Findings Citing § 200.303

Criteria or specific requirement: CFR Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, §200.303 specifies that a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The Organization did not have policies and procedures in place to ensure all the requirements of subrecipient monitoring were being performed. Questioned costs: None. Context: None of the 5 subrecipients selected for testing (out of a population of 10) had proper monitoring in place. Cause: Policies and procedures were not in place to provide adequate subrecipient monitoring. Effect: The Organization could pass through federal funding to subrecipients who are not responsible or capable recipients of the funds. Funding could be used by the subrecipients in ways that are incompatible with program goals and compliance requirements. Repeat finding: Yes. Recommendation: We recommend that the Organization implements policies and procedures to perform subrecipient monitoring and that monitoring is formally documented and approved. Views of responsible officials: There is no disagreement with the audit finding.

Criteria: 2 CFR section 200.303 states in part: “The non-Federal entity must: (b) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . .” Additionally, 31 CFR section 205.33 states in part: (b) “…the timing and amount of funds transfers must be as close as is administratively feasible. . .” Condition: An effective internal control system was not in place to ensure the Corporation’s compliance with requirements related to the grant agreement and the Cash Management compliance requirements. There was no formal review or approval of claim reimbursements by someone other than the individual who prepared them. Additionally, claim reimbursements were not drawn in a timely or consistent manner. Cause: The Corporation's management has not developed a system of internal controls to ensure compliance with the compliance requirements listed above. Specifically, controls were not in place to ensure reimbursement claims were prepared timely, reviewed and approved prior to submission, compared to supporting documentation, and drawn in amounts and at times that were as close as administratively feasible to the related expenditures.Effect: The failure to establish an effective internal control system places the Corporation at risk of noncompliance with the grant agreement and the Cash Management compliance requirements. A lack of effective review and timely claim submission could have resulted in inaccurate reimbursement requests, improper period recognition of federal funds, delayed cash flow, misuse or mismanagement of federal funds and assets, and failure to fully expend the grant within the period of performance. Recommendation: We recommend that the Corporation establish policies and procedures to ensure that reimbursement claims are prepared timely, reviewed and approved by someone other than the preparer, and compared to supporting documentation to ensure accuracy and completeness. Reimbursement claims should also be prepared and submitted timely to help ensure compliance with Cash Management requirements, proper period recognition, and adequate reimbursement. Views of Responsible Officials and Corrective Actions: In early 2026, Hamilton County Area Neighborhood Development, Inc. (HAND) hired an experienced controller to prepare the parent company and subsidiaries financials. HAND will establish effective internal control systems to ensure compliance with the requirements for grant agreements and cash management compliance requirements.

Significant Deficiency in Internal Control over Compliance Federal Agency: U.S. Department of Justice Federal Program: Crime Victim Assistance Assistance Listing Number: 16.575 Direct Award Number: Not applicable Pass-Through Entity: California Governor's Office of Emergency Services (CalOES) Grant Identifying Numbers: XD-23-02-1199, AT-23-04-1199, XL-23-03-1199 Compliance Requirements: Cash Management and Reporting Criteria: Pursuant to 2 CFR §200.303, the Organization is required to establish and maintain effective internal control over the federal award that provides reasonable assurance that the Organization is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Under 2 CFR §200.328 (financial reporting) and §200.329 (performance reporting) recipients are responsible for monitoring activities under federal awards and must submit required performance and financial reports at the intervals required by the federal award, which may be no more frequent than quarterly and no less frequent than annually. Condition and Context: The pass-through entity changed requirements in January 2025 to require only one signature/certification when they moved to electronic submission of monthly cost reimbursement claims and financial reports from paper submission that required two reviewer signatures. This caused the organization to not have proof of review by way of second signature on file for the submitted financial claims and financial reports although procedurally there was evidence of internal review within the accounting department. Cause: Management did not design and implement documented internal controls requiring supervisory review and approval of cash management activities and federal financial reporting. Effect: The lack of documented internal controls increased the risk that errors, omissions, or noncompliance related cash management and reporting could occur and not be detected in a timely manner. Questioned Costs: Not applicable. Repeat Finding: No Recommendation: We recommend management design and implement documented review and approval controls over the applicable compliance requirements. This should include regular monitoring to ensure controls are consistently applied, and periodic internal audits to assess the effectiveness of compliance systems.Views of Responsible Officials: In January 2025, CalOES moved to an electronic submission of the monthly cost reimbursement claims form and financial reports which only allowed one signature/certification on the form. Prior to 2025, the manual submission required two signatures. Under the new electronic system, the Organization did not have proof of a supervisor review on the electronic form or internally. Since the internal policy and Federal requirements ask for supervisory approval, the Organization will amend internal processes to document supervisory approval beginning in January 2027.

Significant Deficiency in Internal Control over Compliance Federal Agency: U.S. Department of Justice Federal Program: Grants to Encourage Arrest Policies and Enforcement of Protection Orders Assistance Listing Number: 16.590 Direct Award Number: Not applicable Pass-Through Entity: Contra Costa County Employment and Human Services Grant Identifying Number: 15JOVW-22-GG-01810-ICJR Compliance Requirement: Reporting Criteria: Pursuant to 2 CFR §200.303, the Organization is required to establish and maintain effective internal control over the federal award that provides reasonable assurance that the Organization is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Under 2 CFR §200.328 (financial reporting) and §200.329 (performance reporting) recipients are responsible for monitoring activities under federal awards and must submit required performance and financial reports at the intervals required by the federal award, which may be no more frequent than quarterly and no less frequent than annually. Condition and Context: The pass-through entity (Contra Costa County) required use of their form D-15 for the sub awardee organization. That form required only one signature for preparation and submission. As such, a second signature was not on the form as proof of review. Cause: Management did not design and implement documented internal controls requiring supervisory review and approval of federal financial reporting. Effect: The lack of documented internal controls increased the risk that errors, omissions, or noncompliance related to reporting could occur and not be detected in a timely manner. Questioned Costs: Not applicable. Repeat Finding: No Recommendation: We recommend management design and implement documented review and approval controls over the applicable compliance requirements. This should include regular monitoring to ensure controls are consistently applied, and periodic internal audits to assess the effectiveness of compliance systems.Views of Responsible Officials: The Organization is a subrecipient of this grant administered by Contra Costa County. We used one signature during 2025 for preparer and submitter of the financial reporting as has been acceptable to the Contra Costa County for acceptance and processing. Although there was evidence of internal review within the accounting department, the Organization understands the need for second review documentation. A process will be implemented beginning in January 2027 to document the second review signature.

Criteria: Per 2 CFR 200.303(a), a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Federal award is managed in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per review of 2 CFR 200.213, non-Federal entities are prohibited from contracting with, or making sub-awards under covered transactions to, parties that are suspended or debarred or whose principals are suspended or debarred. Covered transactions include contracts for goods and services awarded under a non-procurement transaction that are expected to equal or exceed $25,000 or meet certain other criteria as specified in 2 CFR Section 180.220. All non-procurement transactions entered into by a pass-through entity (i.e., sub-awards to subrecipients), irrespective of award amount, are considered covered transactions, unless they are exempt as provided in 2 CFR Section 180.215. Condition/context: The Organization did not perform verification procedures to ensure that the vendor was not suspended or debarred. However, we independently verified that the vendor was not suspended or debarred per review of sam.gov. Cause: Prior to this award, the Organization did not receive Federal funds. As a result, the Organization does not have a formal suspension and debarment policy. Effect: If the Organization is not verifying that vendors with individual purchases greater than $25,000 are neither suspended nor debarred, it is possible that the Organization could expend Federal funds with a vendor that is suspended or debarred, in which case the Organization may be required to return the funds expended to that vendor to the Federal oversight agency. Questioned costs: None. Identification as a repeat finding: No. Recommendation: We recommend that the Organization implement a control system when expending Federal funds to perform and maintain documentation that a sam.gov verification was performed for all vendors with individual purchases greater than $25,000. Views of responsible officials and planned corrective actions: Management concurs with the finding. See Exhibit I.

Findings and Questioned Costs Relating to Federal Awards Finding Reference Number: 2025-001 Bassett Health Network Research and Development Cluster (93.262) Federal Award Number: U54OH007542, 23U01OH012656, R01OH011668, U13OH01282 Federal Award Year: 2025 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness and Material Noncompliance Prior Year Finding: N/A Statistically Valid Sample: No Criteria Title 2 of the Code of Federal Regulations, Part 200 — Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200) section 200.332(c) states a passthrough entity should evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider: 1) The subrecipient’s prior experience with the same or similar subawards; 2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; 3) Whether the subrecipient has new personnel or new or substantially changed systems; and 4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). Further, 2 CFR 200.332(e) states that a pass-through entity must monitor the activities of a subrecipient as necessary to ensure compliance with Federal statutes, regulations, and subaward terms and conditions and to ensure the goals and objectives of the subaward are achieved. At a minimum, monitoring must include: (1) Reviewing financial and performance reports; (2) Ensuring the subrecipient takes corrective action on significant developments that negatively affect the subaward (including relevant Single Audit findings, other audit findings, site visits, and written notifications of adverse conditions); (3) Issuing a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity, as required by § 200.521; and (4) Resolving audit findings specifically related to the subaward. Additionally, 2 CFR 200.332(f) states a pass-through must, depending upon the pass-through entity's assessment of the risk posed by the subrecipient (as described in 2 CFR 200.332(c)), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; (2) Performing site visits to review the subrecipient's program operations; and (3) Arranging for agreed-upon-procedures engagements as described in 2 CFR 200.425. Also, 2 CFR 200.332(g) requires the pass-through entity to verify that a subrecipient is audited as required by Subpart F of Part 200. Lastly 2 CFR 200.303(a) states, recipient and subrecipients of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During the year ended December 31, 2025 Bassett Health Network (the Network) passed through $166,774 of federal funding to subrecipients as it relates to the Research and Development Cluster. As part of our testing related to subrecipient monitoring, we identified the following: A. For 3 out of 3 subrecipients selected for testwork, the Network was unable to provide support evidencing the evaluation of the subrecipients’ fraud risk and risk of noncompliance risk. B. For 3 out of 3 subrecipients selected for testwork, the Network was unable to provide evidence of considering or performing additional monitoring procedures based on the subrecipient’s risk evaluation. C. For 3 out of 3 subrecipients selected for testwork, the Network was unable to provide evidence that the Network reviewed that the subrecipient receives a Single Audit in accordance with subpart F. Cause The cause of the condition was a lack of sufficiently documented and implemented policies, procedures, and internal controls to ensure that required subrecipient monitoring activities were performed and adequately documented in accordance with federal requirements. Effect Failure to perform annual risk assessments to determine appropriate subrecipient monitoring procedures, as well as failure to verify and review subrecipient Single Audit reports, may result in insufficient oversight to detect subrecipient noncompliance with Federal statutes, regulations, and the terms and conditions of the award. Further, the lack of timely audit reviews limits the Network’s ability to ensure subrecipients take prompt corrective action on significant developments or deficiencies affecting the subaward. Questioned Costs None. Recommendation We recommend the Network develop written policies and procedures to ensure that all required subrecipient monitoring activities, both identified through risk assessments and through review of Single Audits, are consistently performed and adequately documented in accordance with Federal requirements and the terms and conditions of the subawards. Such documentation should provide clear and sufficient evidence that required risk assessment and monitoring procedures have been completed, including documentation that demonstrates what was performed, when it was performed, who performed it, the results of the monitoring activities, and any follow‑up actions or issues identified, as applicable. View of Responsible Officials Recommendation accepted. Please see corrective action plan.

