Findings Citing § 200.303

Criteria or Specific Requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non- Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - Per 34 CFR 690.83(b)(2), the College is required to report the disbursement dates and amounts awarded for Pell awards to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell funds to a student. Condition: The College did not report certain Pell disbursements within 15 days to COD. Questioned costs: None Context: For 1 of the 18 Pell disbursements tested across a sample of 32 students receiving Pell awards, the College did not report a disbursement within the 15 day requirement. Cause: The Pell grant was awarded after the fall semester had ended, so the College waited to make sure the student was enrolled for the spring semester before applying it. Effect: The College is not in compliance with required reporting to the Department of Education. Repeat Finding: No. Recommendation: We recommend the College ensure that a process is in place to report within 15 days, including a process to respond and report timely when there are student irregularities. Views of Responsible Officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non- Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance: 1. The Code of Federal Regulations, 34 CFR 685.309(b) and the NSLDS Enrollment Reporting Guide, states that: 􀁸 Colleges must have some arrangement to report student enrollment data to the National Student Loan Data System (NSLDS) through an enrollment roster file. The college is required to report changes in the students’ enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that college must report accurately the enrollment status of all students regardless if they receive aid from the institution or not. 􀁸 Colleges must have some arrangement to report student program enrollment effective date and status to NSLDS. 2. Per Section 4.4.8 of the NSLDS Enrollment Reporting Guide, the program begin date is the date the student first began attending the program being reported. Typically, this would be the first day of the term in which the student began enrollment in the program. Condition: During testing of the enrollment reporting, we identified the following errors: 􀁸 The change in status was not reported at the program level. 􀁸 The program begin date reported to NSLDS does not match the program begin date per the college’s records. Questioned costs: None Context: This condition occurred for the following: 1. The enrollment status was not reported for 3 out of 60 students. 2. The program begin date was incorrectly reported for 6 out of 60 students Cause: The college was having issues with archives not allowing the National Student Clearing house (NSC) reports to run out of colleague. The decision was made to do a mass purging of the archive file in 2023 to eliminate the issue. Months later it was realized that doing this affected the Program start date. This purging of the archives also caused transmission issues between the NSC and NSLDS which resulted in the student’s program status not being changed. Effect: Student enrollment status and program begin date was not reported accurately to NSLDS. Repeat Finding: No. Recommendation: The College should evaluate their procedures and policies related to reporting status changes and program begin dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of Responsible Officials: There is no disagreement with the audit finding.

SA 2025-002: Develop Written Policies and Procedures Assistance Listing Number: 20.509 Federal Program/Cluster Name: Formula Grants for Rural Areas and Tribal Transit Federal Agency: U.S. Department of Transportation – Federal Transit Administration Federal Award Number: 64BA24-02507/64CA17-02442/64HC22-02180/64RO21-01648/64TO21-01865/64MO21-01910/64HC21-01500 Federal Award Year: July 1, 2024 to June 30, 2025 Compliance Requirement Others Criteria 2 CFR 200.303 requires nonfederal entities to establish and maintain effective internal control over federal awards to provide reasonable assurance that organizations who manage the federal award: • Understand and comply with the federal statutes, regulations, and terms and conditions of the award; • Evaluate and monitor compliance; • Take prompt action when instances of noncompliance is identified. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States, or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, the Uniform Guidance requires non-federal entities to develop written procedures related to the following areas: 1. Cash Management 2 CFR 200.302(b)(6) states that the financial management system of each non-Federal entity must provide for the written procedures to implement the requirements of 2 CFR 200.305 Federal Payment. 2. Equipment Management Requirements Non-federal entities other than states must follow 2 CFR sections 200.313(c) through (e). Condition MARTA does not have comprehensive written policies and procedures concerning the following key compliance areas which are required by the Uniform Guidance: Cash Management MARTA does not have written procedures to implement the requirements of 2 CFR 200.305 Federal Payment. Equipment and Real Property Management MARTA has an Asset Inventory Policy and Procedures, however, it does not clearly define the policies and procedures that are in place for the use, management and disposition of equipment acquired under a Federal award in accordance with 2 CFR sections 200.313(c) through (e). Cause MARTA’s reliance on informal business practices leads to inconsistencies in its internal controls. Effect The absence of formal policies and procedures in the key compliance areas could result in non-compliance with federal regulations, which may lead to unnecessary sanctions. Additionally, without formal written policies and procedures, it is difficult to ensure consistent practices across the organization. Questioned Costs None Repeat Findings Yes, see the Summary Schedule of Prior Year Audit Findings, SA 2024‑001. The Cash Management and Equipment and Real Property Management policies have not been updated since last year’s audit. Recommendation MARTA should develop and implement formal written policies and procedures for the specific areas required by the Uniform Guidance. These policies and procedures must clearly delineate the requirements of Uniform Guidance. Personnel responsible for these areas should receive adequate training and apply the policies effectively. Regular reviews should be conducted to update the policies and procedures as needed. Views of Responsible Officials and Planned Corrective Action MARTA has grown substantially in the last several years. This progress includes identifying areas that need to be updated or developing new processes and documentation. MARTA has an Asset Inventory Policy and Procedures in which the purpose is to ensure that fixed assets are properly accounted for, identified, and tracked. MARTA also has Cash Handling Policy and Procedures which addresses safeguarding public funds and maximizing the available resources. This is designed to reduce the risks associated with the collection, receipts storage and reporting of cash transactions and to safeguard and maintain the security and integrity of MARTA's fiscal assets. MARTA will review and update these policies and/or create new policies to make sure that they are compliant with the Uniform Guidance. Personnel responsible: Sandy Benson, General Manager Anticipated completion date: October 2026

