sample of 25 terminated users, in which individuals were not removed from the Network and IMPACT in a timely manner. In both cases, the users’ accounts remained active well beyond their documented termination dates, resulting in unauthorized active credentials during the post‑termination period. The two exceptions were as follows: User A: Termination date 11/05/2024; access not removed until 11/22/2024. User B: Termination date 11/17/2024; access not removed until 02/20/2025. Questioned costs: None. Context: See “Condition.” Cause: The delays appear to be the result of breakdowns in the coordination between HR separation processes and IT access revocation procedures, including delays in communication or gaps in the automated termination workflow. Effect: Failure to remove user access promptly increases the risk of: • Unauthorized access to confidential or sensitive information; • Potential manipulation, loss, or misuse of program data; • Increased exposure to operational and security risks. Although no misuse of access was identified, the presence of active credentials after termination represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend DFPS: • Strengthen coordination between HR and IT functions to ensure immediate notification upon employee separation. • Implement automated workflows that disable all user access promptly upon termination. • Conduct periodic reconciliations of HR separation lists against active user accounts to detect and remove any lingering access. • Enhance monitoring controls, including reporting dashboards or alerts triggered when access is not removed within a defined timeframe. Views of responsible officials: Management agrees with the findings.

Reporting – Post-Expenditure Report Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant ALN: 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXSOSR October 1, 2023 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The 42 USC 1397e requires states and territories to submit to the federal administering agency, the Office of Community Services, an annual Post Expenditure Report no later than six months following the close of the fiscal year. The report includes certain critical key line information including: • TANF Funds Transferred into SSBG –Amount reported on this line item should be consistent with the TANF federal financial report (ACF-196R). The Federal Funds Office (FFO) is responsible for the completeness, accuracy, and timely submission of the Post Expenditure Report. Federal Reporting Fiscal Management personnel are responsible for proper reporting and submission of the ACF-196R Report. Condition: During testing of key line items for the FY2024 Post Expenditure Report submitted in March 2025, we noted that TANF Funds Transferred into SSBG was reported as $41,623,634. However, the amount reported on the ACF-196R report was $38,778,521, resulting in a variance of $2,845,113. Questioned costs: None Context: See “Condition.” Cause: FFO did not properly coordinate efforts with the Federal Reporting personnel to ensure the amounts noted on the ACF-196R report were consistent with the amount on the Post Expenditure Report. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: 2023-013, 2024-008 Recommendation: We recommend the FFO coordinate with the appropriate Federal Reporting Team personnel regarding amounts noted for the TANF Funds Transferred into SSBG to ensure the amount in the Post Expenditure Report matches with the amount in the ACF-196R. Views of responsible officials: HHSC concurs with the recommendation.

Earmarking – Administrative Expenses Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1B09SM087322 October 17, 2022 – October 16, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 U.S.C 300x-5(b), a funding agreement for a grant under section 300x of this title is that the State involved will not expend more than 5 percent of the grant for administrative expenses with respect to the grant. Condition: HHSC expended $1,069,086 of the total grant award amount of $3,690,918 as of the end of the project period. Administrative expenditures for the grant totaled $54,672, which represents 5.11 percent of the federal funds expended, exceeding the allowable 5 percent threshold. Questioned costs: $1,217. Context: See “Condition.” Cause: The overage resulted from a delay in the grant’s start date, which subsequently postponed the initiation of related projects and led to lower overall expenditures. Effect: By exceeding the 5 percent administrative cap, HHSC did not comply with the statutory limitation on administrative costs, resulting in unallowable administrative expenditures charged to the grant. This noncompliance may require reimbursement to the federal agency and increases the risk of future questioned costs. Repeat Finding: No Recommendation: We recommend HHSC make necessary adjustments to federal expenditures in the event of program delays to ensure the agency stays within required percentage maximums. Views of responsible officials: HHSC concurs with the recommendation.