Finding 2025-003: Notification of Disbursements to or on Behalf of Students | Identification of the federal program: Federal Agency: United States Department of Education. Federal Cluster: Student Financial Assistance Cluster. Assistance Listing No.: 84.268 Federal Direct Student Loans (Direct Loans) and 84.063 Federal Pell Grant Program. Award Periods: July 1, 2024 through June 30, 2025; July 1, 2025 through June 30, 2026. Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 34 CFR 668.165(a)(1) – Before an institution disburses title IV, HEA program funds for any award year, the institution must notify a student of the amount of funds that the student or his or her parent can expect to receive under each title IV, HEA program, and how and when those funds will be disbursed. If those funds include Direct Loan program funds, the notice must indicate which funds are from subsidized loans, which are from unsubsidized loans, and which are from PLUS loans. Condition: When Direct Loans are being credited to a student’s account, an institution must notify the student, or parent, in writing of (1) the date and amount of the disbursement; (2) the student’s right, or parent’s right, to cancel all or a portion of that loan or loan disbursement and have the loan proceeds returned to the holder of that loan; and (3) the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan. Atrium Health CMHA was unable to provide the notification letters sent to the student as they are not maintained.. Cause: The current IT system does not allow for the letters sent to be saved. Effect or potential effect: The disbursement notification letters may not have been sent in accordance with the regulations. Questioned costs: None. Context: Total expenditures for the Student Financial Assistance Cluster were $3,348,141 for the year ended December 31, 2025. We selected a sample of 40 disbursements and identified 40 that did not have notification of disbursement. Identification as a repeat finding, if applicable: This finding is a repeat finding of 2024-003 from the prior year. Recommendation: Atrium Health CMHA should implement internal controls to retain all disbursement notification letters sent to students. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Finding 2025-004: Gramm-Leach-Bliley Act (GLBA) – Student Information Security Controls | Identification of the Federal Program: Federal Agency: United States Department of Education. Federal Cluster: Student Financial Assistance Cluster. Assistance Listing No.: 84.268 Federal Direct Student Loans (Direct Loans) and 84.063 Federal Pell Grant Program. Award Periods: July 1, 2024 through June 30, 2025; July 1, 2025 through June 30, 2026. Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. Condition: Atrium Health CMHA did not have adequate internal controls in place surrounding the Information Security Program to ensure all required elements were in place. During our testing, we noted there was one element of the Information Security Program that was not in place during the year. Cause: Atrium Health CMHA did not implement one element of the Information Security Program during the year. Effect or Potential Effect: The Written Information Security Program is not compliant with federal regulations. Questioned Costs: None. Context: Total federal expenditures for the Student Financial Assistance Cluster recorded on the Schedule of Expenditures of Federal Awards (Schedule) totaled $3,348,141 for the year ended December 31, 2025. Identification as a Repeat Finding, if Applicable: This finding is a repeat finding of 2024-004 from the prior year. Recommendation: Atrium Health CMHA should design and implement internal controls over the Information Security Program to ensure all requirements of the GLBA are included in the written Information Security Program appropriately and operating. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.

Identification of the federal program: Federal Grantor: United States Department of Health and Human Services Assistance Listing Number: 93.243, Substance Abuse and Mental Health Services Projects of Regional and National Significance Federal Grant Award No.: H79TI084037 Criteria or specific requirement (including statutory, regulatory, or other citation): 2 CFR 200.303 requires that the non-Federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under the requirements of the Federal Funding Accountability and Transparency Act (Transparency Act) that are codified in 2 CFR Part 170 related to reporting of subawards, “Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward.”. The recipient must report each subaward described to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the end of the month following the month in which the subaward was issued. Condition: During our audit, we noted that four reportable subaward modifications related to Assistance Listing Number 93.243, Substance Abuse and Mental Health Services Projects of Regional and National Significance (the SAMHSA program), made during fiscal year 2025 were not reported to the FSRS by the end of the month following the month in which they were issued, as required by 2 CFR Part 170. The following is a summary of the selections tested during our fiscal year 2025 audit procedures for FSRS reporting of subawards for the SAMHSA program: Cause: Northwell did not have sufficient internal controls to ensure that the required Transparency Act reports were submitted timely. Effect or potential effect: Northwell Health, Inc. and its member corporations and other controlled affiliated entities (collectively, Northwell) did not submit the necessary Transparency Act reports under the SAMHSA program to FSRS on a timely basis for each of the subaward modifications selected in our audit tests, and consequently Northwell was not in compliance with the requirements under the Transparency Act. Questioned costs: None. Context: The SAMHSA program included five reportable subawards totaling $457,399 during the fiscal year 2025. Four of the five reportable subawards were not reported to FSRS within the required reporting timeframe. The untimely reports related to subawards totaling $299,165. The reports were subsequently submitted, and no inaccuracies or missing data elements were identified in the information reported. Total federal expenditures under the program for fiscal year 2025 were $3,093,193. Identification as a repeat finding, if applicable: The finding is not a repeat finding from the prior year. Recommendation: We recommend that Northwell strengthens its internal controls and procedures over Transparency Act reporting related to the SAMHSA program in order to ensure the required reports are submitted on a timely basis in compliance with the Federal reporting requirements. Views of responsible officials: Management concurs with the finding. During fiscal year 2025, certain subaward modifications under the SAMHSA program were not reported to the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS) within the required timeframe. Upon identification, the reports were submitted and confirmed to be accurate and complete. To prevent recurrence, responsible staff will receive annual in-service training on FFATA reporting requirements and the importance of timely compliance with the Transparency Act. In addition, management is reviewing and updating its standard operating procedures for FFATA reporting to strengthen internal controls and ensure all reportable subaward actions are identified and submitted within the required reporting period.

Finding 2025-001 Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Social Services Block Grant Assistance Listing Number: 93.667 Federal Award Identification Number and Year: 2401NVSOSR 2025 Pass-Through Agency: State of Nevada, Department of Health and Human Services Pass-Through Number(s): 2401NVSOSR Award Period: January 1, 2025 – December 31, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance and Other Matters Criteria or specific requirement: In accordance with the Compliance Supplement, Part 6 - Internal Control, CFR § 200.303(a) requires that non-Federal entities must establish and maintain effective internal control over Federal awards that provides reasonable assurance the entity is managing Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, 2 CFR § 200.332(g) requires pass-through entities to verify that subrecipients expected to be audited under 2 CFR Part 200, Subpart F have met the applicable audit requirements and follow-up on any findings and corrective action as part of its subrecipient monitoring requirements. Condition: Management did not retain documentation demonstrating their monitoring procedures over annual audits under 2 CFR Part 200, Subpart F had been met. During our testing of internal controls over subrecipient monitoring compliance requirements, we noted that the Organization had not designed and implemented documented controls to verify that subrecipients subject to audit requirements under 2 CFR Part 200, Subpart F had met the requirements for annual audits. Questioned costs: None. Context: Subrecipient monitoring over federal annual audit requirements was not reviewed and documented for all three subrecipients during the current reporting period. Cause: The Organization did not have documented internal controls designed to ensure verification of annual audit requirements as part of its subrecipient monitoring procedures. Effect: Without a documented control to verify subrecipient audit requirements, management may not timely identify subrecipients subject to Single Audit requirements or instances in which required audits have not been completed. As a result, subrecipient noncompliance could occur and not be detected in a timely manner. Repeat Finding: No. Recommendation: Management should establish internal control procedures to ensure formal documentation of the annual verification of whether subrecipients are subject to audit requirements and, if applicable, that required audits have been completed. Documentation should be retained to support the procedures performed, including information obtained from subrecipients, management's assessment of audit requirements, and any follow-up actions taken. Views of responsible officials: There is no disagreement with the audit finding.

2 CFR 200.303 requires that recipients and subrecipients receiving federal awards establish, document and maintain effective internal control over the federal awards that provides reasonable assurance that the recipient or subrecipient is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. For 6 of 9 samples selected for testing, management was unable to provide evidence of review of the calculations and underlying support of fringe rates applied. Management believed an existing higher-level review provided sufficient oversight; however, the documentation supporting that review did not appropriately demonstrate a sufficiently detailed review of inputs into the Fringe Rate calculations. Lack of review could result in reimbursement of expenditures that are not allowed under ALN 93.778.

Finding 2025-002 United States Department of Agriculture - Forest Service Federal Assistance Listing No. 10.727 Inflation Reduction Act (IRA) Baltimore Tree Trust Significant Deficiency in Internal Controls and Noncompliance Over Subrecipient Monitoring Repeat Finding: No Condition: For 1 out 1 subrecipient, the subaward agreement did not identify the unique entity identifier (UEI), the Federal Award Identification Number (FAIN), and Assistance Listing Number (AL) as required. Management also did not establish and implement adequate written policies and procedures for monitoring subrecipients. For 1 out 1 subrecipient, we were unable to substantiate that BTT reported the first-tier subaward made to Blue Water Baltimore in accordance with the applicable Federal award terms. The subaward met the applicable $30,000 Federal funding threshold for reporting; however, BTT was unable to provide sufficient documentation demonstrating that the required subaward reporting was completed. Criteria: In accordance with 2 CFR §200.303, the non-federal entity must establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, FAIN, identification of whether the award is R&D and indirect cost rate for the federal award. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. (f) Determine whether the PTE has written subrecipient monitoring policies and procedures that address the identification of subawards, assessment of subrecipient risk of noncompliance, and performance of monitoring procedures based on identified risks. (g) Per grant agreement, in accordance with the applicable Federal award terms, unless otherwise exempt, the PTE is required to report each first-tier subaward action that equals or exceeds 30,000 in Federal funds awarded to a non-Federal entity or Federal agency. The non-Federal entity or Federal agency must report each applicable obligating action described in paragraph (g) of the award terms to fsrs.gov. For subaward information, the report must be submitted no later than the end of the month following the month in which the obligation was made Cause: Management did not have adequate written procedures or controls in place to ensure that all required federal award information and applicable requirements were identified and incorporated into subaward agreements. Specifically, management did not have a formal review process to verify the inclusion of the UEI, FAIN, ALN, and applicable federal award requirements before subawards were executed. Effect: BTT was not in compliance with subrecipient monitoring requirements of the grant under the Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend that BTT establish and implement written policies and procedures to ensure that all subaward agreements include the required Federal information, including the UEI, FAIN, and ALN. BTT should also establish procedures to ensure that subrecipients are properly monitored and that all first-tier subawards meet the applicable reporting threshold are reported timely and accurately in accordance with Federal requirements. BTT should maintain sufficient documentation to demonstrate that required subaward reporting and monitoring activities were completed. Auditee Response and Corrective Action Plan: Refer to management’s corrective action plans. Auditor’s Conclusion: Finding remains as stated.

SECTION III - FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS Ref. No. 2025-001 Noncompliance with Grant Award Terms - Significant Deficiency Federal agency: Department of Health and Human Services Program: ALN No. 93.558 Temporary Assistance for Needy Families Pass-through entity: State Department of Human Services Award number and award year: DHS-24-TANF-0116, June 3, 2024 to August 2, 2025 Criteria: Internal control requirements per 2 CFR §200.303 require a non-federal entity to establish and maintain effective internal control over a federal award that provides reasonable assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The DHS-24-TANF-0116 award specifically prohibits BGCH from charging youths or their families for programs or services provided under the award without prior approval from the State. Condition: During the year ended December 31, 2025, BGCH charged summer intersession fees to youth participants at all BGCH Clubhouses without obtaining prior State approval. Cause: BGCH did not have established formal policies and procedures for managing government awards, including a workflow for reviewing contract requirements and training responsible personnel before services commenced. Effect: BGCH improperly collected approximately $62,000 in summer intersession fees, of which was refunded to the youths and their families in May 2026. Without proper policies and procedures in place, there is an increased risk that noncompliance with federal award terms and conditions could occur and not be prevented, detected, and corrected, on a timely basis. Questioned Costs: None identified as part of this finding. The $62,000 relates to fees improperly collected from program beneficiaries rather than federal award funds expended by BGCH. Repeat Finding? No Recommendation: We recommend that management fully implement its corrective action plan submitted to the State Department of Human Services on March 4, 2026, which includes providing training to staff at all levels, refunding fees collected from youth member families, and establishing formal policies and standard operating procedures for managing government contracts. Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding and the recommendation. See Part V Corrective Action Plan.