2025-001 Finding - Federal Award Type: Matching, Level of Effort, Earmarking - Significant Deficiency in Internal Control over Compliance. Criteria / Requirement: 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish, document, and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Earmarking includes requirements that specify the minimum and/or maximum amount or percentage of the program’s funding that must/may be used for specific activities, including funds provided to subrecipients. Per the grant agreement, grantee may use up to ten percent of the total amount of grant funds awarded for the youth and adult activities for grant’s administrative costs, as allowed under the federal regulations governing these programs. Condition / Context: During the year June 30, 2025, WSI was tracking administrative cost by fund, but inadvertently had coded program expenses into the administrative fund. This error was corrected and WSI is in compliance with the earmarking requirement, however it was noted that WSI did not have a process to monitor and ensure that they were under the maximum earmark percentage allowed. Cause: WSI was aware of the requirement and has an established system to track costs but did not have procedures in place to monitor the earmarking requirement of the maximum percentage of administrative costs allowed. Effect: Failure to maintain sufficient internal controls and proper procedures may result in wrongful use of federal funds and non-compliance with federal awards. Questioned Costs: None. Recommendation: The Organization should establish written policies and procedures regarding monitoring of the maximum earmark percentage allowed. Management’s Response: Management concurs with the finding and has developed a report to monitor WIOA administrative expenditures to ensure compliance with applicable earmarking requirements. The corrective action has been implemented prior to this report and has been incorporated into the monthly close process.

Federal Agency: U.S. Environmental Protection Agency Program Name: Greenhouse Gas Reduction Fund: Solar For All ALN: 66.959 Award Numbers: 84090501, Federal Award Year 2024 - 2025 Questioned Costs: None 2025-001: Finding: Internal Controls over Allowable Costs/Activities The Illinois Finance Authority (Authority) had weaknesses in its internal controls over reviews of allowable costs and activities. Condition: Out of the 13 payroll transactions and 4 indirect cost transactions tested for allowable activities and costs, we were unable to obtain documentation to support that controls were in place to review for allowable activities and costs prior to applying to the grant for all (100%) of the transactions. The sample was not intended to be, and was not, a statistically valid sample. Criteria: Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Cause: Authority officials indicated this issue was due to the size of the Authority, there was a lack of segregation of duties or documentation to support reviews. Effect: Without a proper internal control system to support reviews performed over allowable costs and activities, the Authority risks submitting unallowable costs, which could result in a loss of future funding. (Finding Code No. 2025-001) Recommendation: We recommend the Authority develop and document controls for ensuring expenditures applied to the grant are allowable. Authority’s Response: The Authority accepts single audit finding 2025-001 Internal Controls over Allowable Costs/Activities. The Authority has implemented a process and related internal controls and appropriate segregation of duties to ensure Authority financial transactions (i.e., expenditures applied to corresponding grants are allowable; month-end financial entries; etc.) are appropriately prepared, reviewed, authorized, and recorded.