Subrecipient Monitoring – Missing Contract Elements Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Special Education – Grants for Infants and Families Temporary Assistance for Needy Families (TANF) Block Grants for Prevention and Treatment of Substance Abuse ALN: 84.181 93.558 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Special Education – Grants for Infants and Families H181A200171, H181A210171, H181A220171, H181A230171, H181A240171, H181A250171 July 1, 2020 – September 30, 2021, July 1, 2021 – September 30, 2022, July 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2024, July 1, 2024 – September 30, 2025, July 1, 2025 – September 30, 2026 TANF 2001TXTANF, 2101TXTANF, 2201TXTANF, 2301TXTANF, 2401TXTANF and 2501TXTANF October 1, 2019 – September 30, 2020, October 1, 2020 – September 30, 2021, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 and October 1, 2024 – September 30, 2025 Block Grants for Prevention and Treatment of Substance Abuse 1B08TI083969, 1B08TI084609, 1B08TI083054, 1B08TI083478, 1B08I084673, 1B08TI085835, 1B08TI087067, 1B08TI088134 September 1, 2021 – March 24, 2025, September 1, 2021 – March 24, 2025, October 1, 2019 – September 30, 2021, October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR §200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the certain required information provided. A pass-through entity must provide the best available information when some of the required information is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes the subrecipient’s unique entity identifier (UEI), assistance listings numbers (ALN), and title of the program. Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: Special Education – Grants for Infants and Families (SEGIF) –The UEI was not included in the base subaward agreement for seven of the eight agreements selected for testing. The last amendment to the original agreement included the UEI number, however, it did not reference the ALN and title of the program. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Temporary Assistance for Needy Families – The ALN and title of the program was not included in four of the seven subaward agreements selected for testing. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Block Grants for Prevention and Treatment of Substance Abuse –The UEI was not included in one of the 18 agreements selected for testing. The start and end dates for the agreement was September 1, 2020 – August 31, 2025. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR §200.332 prior to execution is not at the correct precision level. Effect: Because required subaward information was omitted, HHSC increased the risk that subrecipients were not fully informed of the federal award details necessary to properly administer the funds in compliance with the applicable statutes, regulations, and award terms. Missing UEI, ALN, and program titles may impede subrecipients’ ability to accurately identify the federal program, appropriately report activities, and meet federal requirements, including those related to financial management, performance, subrecipient monitoring, and audit preparation. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements noted in 2 CFR §200.332. Views of responsible officials: HHSC concurs with the recommendation.

Level of Effort - Supplement not Supplant Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster ALN: 93.044, 93.045, 93.053 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXOASS, 2201TXOANS, 2201TXOACM, 2201TXOAHD October 1, 2021 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §1321.9(c)(2)(xvi), funds awarded under Title III of the Older Americans Act for services provided under section 321(d) (42 U.S.C 3030d(d)) must be used to supplement, not supplant existing Federal, State, and local funds expended to support those activities. Condition: A comparison of supportive services and senior center funding between fiscal years 2023 and 2024 showed that total service levels increased by approximately 5 percent, rising from $40,354,713 in FY2023 to $42,267,130 in FY2024. During the same period, federal expenditures increased by 8 percent, from $31,170,863 to $33,755,005, while non‑federal expenditures decreased by 7 percent, from $9,183,850 to $8,512,125. Because the increase in federal funding outpaced the increase in total services, and was accompanied by a reduction in non‑federal contributions, federal funds effectively replaced rather than supplemented state or other non‑federal resources. Accordingly, HHSC supplanted non‑federal funds with federal funds for the 2024 grant. To quantify the financial impact, total services increased by 5 percent; therefore, the federal contribution would be expected to increase proportionally by 5 percent. Applying a 5 percent growth rate to the FY2023 federal amount of $31,170,863 yields an expected level of $32,729,406 for FY2024. However, actual federal expenditures totaled $33,755,005, resulting in excess federal funding of $1,025,599 beyond what would be needed to support the observed service increase. Questioned costs: $1,025,599. Context: See “Condition.” Cause: HHSC has followed supplement not supplant policies and procedures that were implemented based on compliance with total level of services (i.e., all services) and not specifically for supportive services and senior centers, as required. Effect: HHSC has supplanted non-federal funds used for supportive services and senior centers, resulting in questioned costs and noncompliance. Repeat Finding: No Recommendation: HHSC should revise existing policies and procedures to ensure they are not supplanting nonfederal funds specifically related to supportive services and senior centers. Views of responsible officials: HHSC concurs with the recommendation.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Block Grants for Community Mental Health Services Block Grants for Prevention and Treatment of Substance Abuse ALN: 93.044, 93.045, 93.053 93.558 93.667 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXSSC6, 2101TXCMC6, 2101TXHDC6, 2201TXOASS, 2201TXOANS, 2201TXOACM, 2201TXOAHD, 2201TXSTPH, 2301TXOAHD, 2301TXOACM, 2301TXOASS, 2301TXOANS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS, 2501TXOASS, 2501TXOAHD, 2501TXOACM, 2501TXOANS April 1, 2021 – September 30, 2025, October 1, 2021 – September 30, 2024, January 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 TANF 2401TXTANF and 2501TXTANF October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2025 Social Services Block Grant 2301TXSOSR, 2401TXSOSR, 2501TXSOSR October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Block Grants for Community Mental Health Services 1B09SM085913, 1B09SM085385, 1B09SM087345, 1B09SM087322, 1B09SM089380, 1B09SM089610, 1B09SM089984 September 1, 2021 – March 24, 2025, October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, September 30, 2023 – September 29, 2025, October 1, 2023 – September 30, 2025, September 30, 2024 – September 29, 2026 Block Grants for Prevention and Treatment of Substance Abuse 1B08TI083969, 1B08TI084609, 1B08TI085835, 1B08TI087067, 1B08TI088134 September 1, 2021 – March 24, 2025, September 1, 2021 – March 24, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Nonmajor programs Opioid STR 6H79TI083288, 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. As of March 8, 2025, fsrs.gov was retired, and all subaward reporting data and functionality are now on SAM.gov. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards on FSRS.gov or SAM.gov. A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligation at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS.gov or SAM.gov. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2024-005, 2023-010, 2022-013, 2021-007 Views of responsible officials: HHSC concurs with the recommendation.