Criteria- Uniform Guidance (2 CFR §200.303) requires recipients offecleral awards to establish and maintain effective internal controls over compliance. Specifically, 24 CFR §982.201 and related program requirements for the Moving to Work Demonstration Program (Assistance Listing Number 14.881) specific to the Section 8 Housing Choice Voucher Program mandate: 1. Documentation • of eligibility (including citizenship/immigration status and income verification). 2. Signed lease agreements between the tenant and owner. 3. Rent reasonableness determinations for all units, 4. Hoμsing Quality Standards (HQS) inspections must be documented prior to lease-up and annually thereafter. 5. Recertifications (HUD-50058) and authorizations to release information (HUD-9886) must be on file. Condition - During testing of 22 participant files, we were unable to verify compliance with key program requirements due to missing documentation as detailed below: Deficiency Number of Files Affected Missing signed lease agreement Missing proof of citizenship/eligible immigration status 1 out of22 1 out of22 Cause - The Authority did not maintain adequate documentation in participant files. Effect - The absence of required documentation increases the risk of non-compliance with HUD regulations, which may result in findings during HUD reviews or audits and possible loss of HUD funding or sanctions if deficiencies are not corrected. Questioned Costs - Due to missing documentation, the allowability of housing assistance payments for the impacted participants cannot be determined. Repeat Finding - This is not a repeat finding. Statistical Sampling - The sample was not intended to be, and was not, a statistically valid sample. Recommendation - To address the deficiencies identified in the HCV Program tenant files, we recommend that the Authority implement comprehensive measures to strengthen compliance and improve internal controls. First, the Authority should conduct a full review of all tenant files to identify and resolve missing documentation, using a standardized checklist to ensure all required documents are included in each file.· Management's Response - (a) Comments on the finding and recommendation - The Authority agrees with the finding. The Authority also agrees with the recommendation. Please see below for action taken. (b) Action taken - The Authority will obtain the necessary documentation at the time of the next annual recertification.

Reporting Information of the federal program: Federal Grantor: U.S. Department of Health and Human Services Federal Cluster: None Assistance Listing No.: 93.912, Rural Health Care Services Outreach, Rural Health Network Development and Small Health Care Provider Quality Improvement Federal Award Numbers: G42RH50050 Federal Award Periods: September 1, 2023 through August 31, 2027 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under the Federal Funding Accountability and Transparency Act (FFATA), Public Law 109-282, as implemented in Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, recipients of grants or cooperative agreements who make first-tier subawards of $30,000 or more are required to register in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Subaward data, such as the subaward date, subawardee Unique Entity Identifier number, amount of subaward, subaward obligation/action date, date of report submission, and subaward number, are submitted through the FSRS and accessible to the general public through the USASpending.gov website. Reports are required to be submitted by the end of the month following the subaward date. Condition: During our testing of UPMC’s reporting, it was identified that two of the FFATA reports were not submitted within the timeframe designated by 2 CFR 170 Appendix A. (See the Notes to the SEFA for chart/table.) Furthermore, evidence of review and approval of the FFATA reports and Federal Financial Reports required to be reported under were not maintained. Cause: Policies and procedures and internal controls were in place but not consistently operating across the UPMC health system to ensure compliance with the reporting requirements under the Rural Health Care Services Outreach, Rural Health Network Development and Small Health Care Provider Quality Improvement (Assistance Listing No. 93.912). Effect or potential effect: The timing deficiency noted in the FFATA reporting process resulted in noncompliance with federal regulations. Furthermore, though it does not appear that inappropriate information was transmitted on the FFATA reports, this could occur if appropriate controls are not documented and functioning properly. Questioned costs: None. Context: Total subrecipient expenditures subject to FFATA reporting were $229,691 and total federal expenditures for Rural Health Care Services Outreach, Rural Health Network Development and Small Health Care Provider Quality Improvement (Assistance Listing No. 93.912) were $1,865,588 for the year ended December 31, 2025. Total federal expenditures for the year ended December 31, 2025, were $45,791,146. Identification as a repeat finding, if applicable: No. Recommendation: UPMC should ensure all control policies related to the reporting compliance processes are operating consistently across the UPMC health system and that evidence of each control is maintained. We recommend UPMC maintain a tracking log of subawards and FFATA reports to ensure they are submitted within the required timeframe. Views of responsible officials: Management concurs with this finding.

FFATA Reporting Information of the federal program: Federal Grantor: U.S. Department of Health and Human Services Federal Cluster: None Assistance Listing No.: 93.243, Substance Abuse and Mental Health Services Projects of Regional and National Significance Federal Award Number: H79SP083245 Federal Award Period: September 30, 2024, through September 29, 2029 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under the Federal Funding Accountability and Transparency Act (FFATA), Public Law 109-282, as implemented in Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, recipients of grants or cooperative agreements who make first-tier subawards of $30,000 or more are required to register in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Subaward data, such as the subaward date, subawardee Unique Entity Identifier number, amount of subaward, subaward obligation/action date, date of report submission, and subaward number, are submitted through the FSRS and accessible to the general public through the USASpending.gov website. Reports are required to be submitted by the end of the month following the subaward date. Condition: During our testing of UPMC’s reporting, it was identified that two of the FFATA reports were not submitted within the timeframe designated by 2 CFR 170 Appendix A. (See the Notes to the SEFA for chart/table.) Furthermore, evidence of review and approval of the FFATA reports and Federal Financial Reports required to be reported under were not maintained. Cause: Policies and procedures and internal controls were in place but not consistently operating across the UPMC health system to ensure compliance with the reporting requirements under the Substance Abuse and Mental Health Services Projects of Regional and National Significance (Assistance Listing No. 93.243). Effect or potential effect: The timing deficiency noted in the FFATA reporting process resulted in noncompliance with federal regulations. Questioned costs: None. Context: Total subrecipient expenditures subject to FFATA reporting were $263,959 and total federal expenditures for Substance Abuse and Mental Health Services Projects of Regional and National Significance (Assistance Listing No. 93.243) were $1,342,955 for the year ended December 31, 2025. Total federal expenditures for the year ended December 31, 2025, were $45,791,146. Identification as a repeat finding, if applicable: No. Recommendation: UPMC should ensure all control policies related to the reporting compliance processes are operating consistently across the UPMC health system and that evidence of each control is maintained. We recommend UPMC maintain a tracking log of subawards and FFATA reports to ensure they are submitted within the required timeframe. Views of responsible officials: Management concurs with this finding.

Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Special Programs for the Aging, Title III, Part C, Nutrition Services; Nutrition Services Incentive Program Assistance Listing Number: 93.045; 93.053 Federal Award Identification Number and Year: DA24-00030 (2024) Pass-Through Agency: City of Seattle Human Services Department Pass-Through Number(s): DA24-00030-A2 Award Period: January 1, 2024 through December 31, 2027 Type of Finding: Significant Deficiency in Internal Control over Compliance – Program Income Other Matters – Non-Compliance with Program Income Compliance Requirements Criteria or specific requirement: Per the OMB UG 2025 Compliance Supplement "program income is gross income earned by a non-federal entity that is directly generated by a supported activity or earned as a result of the federal award during the period of performance." Per 2 CFR 200.303(a), recipients of federal funding must establish, document, and maintain effective internal control over federal awards that provides reasonable assurance that federal awards are managed in compliance with applicable statutes, regulations, and the terms and conditions of the award. Program income should be accurately recorded and reported based on the underlying supporting documentation. Condition: During testing of program income, we identified one instance in which program income was not recorded in accordance with the underlying supporting documentation. Program income earned of $4.00 was recorded as $0.04 in the accounting records. Questioned costs: Questioned costs do not exceed the reportable threshold. Context: A sample of program income for the Lake Community Center Transit 35 Community Dining Project was recorded as $0.04. Testing of supporting documentation determined that actual program income earned totaled $4.00; however, due to a data-entry error, the amount was incorrectly recorded as $0.04. Although management performed review procedures over program income, the error was not identified prior to recording. Cause: The exception resulted from a manual data-entry error that was not identified through the review process prior to recording. Effect: Program income was not recorded in accordance with the underlying supporting documentation. The exception resulted in an understatement of program income of $3.96. While the amount of the exception was not material to the federal program and did not result in material noncompliance, the error was not identified through management's review procedures. Repeat Finding: No. Recommendation: Management should review its existing control structure and ensure that there are adequate processes and controls to ensure program income is recorded accurately for federal programs based on the underlying supporting documentation. Management should also continue to reinforce review procedures over program income reporting to help ensure recording errors are detected and corrected on a timely basis. Views of responsible officials and planned corrective actions: Please see the attached Management’s Corrective Action Plan.

Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Special Programs for the Aging, Title III, Part C, Nutrition Services; Nutrition Services Incentive Program Assistance Listing Number: 93.045; 93.053 Federal Award Identification Number and Year: DA24-00030 (2024) Pass-Through Agency: City of Seattle Human Services Department Pass-Through Number(s): DA24-00030-A2 Award Period: January 1, 2024 through December 31, 2027 Type of Finding: Significant Deficiency in Internal Control over Compliance – Activities Allowed or Unallowed Criteria or specific requirement: Per OMB UG 2 CFR §200.303(a) requires the non-Federal to establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Four of twenty-four Community Dining participants tested lacked sufficient evidence of staff review over the participant's eligible participation in the program services. No other deficiencies were identified in the remaining population of forty participants tested across the Meals on Wheels, Transportation, and Community Dining programs. Questioned costs: None identified. Identification of how questioned costs were computed: N/A If questioned costs are not determinable, description of why know questioned costs were undermined or otherwise could not be reported: Audit procedures did not identify any instances in which services were provided to ineligible participants. Accordingly, no questioned costs were identified. The finding relates to a deficiency in internal control over compliance rather than a known instance of noncompliance. Context: Testing was conducted to determine whether participants receiving services met program requirements and whether participant records contained sufficient evidence of review and support. A total of forty participants were selected for testing across the Meals on Wheels, Transportation, and Community Dining programs. Although all participants were deemed eligible to receive services, and therefore represent allowable activities under the programs, Four of twenty-four Community Dining participants tested lacked sufficient evidence of staff review over the participant's eligible participation in the program services. There were no other deficiencies noted across the total of forty samples tested. Cause: Management did not consistently perform or document its review of Community Dining participant records and participant tracking information. Effect: A lack of controls could result in services provided to ineligible participants, which would result in unallowable activities to the program. Fictitious individuals could be added to the program's client count that could result in an excess of program funding requested that does not reflect true participants served. Repeat Finding: No. Recommendation: Management should strengthen controls over Community Dining participant tracking to ensure participant records are reviewed and supported by appropriate documentation. Management should also implement monitoring procedures to verify that participant counts and listings are complete, accurate, and properly supported. Views of responsible officials and planned corrective actions: Please see the attached Management’s Corrective Action Plan.

Finding 2025-001, Level of Effort, Internal Control and Noncompliance Identification of the federal program Assistance listing number and title: 93.493 Congressional Directives Agency: U.S. Department of Health and Human Services Federal award identification number (FAIN): H79FG000996 Federal Award Year: 2024, 2025 Criteria or specific requirement (including statutory, regulatory or other citation) 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls would be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Notice of Award (NOA) lists a specific key personnel (also called a Project Director) at a 25% level of effort. In addition, the detailed budget and narrative justification for the award had listed two in-kind personnel (including the Project Director) as key positions each having a 25% level of effort. Furthermore, the NOA states that organizations receiving federal funds may not exceed 100% level of effort for any program staff member across all federally funded sources. Any changes to key personnel including level of effort involving separation from the project for more than three months or a 25% reduction in time dedicated to the project requires prior approval and must be submitted as a post-award amendment in Electronic Research Administration Commons system. Condition The documentation provided showed that the two in-kind key personnel did not meet the 25% level of effort during the year and no communications were made to the Federal agency relating to the unmet level of effort. Cause The System failed to implement controls over the monitoring of required level of effort. Effect or potential effect The key personnel level of effort required by the grant was not maintained and any changes in the said level of effort was not communicated to the Federal agency. Questioned costs None, as the key personnel’s salaries and benefits were not charged to the Federal grant in 2025. Context EY reviewed the NOA and related detailed budget and identified two (2) in-kind key personnel (including the Project Director) with a 25% level of effort. Supporting documentation such as timesheet tracking showed that the Project Director had only met 15.2% level of effort, while the other key personnel had only met 18.10% level of effort during the year. As a result, the required level of effort was not met. Per inquiry with management, there were no communications made to the Federal agency during the year relating to the change in key personnel level of effort. Identification as a repeat finding, if applicable This is a repeat finding – Finding 2023-002. Recommendation Management should improve internal controls to ensure that any level of effort listed in the grant award documents are met and any required communications to the Federal agency relating to changes in level of effort are made timely. In addition, management should also obtain written communications from the Federal awarding agency for any clarifications they have on the provisions of the grant award documents. Views of responsible officials Management did not fully document the level of effort for key personnel identified as Project Directors who were providing in-kind support to the grant program. Although this grant has ended, management recognizes the importance of maintaining adequate documentation and monitoring procedures for future grants. Management will update its grant policies and procedures to include specific requirements for tracking and documenting in-kind personnel time, as well as an approval and review process to ensure compliance with grant requirements.