2025-003 (2023-002) – INACCURATE SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS Type of Finding: (F) Significant Deficiency in Internal Control Over Compliance of Federal Awards Funding Agency: All (see Schedule of Expenditures of Federal Awards) Title: All (see Schedule of Expenditures of Federal Awards) AL #: All (see Schedule of Expenditures of Federal Awards) Award #: All (see Schedule of Expenditures of Federal Awards) Award Period: All (see Schedule of Expenditures of Federal Awards) Questioned Costs: None Statement of Condition The Schedule of Expenditures of Federal Awards (SEFA) was provided timely to the auditors; however, several adjustments were identified during the audit process: • The SEFA incorrectly included match expenditures, requiring an reduction to the federal expenses of $324,936. Without accurate recording of federal award expenditures, auditors cannot appropriately assess and select federal programs for testing as mandated by the Single Audit Act. Management’s Progress Toward Prior Year Corrective Action Plan: The County has made progress toward addressing the prior year’s SEFA accuracy finding; however, additional corrections remain necessary, as noted above. Criteria 2 CFR § 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program requirements. Good internal control practices require the entity to have documented procedures for: • Properly identifying federal, state, and other funding sources. • Classifying expenditures accurately under the correct federal assistance listing numbers. • Ensuring expenditures reported on the SEFA are accurate and presented according to requirements. Additionally, 2 CFR 200.510(b) mandates the preparation of an accurate and complete SEFA for the audit period, including federal expenditures as determined in accordance with 2 CFR 200.502. Cause The County did not have comprehensive controls to ensure that all federal expenditures are correctly tracked, accurately classified, and properly reported on the SEFA. Effect Without accurate, timely tracking and reporting of federal expenditures, the County is at risk of improperly accounting for federal awards, potentially leading to noncompliance, questioned costs, or repayment obligations. Recommendation We recommend that the County establish, document, and implement a comprehensive internal control structure specifically designed to: • Clearly identify, track, and report grant expenditures. • Accurately distinguish between federal and non-federal expenditures. • Prepare and review the SEFA regularly to ensure completeness, accuracy, and compliance with the Uniform Guidance (2 CFR 200.502 and .510) accrual-basis requirements.

Finding Number: 2025‐001 Repeat Finding: No Program Name/Assistance Listing Title: Education Stabilization Fund Assistance Listing Number: 84.425 Federal Agency: U.S. Department of Education Federal Award Number: S425U210038 Pass‐Through Agency: Arizona Department of Education Questioned Costs: $231,730 Type of Finding: Noncompliance, Material Weakness Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Criteria Management is responsible for establishing and maintaining internal controls over its accounting records. Additionally, 2 CFR 200.303 requires the District establish and maintain internal control over the federal awards that provides reasonable assurance that the District is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Districts must submit expenditure support through the Arizona Department of Education’s (ADE) Grants Management Enterprise system for ADE to review and approve grant reimbursements. Districts must perform grant close out procedures. Condition The ESSER III Set Aside grant had a positive ending balance at year end. However, the grant should have been closed out as of 12/31/24. Cause The District's internal controls over grant close out and reporting procedures did not detect an error. Effect The District is at risk for making unallowable expenditures. The District was required to revert the unallowable funds to the grantor. Context Duplicate invoices were submitted to ADE for reimbursement, resulting in an overpayment of $231,730. In addition, the District requested and was reimbursed $28,019 in indirect costs, however, that money was not moved into the indirect cost fund until after audit procedures were performed. The sample was not intended to be, and was not, a statistically valid sample. Recommendation The District should strengthen existing internal controls over grant reporting to enhance procedures that reduce the risk of unallowable expenditures. Specifically, procedures should be in place to prevent expenditures from being submitted more than once for reimbursement. Views of Responsible Officials See Corrective Action Plan.