Assistance Listing Number, Federal Agency, and Program Name: Assistance Listing Number 64.033, Department of Veteran Affairs, VA Supportive Services for Veteran Families Program Federal Award Identification Number and Year: 20-MI-221 Pass-through Entity – N/A Finding Type – Material weakness in internal control over compliance and material noncompliance Repeat Finding – Yes Criteria – Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, hereafter referred as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Grant and cooperative agreement recipients and contractors are required to register FSRS and report subaward data through FSRS. Compliance testing of the Transparency Act reporting requirements must include the following key data elements about the first-tier subrecipients and subawards under grants and cooperative agreements. Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – During our testing for reporting compliance, it was noted that the Organization did not submit the Federal Funding Accountability and Transparency Act report within the reporting timeline for prime grant recipients. Identification of How Questioned Costs Were Computed – N/A Questioned Costs – None Cause/Effect – The Organization’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2025. Subawards were not reported to FSRS in accordance with FFATA requirements. The Organization was required to report the subaward details above. The Organization was not required to report executive compensation. Recommendation – We recommend the Organization establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. View of Responsible Officials and Corrective Action Plan – The Agency agrees with this finding. As part of the subaward review process, the Chief Financial Officer will ensure that first tier subawards are checked to see if FFATA reporting is needed based on the award amount. If FFATA reporting is required, then the Chief Financial Officer will complete the reporting in the FFATA Reporting System FSRS.

Assistance Listing Number, Federal Agency, and Program Name: Assistance Listing Number 93.600, Department of Health and Human Services, Head Start Federal Award Identification Number and Year: 05CH011937-05-04 Pass-through Entity – N/A Finding Type – Material weakness in internal control over compliance and material noncompliance Repeat Finding – Yes Criteria – Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, hereafter referred as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Grant and cooperative agreement recipients and contractors are required to register FSRS and report subaward data through FSRS. Compliance testing of the Transparency Act reporting requirements must include the following key data elements about the first-tier subrecipients and subawards under grants and cooperative agreements.Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – During our testing for reporting compliance, it was noted that the Organization did not submit the Federal Funding Accountability and Transparency Act report within the reporting timeline for prime grant recipients. Identification of How Questioned Costs Were Computed – N/A Questioned Costs – None Cause/Effect – The Organization’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2025. Subawards were not reported to FSRS in accordance with FFATA requirements. The Organization was required to report the subaward details above. The Organization was not required to report executive compensation. Recommendation – We recommend the Organization establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. View of Responsible Officials and Corrective Action Plan – The Agency agrees with this finding. As part of the subaward review process, the Chief Financial Officer will ensure that first tier subawards are checked to see if FFATA reporting is needed based on the award amount. If FFATA reporting is required, then the Chief Financial Officer will complete the reporting in the FFATA Reporting System FSRS.

Corporation for National and Community Service Federal Financial Assistance Listing #94.012, 22BIICA001 10/1/2022 – 9/30/2025, 23BIACA001 10/1/2023 – 9/30/2026, 23BIFNY001 10/1/2023 – 9/30/2026 Americorps September 11th National Day of Service and Remembrance Grants Procurement, Suspension and Debarment Material Weakness in Internal Controls over Compliance and Noncompliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. The non-Federal entity’s documented procurement procedures must conform to the procurement standards identified in 2 CFR 200.318 through 200.327 which also requires documentation to be retained to detail the history of procurements. Condition: The Organization’s procurement policy is missing required provisions in accordance with 2 CFR 200.318. For each of the 3 vendors selected for testing there was no documentation retained to support the rationale for the method of procurement. Additionally, the Organization did not retain supporting documentation to substantiate whether consideration was taken whether the vendor was suspended or debarred from doing business with the federal government prior to entering the covered transaction for each of the 3 vendors selected for testing. Cause: There was a lapse in oversight of the internal control process ensuring documentation was retained supporting the Organization’s procurement, suspension and debarment process. Additionally, the Organization did not cross reference procurement policy with 2 CFR 200.318 through 200.327 ensuring minimum required provisions were included within. Effect: Without retaining documentation to support procurement, suspension and debarment rationale, demonstrating that the program complies with laws, regulations, and other compliance requirements is difficult. Questioned Costs: None reported based on assessment of comparative pricing readily available. Context/Sampling: A nonstatistical sample of 3 vendors out of 9 vendors were selected for testing. Repeat Finding from Prior Year: Yes, prior year finding 2024-003 Recommendation: We recommend management to review internal control procedures ensuring support is retained to substantiate procurement, suspension and debarment was considered prior to entering the transaction. We recommend management review 2 CFR 200.318 through 200.327 and revise the Organization’s procurement policy to include all minimum required provisions. Views of Responsible Officials: Management is in agreement.

Corporation for National and Community Service Federal Financial Assistance Listing #94.012, 22BIICA001 10/1/2022 – 9/30/2025, 23BIACA001 10/1/2023 – 9/30/2026, 23BIFNY001 10/1/2023 – 9/30/2026 Americorps September 11th National Day of Service and Remembrance Grants Reporting Material Weakness in Internal Controls over Compliance and Material Noncompliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. 2 CFR 200.328 and 2 CFR 200.329 require the auditee to collect financial information and monitor its activities under federal awards to assure compliance with applicable federal requirements and performance expectations are being achieved and report these items in accordance with the program requirements. 2 CFR Part 170 establishes requirements for recipients’ reporting of information on subawards as required by the Federal Funding Accountability and Transparency Act of 2006 (FFATA). Condition: Reporting of information on subawards as required by the Federal Funding Accountability and Transparency Act of 2006 (FFATA) was not completed for 3 of the subrecipients in which pass through funds exceeded $30,000 and 1 of the subrecipients in which pass through funds exceeded $30,000 was not filed timely. Cause: There was a misunderstanding with management over reporting requirements surrounding amounts passed through to subrecipients. Effect: Not having a clear understanding of FFATA reporting requirements lead to required information not being reported. Questioned Costs: None reported. Context/Sampling: There was a total of 9 federal financial reports, of which 3 were selected for testing. There were a total of 10 FFATA reports, of which 4 were selected for testing. Repeat Finding from Prior Year: Yes, prior year finding 2024-004. Recommendation: We recommend that management review procedures and control processes to ensure they comply with the federal requirements noted above. Views of Responsible Officials: Management is in agreement.

Corporation for National and Community Service Federal Financial Assistance Listing #94.012, 22BIICA001 10/1/2022 – 9/30/2025, 23BIACA001 10/1/2023 – 9/30/2026, 23BIFNY001 10/1/2023 – 9/30/2026 Americorps September 11th National Day of Service and Remembrance Grants Subrecipient Monitoring Material Weakness in Internal Controls over Compliance and Material Noncompliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. 2 CFR 200.332 identifies the requirements for all pass-through entities surrounding subrecipient monitoring and management. Condition: We noted the following during testing; a) Subawards did not contain minimum required elements in accordance with 2 CFR 200.332(b) b) The Organization did not consider all suggested elements when evaluating subgrantee’s fraud risk and risk of noncompliance with subaward in accordance with 2 CFR 200.332(c) c) Documentation could not be provided to substantiate whether suspension and debarment was considered prior to awarding the subgrant d) The Organization required the subgrantee to complete performance reports, however, did not require completion of a financial report in accordance with 2 CFR 200.332(e)(1) e) The Organization did not consider whether subgrantee was required to be audited and therefore did not review whether subgrantee had deficiencies reported over the federal program in accordance with 2 CFR 200.332(e)(2) through 2 CFR 200.332(e)(4) Cause: Management was not familiar with all subrecipient monitoring requirements as published under 2 CFR 200.332. The Organization adopted a subrecipient monitoring policy during quarter 4 of 2025. Effect: Without full understanding of subrecipient monitoring requirements under 2 CFR 200.332, demonstrating that the program complies with laws, regulations, and other compliance requirements is difficult. Questioned Costs: None reported. Context/Sampling: Seven out of thirty six subrecipients were reviewed for testing. Repeat Finding from Prior Year: Yes, prior year finding 2024-005. Recommendation: We recommend management to review subrecipient monitoring requirements as published under 2 CFR 200.332 and adopt a subrecipient monitoring policy. Views of Responsible Officials: Management is in agreement.

Federal Program, Assistance Listing # and Year, Federal Agency: COVID-19 - Coronavirus State & Local Fiscal Recovery Fund, Assistance Listing #21.027, 2021, U.S. Department of Treasury. Criteria or Specific Requirement: In accordance with 2 CFR 200.1, all recipients of federal funds must complete and submit annual project and expenditure reports on all SLFRF funded projects. Also, 2 CFR 200.303 requires the entity to establish and maintain effective internal controls over compliance with respect to federal awards and Section 1111(b)(2)(A) of the ESEA for compliance accountability. Proper internal controls require supporting documentation to be retained as evidence for effectiveness of the controls in place. In accordance with 2 CFR.307, program income earned during the period of performance must be used in accordance with the terms and conditions of the federal award. Condition: During our testing, CRI identified a lack of internal controls related to reviewing and approving report submissions. During our testing, CRI identified 2025 report submissions did not agree to cumulativeto- date expenditures of the fiscal years 2021-2025. During our testing, CRI identified revenue recognized/earned during the period was improperly reported as program income and expenditures were improperly included as program income expenditures, causing inaccurate reporting. Program income was materially overstated. Effect: The City of Shreveport risks reports required to be submitted to the U.S. Department of the Treasury to be materially misstated. Cause: A lack of adequate controls over reporting requirements. Questioned Costs: Not applicable to the reporting compliance requirement. Context: The issue was identified while testing the population of reports. Recommendation: We recommend the City implements proper controls to review reports submitted, so as to identify and address any discrepancies. Views of responsible officials and corrective action plan: The City does have sufficient internal controls over ARP reporting. Reports submitted matched the 2025 cumulative expenditures at the time that reporting was due. However, as is always the case with year-end invoices for the fourth quarter 2025 reporting period were processed after the report due date and updated on our internal ARP spending tracking. Because the Treasury Department does not have a process to amend report submissions, the amounts were included in the next period (1st quarter 2026) report.

Federal Program, Assistance Listing # and Year, Federal Agency: COVID-19 - Coronavirus State and Local Fiscal Recovery Fund, Assistance Listing #21.027, 2021, U.S. Department of Treasury. Criteria or Specific Requirement: 2 CFR 200.303 requires the entity to establish and maintain effective internal controls over compliance with respect to federal awards and Section 1111(b)(2)(A) of the ESEA for compliance accountability. Proper internal controls require supporting documentation to be retained as evidence for effectiveness of the controls in place. Also, 2 CFR 180 prohibits non-Federal entities from entering into covered transactions with suspended or debarred entities.’ Condition: The City failed to establish and maintain effective controls over suspension and debarment. The City failed to provide evidence the City verified vendor’s suspension and debarment status prior to procurement. Effect: The City of Shreveport risks not being in compliance with their federal funding procurement compliance requirements. Cause: Purchasing Department/Management failed to follow City Procurement Policy and Procedure when contracting vendors. Questioned Costs: None noted. Reported finding is a deficiency in internal control Context: The issue was identified in a sample of 3 contracts for the major program. Recommendation: We recommend the City follows their Procurement Policy when ensuring vendor status prior to contracting services. Views of responsible officials and corrective action plan: The Purchasing Agent will ensure that the contracted vendor(s) are not suspended or debarred using the data from SAM.GOV and Louisiana Secretary of State websites. The search results will be included in the files. This will ensure that the City of Shreveport is following the federal funding procurement requirements.

Internal Control over Compliance with Indirect Costs and Earmarking Requirements Federal Agency: U.S. Department of Housing and Urban Development Assistance Listing Number: 14.267 Federal Program Name: Continuum of Care Pass-through Entity: King County Regional Homelessness Authority Pass-through Award Numbers: WA0363L0T002307, WA0363L0T002408, WA0412D0T002305 Criteria: Under 2 CFR 200.303(a), the non-federal entity must establish and maintain effective internal control over compliance with the requirements of federal awards, including the calculation of allowable indirect costs and monitoring earmarking requirements. Condition: There was no documented review of the indirect cost calculations or earmarking for administrative costs on the award invoices tested. Cause and Context: During the year ended December 31, 2025, a single employee was tasked with preparing and submitting award invoices. Effect: Inadequate internal controls over requirements for indirect costs and earmarking may result in the Organization requesting reimbursement for disallowed costs. Questioned Costs: None. Recommendation: We recommend that management implement a formal review of award invoices before they are submitted to the grantor for reimbursement, including review of the indirect cost calculation and administrative cost tracking for earmarking requirements, and retains documentation of this review. Views of Responsible Officials: There is no disagreement with the finding.

FINDING 2025-003 Subject: Highway Planning and Construction - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Transportation Federal Program: Highway Planning and Construction Assistance Listings Number: 20.205 Federal Award Numbers and Years (or Other Identifying Numbers): DES 1400550, DES 1700788, DES 2100081 Pass-Through Entity: Indiana Department of Transportation Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Audit Findings: Material Weakness, Modified Opinion Condition and Context An effective internal control system was not designed nor implemented at the County in order to ensure compliance with requirements related to the grant agreement and the Activities Allowed or Unallowed and the Allowable Costs/Cost Principles compliance requirements. The County had not properly designed or implemented a system of internal controls that would be effective in preventing, or detecting and correcting, noncompliance to ensure that expenses reimbursed with Highway Planning and Construction monies were not charged to another federal grant. INDIANA STATE BOARD OF ACCOUNTS 18 FLOYD COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) The following instances of noncompliance were identified during the audit of project DES 1700788:  Duplicate Federal Funding (Double Dipping): Two of eight expenses sampled from the Highway Planning and Construction program were found to be originally charged to the COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (SLFRF) federal program (ALN 21.027) and subsequently submitted and received as reimbursement through the Highway Planning and Construction program. A further comprehensive review of Highway Planning and Construction funds reimbursed in 2025 revealed that $965,722 in expenditures originally charged to the SLFRF in 2024 was subsequently requested and received as a reimbursement through Highway Planning and Construction in 2025. Additionally, $17,000 in expenditures originally charged to the SLFRF in 2025 was subsequently requested and received as a reimbursement through Highway Planning and Construction in 2025.  Duplicate Project Reimbursement Requests: One check was included in two separate Highway Planning and Construction reimbursement claims, resulting in the County receiving duplicate payments for the exact same expenditure under the Highway Planning and Construction program in 2025. The lack of an effective internal control system was systemic throughout the audit period, while the identified noncompliance was specific to project DES 1700788. Total known questioned costs, resulting from the duplicate federal funding, equal $982,722. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: . . . (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. . . ." 2 CFR 200.405(c) states in part: "Any cost allocable to a particular Federal award under the principles provided for in this part may not be charged to other Federal awards . . ." 2 CFR 200.402 states: "The total cost of a Federal award is the sum of the allowable direct and allocable indirect costs minus any applicable credits." INDIANA STATE BOARD OF ACCOUNTS 19 FLOYD COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Cause The County did not establish, implement, and enforce a formal grant management and review process capable of cross-referencing ledger expenditures between different federal grants. Furthermore, the County lacked a tracking mechanism to flag individual vendor checks and invoices to prevent them from being submitted for reimbursement multiple times. Effect Without a proper system of internal controls in place that operated effectively, the County requested and received reimbursement for $982,722 from the Highway Planning and Construction program that had already been charged to the SLFRF federal program. Additionally, the County asked for reimbursement for the same check on two different reimbursement claims. Questioned Costs Questioned costs in the amount of $982,722 were identified as described in the Condition and Context. Recommendation We recommended that County management implement an effective internal control system and formal procedures to prevent duplicate reimbursement requests across different grant programs. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2025-004 Subject: Highway Planning and Construction - Procurement Federal Agency: Department of Transportation Federal Program: Highway Planning and Construction Assistance Listings Number: 20.205 Federal Award Numbers and Years (or Other Identifying Numbers): DES 1400550, DES 1700788, DES 2100081 Pass-Through Entity: Indiana Department of Transportation Compliance Requirement: Procurement and Suspension and Debarment Audit Finding: Material Weakness Condition and Context The County, acting as the Local Public Agency (LPA), did not maintain adequate internal controls over its procurement process for professional engineering and consulting contracts funded by the Highway Planning and Construction program. Specifically, for the consulting contracts reviewed during the audit period, the designated Employee in Responsible Charge was the sole individual documented as responsible for completing, reviewing, and submitting the LPA Selection Checklist to the Indiana Department of Transportation (INDOT). No secondary review, approval, or independent verification of the checklist or the required contract reporting items was documented or presented for audit. INDIANA STATE BOARD OF ACCOUNTS 20 FLOYD COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause No documentation was provided to ensure a proper internal control process that would include an independent oversight review or dual-signature sign-off on the LPA Selection Checklist prior to its submission to the INDOT. During the audit period, the County office responsible for the Highway Planning and Construction program experienced staff turnover, resulting in a breakdown of internal controls. Effect The lack of an effective internal control could lead to material noncompliance going undetected. This lack of documented internal controls constitutes a material weakness in internal control over compliance. Material noncompliance could lead to loss of federal funding for the County. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the County management establish an internal control system and formal procedures to ensure consulting contracts are properly procured and that the LPA Selection Checklist review is thoroughly documented. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2025-005 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Procurement and Suspension and Debarment Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): FY2021 Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion INDIANA STATE BOARD OF ACCOUNTS 21 FLOYD COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Condition and Context Procurement When the value of the procurement for property or services exceeds the simplified acquisition threshold (SAT), or a lower threshold established by a nonfederal entity, formal procurement methods are required. The SAT is typically set at $250,000. However, Indiana Code 5-22-8 has a more restrictive threshold; and, therefore, the threshold for the SAT is set at $150,000. Formal procurement methods require adherence to documented procedures and formal methods such as sealed bids or proposals. Two vendors were identified that fell within the SAT, with total purchases of $1,401,188. A review of the procurement files revealed that the County did not solicit, receive, or retain sealed bids or competitive proposals for these contracts. While the project awards were documented within the Board of County Commissioners' meeting minutes, the formal competitive process, public advertisements, and underlying evaluation metrics were completely absent from the record. Suspension and Debarment Prior to entering into subawards and covered transactions with the COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (SLFRF), recipients are required to verify that such contractors and subrecipients are not suspended, debarred, or otherwise excluded. "Covered transactions" include, but are not limited to, contracts for goods and services awarded under a nonprocurement transaction (i.e., grant agreement) that are expected to equal or exceed $25,000. The verification is to be done by checking the Excluded Parties List System (EPLS), collecting a certification from that person, or adding a clause or condition to the covered transaction with that person. The County's procedure to verify the vendor was not suspended or debarred was not always implemented or effective. A population of four covered transactions totaling $1,816,421 met or exceeded the $25,000 threshold and was paid using the SLFRF allocations. All four covered transactions were selected for testing, and the County failed to provide documentation to support that it performed any of the mandatory verification procedures prior to entering into the agreements or issuing payments to the contractors. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 22 FLOYD COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 200.320 states in part: "The non-Federal entity must have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award. . . . (b) Formal procurement methods. When the value of the procurement for property or services under a Federal financial assistance awards exceeds the SAT, or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with § 200.319 or paragraph (c) of this section. The following formal methods of procurement are used for procurement of property or services above the simplified acquisition threshold or a value below the simplified acquisition threshold the non-Federal entity determines to be appropriate: (1) Sealed bids. A procurement method in which bids are publicly solicited and a firm fixed-price contract (lump sum or unit price) is awarded to the responsible bidder whose bid, conforming with all the material terms and conditions of the invitation for bids, is the lowest in price. The sealed bids method is the preferred method for procuring construction, if the conditions. . . . (2) Proposals. A procurement method in which either a fixed price or cost-reimbursement type contract is awarded. Proposals are generally used when conditions are not appropriate for the use of sealed bids. They are awarded in accordance with the following requirements: . . ." 31 CFR 19.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the EPLS; or (b) Collecting a certification from that person if allowed by this rule; or (c) Adding a clause or condition to the covered transaction with that person." Cause A proper system of internal controls over procurement and suspension and debarment was not implemented by the management of the County to ensure that goods and services were properly procured and that vendors to whom payment equaled or exceeded $25,000 were not suspended or debarred. The County was unable to provide documentation to demonstrate they had properly procured and verified that contractors were neither suspended nor debarred, or otherwise excluded or disqualified, from participating in federal assistance programs or activities. INDIANA STATE BOARD OF ACCOUNTS 23 FLOYD COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. As a result, property and services were not properly procured and vendors to whom payments equal to or in excess of $25,000 were not verified to be not suspended, debarred, or otherwise excluded. Any program funds the County used to pay vendors that have been suspended or debarred would be unallowable, and the funding agency could potentially recover them. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the County. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the County establish a proper system of internal controls and develop procedures to ensure that property and services are properly procured and that contractors are not suspended, debarred, or otherwise excluded prior to entering into any contracts or subawards. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2025-006 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Reporting Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): FY2021 Compliance Requirement: Reporting Audit Findings: Material Weakness, Other Matters Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2024-004. Condition and Context Recipients are required to submit quarterly or annual Project and Expenditure (P&E) reports to the U.S. Department of the Treasury (Treasury). The reporting periods, as well as the respective due dates, are based upon type of recipient and its population, as well as the recipient's allocation amount. Information to be reported includes projects funded, expenditures, and contracts for the appropriate reporting period. The County was classified as a county with a population below 250,000 residents that are allocated more than $10 million in COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (SLFRF). As such, the P&E quarterly reports were to cover one calendar quarter and must be submitted to the Treasury by the last day of the month following the end of the period covered. INDIANA STATE BOARD OF ACCOUNTS 24 FLOYD COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) The County's current policy and procedures for complying with reporting requirements is to have the Director of Operations prepare the P&E reports with assistance from their Administrative Assistant and then the President of the Board of County Commissioners certifies the P&E reports. The current internal control has been determined to be ineffective since the P&E reports do not agree with the County's financial records. The County submitted four P&E reports during the audit period; however, the errors as identified below were noted on all four reports. Quarterly Report: October 1, 2024 to December 31, 2024  Current period obligations reported 3 projects with errors cumulatively totaling $271,203.  Current period expenditures reported 7 projects with errors cumulatively totaling $1,315,969.  Cumulative expenditures reported 23 projects with errors cumulatively totaling $2,261,478. Quarterly Report: January 1, 2025 to March 31, 2025  Current period expenditures reported 2 projects with errors cumulatively totaling $29,117.  Cumulative expenditures reported 24 projects with errors cumulatively totaling $2,233,551. Quarterly Report: April 1, 2025 to June 30, 2025  Current period expenditures reported 1 project with errors cumulatively totaling $439.  Cumulative expenditures reported 24 projects with errors cumulatively totaling $2,212,674. Quarterly Report: July 1, 2025 to September 30, 2025  Current period expenditures reported 3 projects with errors cumulatively totaling $21,693.  Cumulative expenditures reported 24 projects with errors cumulatively totaling $2,234,366. The lack of effective internal controls and noncompliance were systemic issues throughout the entire audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 25 FLOYD COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Compliance and Reporting Guidance, State and Local Fiscal Recovery Funds, page 13, states in part: ". . . 10. Reporting. All recipients of federal funds must complete financial, performance, and compliance reporting as required and outlined in Part 2 of this guidance. Expenditures may be reported on a cash or accrual basis, as long as the methodology is disclosed and consistently applied. Reporting must be consistent with the definition of expenditures pursuant to 2 CFR 200.1. Your organization should appropriately maintain accounting records for compiling and reporting accurate, compliant financial data, in accordance with appropriate accounting standards and principles. . . ." 31 CFR 35.4(c) states in part: "Reporting and requests for other information. During the period of performance, recipients shall provide to the Secretary periodic reports providing detailed accounting of the uses of funds, . . ." Cause The County's oversight process for filing the P&E reports did not detect errors. The errors were the result of including expenditures from the incorrect time periods. Effect Without the proper implementation of an effectively designed system of internal controls, including policies and procedures that provide segregation of duties and additional oversight as needed, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. As such, the County did not report current period obligations, current period expenditures, and cumulative expenditures properly when filing the P&E reports during the audit period. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the County. In addition, not meeting the SLFRF reporting requirements increases the likelihood that the public will not have access to transparent and accurate information regarding expenditures of federal awards. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the County strengthen its system of internal controls to provide for a segregation of duties in the preparation and review of federal reports to ensure appropriate reviews, approvals, and oversight are taking place. We also recommended the development of policies and procedures to ensure the County provides the Treasury with complete and accurate information for the P&E reports. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2025-007 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Subrecipient Monitoring Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): FY2021 Compliance Requirement: Subrecipient Monitoring Audit Findings: Material Weakness, Other Matters Condition and Context The County expended $1,810,837 in COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (SLFRF) during the audit period. Of that amount, $6,014 was passed through to one subrecipient. As a pass-through entity, the County was required to identify the award and applicable requirements and monitor the subrecipients. Procedures to monitor its subrecipients included reviewing the quarterly financial and performance reports as required by the County through the Subrecipient Agreements. No quarterly financial and performance reports were submitted to the County during the audit period. As part of the monitoring the County performed on subrecipients in prior audit periods, they noted subrecipients had been missing reports. Despite having received quarterly reports in prior audit periods, no quarterly reports were submitted for the current audit period. The lack of effective internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.332 states in part: "All pass-through entities must: . . . (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing the financial and performance reports required by the pass-through entity. . . ." INDIANA STATE BOARD OF ACCOUNTS 27 FLOYD COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Cause The County's agreements with the subrecipients included quarterly financial and performance reporting requirements, but no procedures were in place to ensure timely and appropriate reporting occurred. The County's oversight process for monitoring subrecipient financial and performance reporting for the audit period did not include adequate follow-up procedures to ensure that required reports were submitted. Subrecipients did not submit the quarterly reports as requested by the County. Effect Without the proper implementation of an effectively designed system of internal controls, including policies and procedures that provide segregation of duties and additional oversight as needed, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. The lack of sufficient internal controls resulted in the County receiving none of the required quarterly financial and performance reports from its subrecipients during the year. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the County strengthen its system of internal controls to ensure that subrecipients are submitting their financial and performance reports timely and accurately, so that the County can comply with the Subrecipient Monitoring compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Criteria: Federal program requirements require health centers administering a Sliding Fee Discount Program to maintain adequate documentation supporting patient eligibility determinations and the application of discounts. Eligibility determinations should be supported by appropriate and verifiable documentation and retained in accordance with established recordkeeping requirements. Furthermore, 2 CFR §200.303 requires recipients of federal awards to establish and maintain effective internal controls that provide reasonable assurance of compliance with federal statutes, regulations, and the terms and conditions of federal awards. Cause: Established controls did not adequately ensure that required supporting documentation was obtained and retained prior to the approval of Sliding Fee Discount Program applications. In addition, monitoring procedures were not sufficient to identify instances in which eligibility documentation was incomplete or missing. Effect: The Organization was not in compliance with federal regulations. Recommendation: The Organization should strengthen internal controls over the administration of the Sliding Fee Discount Program to ensure that all applications are supported by complete and verifiable eligibility documentation prior to approval. Procedures should also be implemented to ensure supporting documentation is consistently retained and periodically reviewed to verify compliance with program requirements and organizational policies. View of Responsible Officials: Management agrees with the finding and has prepared a corrective action plan.