FA 2025-001 Strengthen Controls over Employee Compensation Compliance Requirement: Allowable Costs/Cost Principles Internal Control Impact: Significant Deficiency Compliance Impact: Nonmaterial Noncompliance Federal Awarding Agency: U.S. Department of Education Pass-Through Entity: Georgia Department of Education AL Numbers and Titles: 84.027 – Special Education Grants to States 84.173 – Special Education Preschool Grants Federal Award Numbers: H027A230073 (Year: 2024), H027A240073 (Year: 2025), H173A240081 (Year: 2025) Questioned Costs: $1,283 Description: The policies and procedures of the School District were insufficient to provide adequate internal controls over the employee compensation process as it relates to the Special Education Cluster. Background: The Special Education Cluster (SEC), which is comprised of the Special Education Grants to States (IDEA, Part B) and Special Education Preschool Grants (IDEA Preschool) programs, was authorized under the Individuals with Disabilities Education Act (IDEA). Special Education Cluster funding is available to ensure that all children with disabilities have available to them a free appropriate public education that emphasizes special education and related services designed to meet their unique needs and prepares them for further education, employment, and independent living; ensure that the rights of children with disabilities and their parents are protected; assist states, localities, educational service agencies, and federal agencies to provide for the education of all children with disabilities; and assess and ensure the effectiveness of efforts to educate children with disabilities. SEC funding was granted to the Georgia Department of Education (GaDOE) by the U.S. Department of Education (ED). GaDOE is responsible for distributing funds to LEAs and overseeing the expenditure of funds by LEAs. SEC funds totaling $2,769,220.76 were expended and reported on the Lowndes County Board of Education’s Schedule of Expenditures of Federal Awards (SEFA) for fiscal year 2025. Criteria: As a recipient of federal awards, the School District is required to establish, document, and maintain effective internal control over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Section 200.303 – Internal Controls. Additionally, provisions included in the Uniform Guidance, Section 200.403 – Factors Affecting Allowability of Costs state that “costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles, (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items, (c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient… (g) Be adequately documented…” Furthermore, provisions included in the Uniform Guidance, Section 200.430 – Compensation-Personal Services prescribe standards for documentation of personnel expenses and state, in part, that “(a) … Costs of compensation are allowable to the extent that they satisfy… specific requirements…, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the recipient or subrecipient consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with recipient’s or subrecipient’s laws, rules, or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (g)…, [as follows:] (g) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the recipient or subrecipient…” Condition: A sample of 16 employees was randomly selected for testing using a non-statistical sampling approach. These employees were reviewed to determine if internal controls were properly functioning, and applicable compliance requirements were met. The following deficiencies were noted: • For two employees, the amount paid did not agree to supporting documentation and resulted in underpayments totaling $4,378. • For one employee, the amount paid did not agree to board-approved salary scales and resulted in the overpayment of salary and benefit amounts by a total of $1,283. Questioned Costs: Upon testing a sample of $195,182 in personnel services expenditures, known questioned costs of $1,283 were identified for payroll charges exceeding documented federal program activities, including $743 in salaries and $540 in associated benefits. Using the total personnel services expenditure population of $1,806,992 (excluding benefits payments), we project the likely questioned costs to be approximately $6,882. Cause: The identified variances resulted from isolated payroll processing errors during position changes and pay scale updates for specific positions resulting in data-entry and reconciliation discrepancies. Effect: The School District is not in compliance with the Uniform Guidance and GaDOE guidance. Failure to pay employees associated with Special Education Cluster the appropriate amount and/or maintain documentation supporting these payments could result in the expenditure of funds for unallowable purposes. This may also expose the School District to unnecessary financial strains and shortages within the Special Education Cluster fund as ED or GaDOE may require the School District to return funds associated with unallowable or improperly documented expenditures. Recommendation: The School District should evaluate their internal control processes related to the documentation and review of employee compensation payments. Where vulnerable, the School District should develop and/or modify its policies and procedures to ensure that Special Education Cluster employees are paid appropriately. Furthermore, management should develop and implement a monitoring process to ensure that these procedures are functioning properly. Views of Responsible Officials: We concur with this finding.

Assistance Listing Number, Federal Agency, and Program Name 10.558, U.S. Department of Agriculture, Child and Adult Care Food Program Federal Award Identification Number and Year 0010284 (2024) Pass through Entity N/A Finding Type Significant deficiency Repeat Finding No Criteria Per 2 CFR 200.303, the recipient must establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States, or the “Internal Control Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Organization lacked adequate controls to ensure the SEFA was complete and accurate. Questioned Costs N/A If Questioned Costs are not Determinable, Description of Why Known Questioned Costs were Undetermined or Otherwise Could not be Reported No questioned costs were identified as the result of this finding Identification of How Questioned Costs Were Computed N/A Context In reviewing a monitoring report from the Colorado Department of Public Health & Environment from March 2025, we noted that the program under review - Child and Adult Care Food Program for Fiscal Year 2024 2025 - was not listed on the initial SEFA provided. The report specifically identified a review of records encompassing activity from January 2025, therefore there were expenditures during the year ended June 30, 2025. Cause and Effect A lack of adequate controls over financial reporting could result in inaccuracies or incomplete information on the SEFA. Recommendation We recommend the Organization implement a formal control requiring an independent review of the SEFA to ensure all federal expenditures are reported. Views of Responsible Officials and Corrective Action Plan Management concurs with the finding. The Child and Adult Care Food Program (CACFP) was omitted from the initial Schedule of Expenditures of Federal Awards (SEFA) for the year ended June 30, 2025. Although CACFP had been consistently reported as a federal award in prior years, an update to the SEFA preparation format eliminated the prior-year rollover/carryforward record and the year over year (YOY) comparison functionality, reducing visibility into historical program inclusion. Additionally, the executed agreement was not readily available during preparation, resulting in the program being initially misclassified as non federal without documented cross functional validation or independent review. As a result, the omission was not identified during the initial SEFA review. Federal expenditures were incurred and properly recorded during the fiscal year. The issue was limited to SEFA reporting completeness and did not constitute a compliance deficiency related to program administration, allowability, or management of federal funds. No questioned costs were identified. Corrective Action: 1. Federal Award Classification Review: Federal versus non federal classification will be reviewed by the program manager, Director of Internal Control, and CFO based on the executed agreement. Any reclassification will require documented CFO approval. 2. Annual Cross System Reconciliation: An annual reconciliation between the contract management system and the general ledger will be performed to ensure all federal awards are captured for SEFA reporting. 3. SEFA Format Standardization: The SEFA preparation schedule will be reverted to a prior year rollover format that retains carryforward data and enables year over year comparison to improve completeness review and anomaly detection. 4. General Ledger Tagging Controls: General ledger dimensional tagging has been enhanced so federally funded activity is automatically identified and included in the preliminary SEFA. 5. Independent SEFA Review: The SEFA will undergo documented independent review and approval by the CFO prior to auditor submission, consistent with 2 CFR 200.303.