Department of Veteran Affairs FFAL #64.033, 20-SD-136-25, 10/1/2024 – 12/31/2025 VA Supportive Services for Veteran Families Program Reporting Material Weakness in Internal Control over Compliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. 2 CFR 200.328 and 2 CFR 200.329 require the auditee to collect financial information and monitor its activities under federal awards to assure compliance with applicable federal requirements and performance expectations are being achieved and report these items in accordance with the program requirements. Condition: No review and approval processes were in place over 2 quarterly progress reports. Cause: Management did not have review procedures and processes in place over the quarterly progress reports until the quarter report ending June 30, 2025. Effect: Without review procedures and processes in place over reporting, demonstrating the program complies with laws, regulations, and other compliance requirements is difficult. Additionally, not having an oversight process over reporting could result in a reasonable possibility reports that are inaccurate or incomplete could be submitted. Questioned Costs: None reported Context/Sampling: Included under two award letters of the federal program, one annual financial report and 2 quarterly progress report were reviewed in the Organization’s fiscal year. In addition, two monthly HMIS reports were reviewed in the Organization’s fiscal year. There was a total of 16 reports filed. Repeat Finding from Prior Year: Yes, prior year finding 2024-003. Recommendation: Management implemented procedures and control processes to incorporate an independent review and approval over reporting effective for the quarterly progress report ending June 30, 2025. We recommend to continue following the implemented procedures and control processes and retain documentation to support the review was performed. Views of Responsible Officials: Management is in agreement.

Department of Veteran Affairs FFAL #64.033, 20-SD-136-25, 10/1/2024 – 12/31/2025 FFAL #64.033, 20-SD-136-26, 10/1/2025 – 9/30/2026 VA Supportive Services for Veteran Families Program Activities Allowed or Unallowed and Allowable Costs/Cost Principles Significant Deficiency in Internal Control over Compliance Criteria: The Center is required to have procedures in place to ensure that federal awards are expended only for allowable costs in accordance with Subpart E – Cost Principles of the Uniform Guidance. Allowable costs are supported by appropriate documentation and correctly charged as to account, amount, and period. 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. 2 CFR 200.430(g) establishes the standards for documentation of personnel expenses including charges to Federal awards for salaries and wages. Charges must be based on records that accurately reflect the work performed with the records meeting the following standards: a. Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. b. Be incorporated into the office records of the non-Federal entity. c. Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities. d. Encompass both federally assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity’s written policy. e. Comply with the established accounting policies and practices of the non-Federal entity. f. Support the distribution of the employee’s salary or wages among specific activities or cost objectives. g. Budget estimates alone do not qualify as support for charges to Federal awards, but may be used for interim accounting purposes. Condition: In our sample of expenditures selected for testing, we noted the following items: a) Calculation errors for payroll expenses allocated to the grant based upon review of supporting timesheets, payroll documentation and management’s true-up calculations to allocate actual costs rather than budgeted costs (5 instances). b) Identification of benefits not being allocated in a similar manner as salaries and wages (1 employee impacted). c) Grant was overcharged as it relates to a travel reimbursement (1 instance). Cause: Calculation errors were made during the year due to management’s true-up payroll calculation spreadsheet not being updated appropriately for employee payrate increases and including incorrect inputs based upon supporting payroll documentation. Additionally, management was unaware of the requirement of allocating payroll benefits in a similar manner to the allocation salaries and wages. In addition, individuals with key roles over financial and compliance reporting were not involved in the Organization’s financial and compliance reporting activities for the full year. Effect: The Organization’s controls did not detect or correct the errors identified, which results in a reasonable possibility that the Organization could submit disallowed costs under the federal awards and would not be able to detect and correct noncompliance in a timely manner. Questioned Costs: No questioned costs greater than $25,000. Context: A total non-statistical sample of 60 payroll and nonpayroll transactions out of more than 250 payroll and nonpayroll transactions were selected for testing, which accounted for approximately $73,700 of approximately $1,702,000 of direct payroll and nonpayroll program expenditures. Repeat Finding from Prior Year: No Recommendation: We recommend management review the procedures and control processes involving allocating payroll related expenses and ensuring expenses allocated to the grant are supported by documentation to ensure compliance with the federal grant. Views of Responsible Officials: Management is in agreement.

Department of Veteran Affairs FFAL #64.033, 20-SD-136-25, 10/1/2024 – 12/31/2025 FFAL #64.033, 20-SD-136-26, 10/1/2025 – 9/30/2026 VA Supportive Services for Veteran Families Program Procurement, Suspension & Debarment Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. 2 CFR 200.318 maintains that recipients must have and use documented procurement policies and must conform with procurement standards in sections 200.317 through 200.327. Additionally, 2 CFR 200.214 requires recipients to restrict making contracts with certain parties that are debarred, suspended, or excluded from participating in Federal awards. Condition: Testing of the federal program identified the following: a. The Organization’s formally documented procurement policy is missing one required element as it relates to domestic preferences (2 CFR 200.322). b. Two lease agreements were entered into where the Organization did not follow the procurement process as detailed in the procurement policy. The lease agreements with the vendors were also missing a required contract provision in accordance with Uniform Guidance and there was no review performed by the Organization to ensure the vendors were not suspended or debarred as the lease agreements with the vendors were over $25,000. Cause: Individuals with key roles over compliance reporting were not involved in the Organization’s compliance reporting activities for the full year. Contract provisions were not evaluated compared to Uniform Guidance contract requirements. Lease agreements entered into were not evaluated in accordance with Uniform Guidance as it relates to suspension and debarment. Effect: Ineffective controls over this area of compliance could result in a reasonable possibility the Organization would be noncompliant with the compliance requirements outlined above. Additionally, the Organization may enter into a covered transaction with a vendor that is suspended or debarred. Questioned Costs: None reported. Context/Sampling: A nonstatistical sample of 2 out of 4 vendors were selected for testing. Repeat Finding from Prior Year: No Recommendation: We recommend the Organization update their procurement policy to ensure it includes the required elements as it relates to domestic preference. In addition, we suggest that management implement procedures and control processes related to the review of contracts to ensure the procurement methods are being followed, documentation is being retained, and that the contracts include the required Uniform Guidance provisions. Also, management should ensure vendors are not suspended or debarred from doing business with the federal government. Views of Responsible Officials: Management agrees with the finding.

Finding 2025-004: Reporting and Internal Controls Identification of the Federal Program - US Department of Health and Human Services, 93.778 Grants to States for Medicaid Criteria - In accordance with 2 CFR 200.329(c)(1) recipients and subrecipients must submit performance reports as required by the Federal award. In accordance with 2 CFR 200.303(a) recipients and subrecipients of Federal Awards must establish, document, and maintain effective internal controls over the Federal award that provides reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Recipients and subrecipients of federal awards must maintain evidence that such internal controls were performed. Condition - The Organization was unable to provide sufficient and appropriate evidence that reports required under the federal program were reviewed and approved by appropriate personnel prior to submission to the granting agency. Additionally, the Organization was unable to provide sufficient and appropriate evidence that one out of five selected reports was prepared and submitted as required under the federal program. Cause - Due to a lack of formal documentation of current policies and procedures, the Organization did not maintain sufficient or appropriate evidence that reviews and approvals were performed for five of the five sampled reports. Due to a lack of formal policies and procedures, the Organization did not maintain sufficient or appropriate evidence that reports submitted through the Women & Minorities portal were prepared or submitted. Effect - Reports submitted to the granting agency may be incomplete or inaccurate. Questioned Costs – None Context - Management was unable to produce sufficient and appropriate evidence that five of the five reports selected for testing were reviewed and approved prior to submission to the granting agency. For one report selected, we noted the underlying data did not reconcile to the final report submitted to the granting agency. Additionally, for one report selected, the Organization was unable to provide sufficient and appropriate evidence that the report was prepared and submitted. Repeat Finding – No Recommendation - We recommend the Organization establish formal internal controls, and documentation of their performance, relating to the review and approval of reports by appropriate personnel who is knowledgeable of such reporting requirements. Additionally, we recommend the Organization develop internal controls relating to the documentation of reports submitted through the Women & Minorities portal. View of Responsible Officials - Management will formalize the review and approval process for required federal financial reports. Reports will be reviewed by appropriate personnel knowledgeable of grant requirements, and evidence of the review will be maintained.

Criteria: 2 CFR 200.303(a) requires non-federal entities to establish and maintain effective internal control over the federal award that provides reasonable assurance of compliance with federal statutes, regulations and the terms of the award. Under the PEMA-DAP-9 Request for Reimbursement, the Church certifies that the costs reported were incurred for eligible work, that the work was approved, and that it complied with the terms of the award. Condition: The Church submits reimbursement requests (Form PEMA-DAP-9) to PEMA. We tested 3 requests and agreed each to supporting invoices and to the related deposit. Each request was signed by the Church Treasurer, but there was no evidence that anyone other than the preparer reviewed and approved the request, before it was submitted. Cause: The Church has not established a formal procedure requiring independent review and approval of reimbursement requests prior to submission. Effect: Without an independent review, ineligible, unsupported, or incorrectly calculated costs could be certified to PEMA and FEMA and not be prevented or detected on a timely basis. We did not identify any noncompliance or questioned costs in the requests we tested. Questioned costs: None Recommendation: We recommend that the Church adopt a written procedure requiring a person independent of the preparer to review each reimbursement request and its supporting documentation before submission, and to document the review. Views of responsible officials: The Church agrees with the finding. Going forward, all reimbursement requests will be reviewed and approved by someone independent of the preparer, before submission.

Subrecipient Monitoring and Special Tests: Housing Quality Standards Federal Department – U.S. Department of Housing and Urban Development Federal Award Identification Number and Year: M17-DC170213 and 2017 M18-DC170213 and 2018 M21-DC170213 and 2021 M22-DC170213 and 2022 Home Investment Partnerships Program (HOME), Federal Assistance Listing #14.239 County Department – Department of Planning and Development (DPD) Finding 2025 – 001 CRITERIA Subrecipient Monitoring 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D—Post Federal Award Requirements Standards for Financial and Program Management, Section 200.303 Internal controls states, “the recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Section 200.332. Requirements for pass-through entities, requires that “A pass-through entity must: (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency)... (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must:(1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521.(4) Resolve audit findings specifically related to the subaward…. (g)Verify that a subrecipient is audited as required by subpart F of this part. (h) Consider whether the results of a subrecipient's audit, site visits, or other monitoring necessitate adjustments to the pass-through entity's records. (i) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 and in program regulations. DPD’s HOME Program Policies and Procedures Manual (updated January 2025), Monitoring Section (pages 114 to 129), under the Annual Monitoring Plan/Schedule Update, states the plan should identify the participating jurisdiction (PJ) monitoring goals and strategies, highlighting areas to which staff should pay special attention during the monitoring year. A specific schedule detailing annual, bi-annual, and tri-annual monitoring visits as required by HUD must be developed and maintained. To assure that adequate records are kept regarding each property and its compliance status, the monitor should establish a monitoring file for each property. The basic items in the file should include written agreement, written tenant selection criteria, property and unit inspections and results, etc. Also, HOME Program Compliance should conduct a risk assessment of its portfolio of the PJ’s HOME projects so that the highest risk projects can be identified and monitored first. In addition, HOME Program Compliance must conduct a desk review of all properties in the monitoring workload each year, as well as on-site reviews periodically, ranging from annually to every 3 years based on the number of units in property (i.e. 26 or more units require an annual review). Special Tests: Housing Quality Standards Per 24 CFR Section 92.209(i), Tenant-based rental assistance: Eligible costs and requirements, Housing Standards, states “The participating jurisdiction must require the housing occupied by a family receiving tenant-based rental assistance under this section to meet the participating jurisdiction's property standards under § 92.251. Initially and annually thereafter, the participating jurisdiction must determine the housing complies with its property standards and is decent, safe, sanitary, and in good repair in accordance with § 92.251(f). During the period of affordability (i.e., the period for which the nonfederal entity must maintain subsidized housing) for HOME assisted rental housing, the PJ must perform on-site inspections to determine compliance with property standards and verify the information submitted by the owners no less than (a) every three years for projects containing one to four units, (b) every two years for projects containing five to 25 units, and (c) every year for projects containing 26 or more units. CONDITION During the current audit period, the Cook County Department of Planning and Development (DPD) did not provide sufficient evidence to document annual monitoring performed, as well as performed the required inspections to ensure property standards were met, as required by Federal regulations and its internal policies. CAUSE Based on discussions with management, the cause of the findings occurred as a result of post pandemic allocations to the County which included several housing related fundings and initiatives, including Emergency Rental Assistance I & II (ERA I& II), Homeless Sheltering, Homeless and Transitional Sheltering Physical Site Acquisition and Development, HOME ARPA (HUD Allocation), and HOME, CDBG CV development delays that challenged the Housing teams provision of services and compliance requirement. While HUD had extended post pandemic compliance moratoriums into fiscal year 2024, Housing team hiring, training and implementation of compliance activities were unable to activate fully in the subject fiscal year to meet compliance. Additionally, for subrecipient monitoring of the HOME program, costs paid to developers were misclassified as subrecipient expenditures. The HOME program does not have contracts with subrecipients. EFFECT Failure to adequately monitor the activities and performance of subrecipients (and developers) could result in Federal awards being used for unauthorized purposes and DPD’s inability to adequately perform required risk assessments. Failure to perform the required inspections to ensure property standards were met is a violation of Federal regulations. QUESTIONED COSTS None. CONTEXT Subrecipient Monitoring During the current audit period, we noted a total of thirty-seven (37) projects were included on the Program Year 2024 (Fiscal Year 2025) HOME monitoring rental portfolio schedule provided, which required annual monitoring per DPD’s internal policies. Of the 37 projects, we noted three projects had some monitoring conducted during the period, which included some review of tenant files (for income verification/eligibility) and limited physical inspections of HOME units. No additional documentation was provided to verify compliance with federal regulations and the HOME Program Policies and Procedures Manual which required annual monitoring of each project (property). In addition, we noted approximately $7.3 million was reported on the SEFA as pass-through to two subrecipients under the program for the fiscal year ended November 30, 2025. Based on further discussions, DPD noted that these subrecipients are the two title companies used to pay the developers under the HOME program in accordance with its escrow agreement(s). We also reviewed a sample of these payments noting the supporting documentation referenced the developers as subrecipients. No documentation was provided to support compliance with subrecipient monitoring as required by 2 CFR Part 200.332. Special Tests: Housing Quality Standards We were provided with the same 37 projects reviewed under subrecipient monitoring to verify that DPD performed the required inspections to ensure that property standards were met. Based on our review, we noted the list included projects with HOME assisted units ranging from one (1) to 99 units, which would have required inspections every one to three years. However, the listing provided did not identify those units on which housing quality inspections were due. In addition, of the 37 projects, we were provided with documentary evidence to support only one (1) project whereby the required unit inspection reports were completed. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend DPD ensure procedures should be in place to ensure adequate documentation is maintained to support the evaluation of each subrecipient’s risk of noncompliance, as required by Federal regulations and internal policies. Also, documentation should be maintained to support that required inspections are performed to ensure that property standards are met, including identification of those units on which housing quality inspections are due, in accordance with 24 CFR 92.251(f). VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 42-43.

2025 – 006 Suspension and Debarment Federal Agency: U.S. Department of Transportation – Federal Railroad Administration Federal Program Name: Consolidated Rail Infrastructure and Safety Improvements Program Assistance Listing Number: 20.325 Federal Award Identification Number and Year: 69A36525421690CRSIL FY2023-2024 Pass-Through Agency: City of Springfield, Illinois Pass-Through Numbers: 69A36525421690CRSIL Award Period: May 1, 2025 through January 31, 2029 Type of Finding: • Significant Deficiency in Internal Control over Compliance AND Other Matter Criteria or Specific Requirement: Uniform Grant Guidance (2 CFR 200.303) requires non-federal entities receiving federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to verify vendors are not suspended or debarred by checking the SAM.gov exclusions list, obtaining a certification from the vendor, or including a clause or condition in the covered transaction with the vendor. Documentation evidencing such verification should be retained. Condition: The County did not retain documentation verifying vendors were not suspended or debarred prior to entering into covered transactions. Questioned Costs: None Context: The County lacked documentation of suspension and debarment verifications for 5 of 13 vendors tested. Cause: The County does not have a formal process in place to ensure vendors are not suspended or debarred prior to entering into covered transactions. Effect: Without documented verification of suspension and debarment status, there is an increased risk of contracting with excluded parties, which could result in noncompliance with federal requirements and potential repayment obligations. Repeat Finding: The finding is not a repeat of a finding in the prior year. Recommendation: We recommend the County design and implement internal controls to ensure proper verification and documentation of suspension and debarment status for vendors prior to entering into contracts or purchases that exceed the covered transaction threshold. Views of Responsible Officials: There is no disagreement with the audit finding.

2025 – 003 Period of Performance Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Low-Income Home Energy Assistance Program (LIHEAP) Assistance Listing Number: 93.568 Federal Award Identification Number and Year: G-2402LLIEA 10/1/2023 Pass-Through Agency: Illinois Department of Commerce and Economic Opportunity Pass-Through Numbers: 24-221038; 24-224038 Award Period: October 1, 2023 through August 31, 2025; June 1, 2024 through September 30, 2025 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or Specific Requirement: Uniform Grant Guidance (2 CFR 200.303) requires non-federal entities receiving federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure that costs charged to federal awards are reviewed and approved for compliance with the allowable period of performance and that documentation evidencing such review is retained. Condition: Although payroll transactions charged to the federal award were reviewed to verify they were incurred within the allowable period of performance, documentation evidencing such review was not retained. Questioned Costs: None Context: 9 of 9 payroll transactions tested lacked documentation of review and approval. Cause: The County does not have a formal process in place to ensure documentation of the review and approval of payroll transactions charged to the federal award is consistently retained. Effect: Without documentation of review and approval, there is an increased risk of unauthorized or inaccurate payroll charges being processed, which could result in noncompliance with federal requirements and potential repayment obligations. Repeat Finding: The finding is a partial repeat of a finding in the prior year. The prior year finding number was 2024-003. Recommendation: We recommend the County review and strengthen its internal controls to ensure that costs charged to federal awards are reviewed and approved for compliance with the allowable period of performance and that documentation evidencing such review is retained. Views of Responsible Officials: There is no disagreement with the audit finding.

2025 – 005 Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Low-Income Home Energy Assistance Program (LIHEAP) Assistance Listing Number: 93.568 Federal Award Identification Number and Year: G-2402LLIEA 10/1/2023 Pass-Through Agency: Illinois Department of Commerce and Economic Opportunity Pass-Through Numbers: 24-221038; 24-224038 Award Period: October 1, 2023 through August 31, 2025; June 1, 2024 through September 30, 2025 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or Specific Requirement: Uniform Grant Guidance (2 CFR 200.303) requires non-federal entities receiving federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure grant closeout report packages are reviewed and approved by all required department personnel prior to submission. Condition: There were instances in which grant closeout report packages were not reviewed and approved by all required department personnel prior to submission to the granting agency. Questioned Costs: None Context: 2 of 2 closeout report packages tested lacked documentation of review and approval by all required department personnel prior to submission. Cause: The County's current practice is for the required department personnel to review grant closeout report packages only after the State has approved them, rather than prior to submission. Effect: Without a proper pre-submission review of grant closeout report packages, there is an increased risk of inaccurate or incomplete reporting, which could result in noncompliance with federal requirements. Repeat Finding: The finding is not a repeat of a finding in the prior year. Recommendation: We recommend the County design and implement internal controls to ensure that the grant closeout report packages are reviewed and approved by all required department personnel prior to submission and that documentation evidencing such review is retained. Views of Responsible Officials: There is no disagreement with the audit finding.

2025 – 004 Cash Management Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Low-Income Home Energy Assistance Program (LIHEAP) Assistance Listing Number: 93.568 Federal Award Identification Number and Year: G-2402LLIEA 10/1/2023; 2502ILLIEI 10/1/2024 Pass-Through Agency: Illinois Department of Commerce and Economic Opportunity Pass-Through Numbers: 24-224038; 25-224038; 24-221038 Award Period: October 1, 2023 through August 31, 2025; October 1, 2024 through August 31, 2026; June 1, 2024 through September 30, 2025 Type of Finding: • Significant Deficiency in Internal Control over Compliance AND Other Matter Criteria or Specific Requirement: Uniform Grant Guidance (2 CFR 200.303) requires non-federal entities receiving federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure reimbursement requests reconcile to documentation of the underlying expenditures incurred and are also reviewed and approved prior to submission. Condition: There were instances in which reimbursement requests did not reconcile to documentation of the underlying expenditures incurred. In addition, reimbursement requests were not reviewed and approved prior to submission to the granting agency. Questioned Costs: None Context: 1 of 6 reimbursement requests tested did not have supporting documentation reconciling to the amount received. 6 of 6 reimbursement requests tested lacked documentation of review and approval prior to submission. Cause: Supporting documentation for reimbursement requests was not retained, in part due to employee turnover. Additionally, the County does not have a formal process in place to ensure documentation of the review and approval of reimbursement requests is consistently retained. Effect: Without proper supporting documentation and documented review, there is an increased risk of over- or under-reimbursement of federal awards, which could result in noncompliance with federal requirements and potential repayment obligations. Repeat Finding: The finding is a partial repeat of a finding in the prior year. The prior year finding number was 2024-004. Recommendation: We recommend that the County design and implement internal controls to ensure accounting records reconcile to reimbursement requests and that supporting documentation is retained. Reimbursement requests should be reviewed and approved by an individual other than the preparer prior to submission, and documentation evidencing such review should be retained. Views of Responsible Officials: There is no disagreement with the audit finding.

2025-101 Lack of Effective Internal Controls over the Application of the Sliding Fee Discount Schedule (repeated, prior year 2024-101) (initially reported 2014) Assistance Listing Number: 93.224 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program Compliance Requirement: Special Tests and Provisions – Sliding Fee Discounts Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2025 and 2024), H8K49674 (2024), H2E50094 (2024) and H8N53812 (2024). Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: The Organization lacks consistently applied processes and procedures related to the application of the sliding fee scale. The Organization’s current review process related to the sliding fee scale to identify errors quickly to allow for corrections to be made in a timely manner does not always detect all errors. This has been a systemic issue as a repeat finding in the prior years. The sample was not statistically valid. We also noted: • Sliding fee scales were not used for the agreement that the Organization has in place with the local school district in which they provide services to students. The agreement specifically does not allow the Organization to obtain information related to household size and income as needed to appropriately place the family on the sliding fee scale. The agreement also indicates no amounts can be collected from the students, except when that student has insurance which allows the Organization to bill the insurance company for a portion of the fees. • Sliding fee scales are not used in the disaster recovery bus program that does not charge the patients for services. • Eleven of the sixty encounters sampled where the sliding scale was used had the wrong sliding fee scale applied based on information obtained about the patient’s family size and income. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Health centers must prepare and apply a sliding fee discount schedule, so that the amounts owed for health center services by eligible patients are adjusted based on the patient's ability to pay (42 U.S.C 254b(k)(3)(G)(i)). The patient's ability to pay is based on the official poverty guidelines, as revised annually by the U.S. Department of Health and Human Services (42 U.S.C 9902(2)). Cause: Failure to apply the sliding fee correctly, as noted in eleven of the 60 encounters above, was due to improper staff training or failure to properly monitor the process. Failure to apply the sliding fee scales due to the requirements of the agreement with the local school district and procedures applied to the disaster recovery bus program do not follow the written procedures of the Organization for use of the sliding fee scale. Effect: The Organization could be incorrectly billing for services and maintaining customer account balances at incorrect amounts. Recommendation: Staff should be consistently trained in how patients should complete the intake forms, including the sliding fee scale application, and require patients complete the form appropriately, including refusal to provide information, if applicable. Staff should also be consistently trained in what documentation is considered sufficient to support income identified as well as verify the application is consistent with the documentation and, when needed, clearly document the reasons for inconsistency. Staff should make every effort to obtain documentation of patient income in accordance with internal policies and procedures. Patients should be billed the usual and customary billing rates for all services until all documentation is received, or policies are adjusted to allow for self-determination by patients in certain situations. A process should be put in place to track patients to attempt further collection of the necessary data that would allow for adjustment of the bill after the fact when necessary. These exceptions should be tracked each month with the monthly review by the regional operations managers. The reviews by the regional operations managers should be documented and retained including the results and corrective action of the follow-up on deficiencies noted. The Organization should discuss with HRSA what could be done to either adjust policies and procedures used during the school visits to be compliant or obtain a waiver from HRSA to indicate their knowledge and approval of the school visits and disaster bus program visits not being compliant with the application of the sliding fee scale requirements. Views of Responsible Officials and Planned Corrective Actions: The Organization has hired a new Chief Financial Officer and a new Revenue Cycle Manager. Sliding fee discount program training has been incorporated into onboarding for all new front desk employees. The billing department is adding a Patient Accounts Specialist who will monitor and review individual sliding fee determinations for accuracy and completeness and will conduct ongoing training with front desk staff as needed. Additionally, management will perform quarterly random sample testing of sliding fee determinations to verify that household size, income documentation, and discount tier were applied in accordance with the Organization's sliding fee discount policy. With respect to the school district agreement and the bus program, management will contact HRSA to request written guidance or a waiver confirming that the sliding fee discount schedule is not required to be applied to these programs. Management will also amend the Organization's sliding fee discount policies and procedures accordingly and will remove the word "disaster" from references to the bus program, as the program is not limited to disaster-related services.

Federal Agency: U.S. Department of Treasury Federal Program: COVID-19 Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: March 2021 through December 2026 Type of finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Condition: During our testing of the County's State and Local Fiscal Recovery Funds (SLFRF) Project and Expenditure Reports, we noted the reported amounts did not agree to the County's underlying accounting records and supporting documentation. The County did not have documented procedures requiring a reconciliation of reported expenditures to accounting records or documented review and approval of report prior to submission. Criteria or specific requirement: Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Effective internal controls should include that the grant report is reviewed and approved by someone other than the preparer prior to submission and that it ties to all underlying accounting records and documentation. Questioned costs: None Context: 3 of 3 SLFRF Project and Expenditure Reports tested lacked documentation of review and approval by someone other than the preparer. There were discrepancies between the expenditure reports submitted and underlying accounting records. Cause: The County lacked documented policies and procedures to ensure expenditures reported on SLFRF Project and Expenditure Reports were reconciled to supporting accounting records and reviewed for completeness and accuracy prior to submission. Effect: As a result, inaccurate information was submitted to the grantor. Repeat finding: No Recommendation: We recommend the County establish and document procedures for preparing, reviewing, and approving reports prior to submission. Review procedures should include reconciliation of reported expenditures to supporting accounting records and documentation. Views of responsible officials and planned corrective actions: The County agrees with this finding and will implement procedures requiring management review and approval of SLFRF reports prior to submission. Reported amounts will be reconciled to supporting records and documentation before filing.

Federal Agency: U.S Department of Health and Human Services Federal Program Name: Health Center Program Cluster Assistance Listing Number: 93.224 and 93.527 Award Period: 03/01/24-02/28/27 Federal Program Name: Congressionally Directed Spending for Construction Projects Assistance Listing Number: 93.493 Award Period: 09/03/23-09/29/26 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303 requires that recipients and subrecipients receiving federal awards establish, document and maintain effective internal control over the federal awards that provides reasonable assurance that the recipient or subrecipient is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition: There is no formal process in place to review required reports prior to submission. Context: During our audit inquiries related to internal control, it was noted that the Organization is not practicing a key control of their internal control structure by reviewing reports prior to submission to the relevant granting authority. Cause: Following recent staff turnover, an internal policy was not maintained and/or adhered to. Effect: Potentially submitted reports may contain errors or provide misinformation. Recommendation: We recommend the organization review all required reports for accuracy prior to submission. Views of responsible officials: There is no disagreement with the audit finding.

Information of the Federal Program: Assistance Listing Number 10.565—Commodity Supplemental Food Program, U.S. Department of Agriculture Pass-Through Entity and Award Number: Minnesota Department of Health, award number 204642. Compliance Requirement: Eligibility Type of Finding: Significant deficiency in internal control over compliance Criteria: 2 CFR 200.303 of Subpart D, "Post Federal Award Requirements Standards for Financial and Program Management," of the Uniform Guidance requires a recipient to establish, document and maintain effective internal control over the federal award that provides reasonable assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award, including eligibility. Condition: We requested eligibility forms for forty participants to review for the signature of site partner personnel indicating review of eligibility information on the form. One of the forty forms were unable to be located upon request. Eligibility information is input in ClientTrack software and the form should also be uploaded. Cause: Signed enrollment forms were not properly scanned into Sharepoint and had likely been disposed of. The signatures on these forms indicated the review by an agency partner that information included on the form is correct. Effect or Potential Effect: An ineligible individual could receive a CSFP box. Questioned Costs: None Context: Signed enrollment forms were not available for one of forty participants selected. Repeat Finding: yes, 2024-001 Recommendation: We recommend that Second Harvest Heartland digitalize their CSFP enrollment forms for convenient access and provide review of the electronically filed form prior to disposal of the paper form. Views of Responsible Officials: Agree.

Information on the Federal Program: Assistance Listing Number 10.565—Commodity Supplemental Food Program, U.S. Department of Agriculture Pass-Through Entities and Award Numbers: Minnesota Department of Health, award number 204642. Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs and Cost Principles Type of Finding: Significant deficiency in internal control over compliance Criteria: 2 CFR 200.303 of Subpart D, "Post Federal Award Requirements Standards for Financial and Program Management," of the Uniform Guidance requires a recipient to establish, document and maintain effective internal control over the federal award that provides reasonable assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award, including Activities Allowed or Unallowed and Allowable Costs and Cost Principles. Condition: Processes and procedures in place to review and submit administrative expenditures did not include a thorough enough review process to agree information to source data. Cause: Expenditures were reviewed before submission, however the review of this information was inadequate as it did not corroborate totals with the source data. Effect or Potential Effect: The Organization could have received reimbursement in excess of incurred expenses. Questioned Costs: None Context: One of the months selected for detail testing was found to have an erroneous submission using the wrong month’s expenditures. However, because the Organization incurred significantly more expenses than for which it was reimbursed during the year, the erroneously reported expenses had not been reimbursed by the funder. Repeat Finding: No Recommendation: We recommend that Second Harvest Heartland review the source data for all future expense reports. Views of Responsible Officials: Agree.

Department of Health and Human Services Temporary Assistance for Needy Families, Passed through Ramsey County, Federal Financial Assistance Listing 93.558, FAST X award 2201MNTANF for the year ending 12/31/2024 Activities Allowed or Unallowed and Allowable Costs/Cost Principles Significant Deficiency in Internal Control over Compliance Criteria: CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Goodwill-Easter Seals Minnesota’s internal control structure should be designed to properly follow the allocation policy for employees’ pay to each grant in accordance with the policy established by Goodwill-Easter Seals Minnesota. Condition: Goodwill-Easter Seals Minnesota has an internal control system designed to detect or prevent improper allocation of employees’ pay to grants in a timely manner in accordance with their established policy, however, during the year for one pay period tested, an error was identified in the process but was not fully corrected. Cause: Goodwill-Easter Seals Minnesota has a process for allocating employee wages based on hours worked. The controls in place did not operate as designed and failed to fully correct an error in the allocation of employee pay to the grant. Effect: One employee had some of their pay allocated improperly and not in accordance with the policy established. Questioned Costs: None reported. Context/Sampling: A nonstatistical sample of eight pay periods out of 26 were selected for testing which accounted for $383,866 of $2,284,613 of federal program expenditures. Repeat Finding from Prior Year: Yes Recommendation: We recommend that management develop a more extensive review over payroll allocation to ensure pay is properly allocated to each grant in accordance with the policy established by Goodwill-Easter Seals Minnesota. Views of Responsible Officials: Management agrees with this finding.

Department of Health and Human Services Temporary Assistance for Needy Families, Passed through Ramsey County, Federal Financial Assistance Listing 93.558, MFIP award 2201MNTANF for the year ending 12/31/2025 Activities Allowed or Unallowed and Allowable Costs/Cost Principles Significant Deficiency in Internal Control over Compliance Criteria: CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Goodwill-Easter Seals Minnesota’s internal control structure should be designed to properly follow the allocation policy for employees’ pay to each grant in accordance with the policy established by Goodwill-Easter Seals Minnesota. Condition: Goodwill-Easter Seals Minnesota has an internal control system designed to detect or prevent improper allocation of employees’ pay to grants in a timely manner in accordance with their established policy, however, during the year for five pay periods tested, Goodwill-Easter Seals Minnesota failed to identify that one employee’s timecard had incorrectly allocated time to a grant that ended. However, the time was corrected before submission to the grant, but it was not changed on the timecard. Cause: Goodwill-Easter Seals Minnesota has a process for approving timecards which include program codes for allocation to awards. The controls in place did not operate as designed and failed to fully correct an error in five timecards of an employee’s pay to the grant. Effect: One employee had the incorrect program code listed on the approved timecard for five pay periods tested. Questioned Costs: None reported. Context/Sampling: A nonstatistical sample of eight pay periods out of 26 were selected for testing which accounted for $383,866 of $2,284,613 of federal program expenditures. Repeat Finding from Prior Year: Yes Recommendation: We recommend that management develop a more extensive review over timecards to ensure pay is properly allocated to each grant in accordance with the policy established by Goodwill-Easter Seals Minnesota. Views of Responsible Officials: Management agrees with this finding.