Assistance Listing Number, Federal Agency, and Program Name 93.044, 93.045, 93.053, U.S. Department of Health and Human Services, Special Programs for the Aging, Title III, Part B, Grants for Supportive Services and Senior Centers; Special Programs for the Aging, Title III, Part C, Nutrition Services, and Nutrition Services Incentive Program (Aging Cluster) Federal Award Identification Number and Year EX24040 (2024); 21 IHEA 160179 (2021); EX23077 (2023); CON1357567 (2024) Pass through Entity Larimer County and Denver Regional Council of Governments Finding Type Material weakness Repeat Finding No Criteria Per 2 CFR 200.303, the recipient must establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States, or the “Internal Control Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Organization lacked adequate controls to ensure reviews were performed by a different individual than the one responsible for preparing monthly financial reporting, calculations of per unit activity, and requests for reimbursement. Questioned Costs N/A If Questioned Costs are not Determinable, Description of Why Known Questioned Costs Were Undetermined or Otherwise Could not be Reported No questioned costs were identified as the result of this finding Identification of How Questioned Costs Were Computed N/A Context During our walkthrough to understand management’s processes and internal controls to ensure compliance with financial reporting, we observed that the same individual was responsible for preparing, finalizing, and submitting financial reports for passthrough awards. This process includes accumulating cost activity incurred for the period from the general ledger for the Denver Regional Council of Governments awards, calculating revenue based on a fixed fee per service under the Larimer County awards, and accumulating and reporting matching contributions under all the awards. There was no evidence of an independent review or approval prior to submission. Cause and Effect A lack of segregation of duties and independent review increases the risk of material errors in financial reporting, including misstatements of fee based revenue on the SEFA and inaccuracies in meeting match requirements. Recommendation We recommend the Organization implement a formal control requiring an independent review of all financial reports prior to submission to the funding agency. This review should be performed by an individual who is not involved in the preparation of the reports. Views of Responsible Officials and Planned Corrective Actions Management concurs with the finding. We recognize that for the Denver Regional Council of Governments (DRCOG) and Larimer County awards the processes for accumulating cost activity, calculating per unit revenue, and reporting matching contributions lacked documentation of an independent review prior to submission. While management maintains that the data submitted was accurate and supported by the general ledger, we acknowledge that the absence of a formal "preparer vs. approver" workflow does not meet the standards outlined in 2 CFR 200.303. Corrective Action Plan: 1. Standardization of Financial Reporting Workflow: A formal segregation of duties for all federal and pass through reimbursement requests and financial reports has been implemented. Effective immediately, the individual responsible for accumulating cost data and calculating per unit activity (preparer) is prohibited from being the reviewer. 2. Implementation of Approval Process: All reports must now be submitted by the preparer to the designated reviewer for approval via email prior to submission. An approval response from the reviewer is required prior to submission to the awarding agency. 3. Staff Training: All grants management and accounting personnel have been briefed on the requirements of 2 CFR 200.303, specifically regarding the necessity of documented internal controls to provide reasonable assurance of compliance.

Finding number: 2025-001 Federal agency: U.S. Department of Education Programs: Student Financial Assistance Cluster AL #: 84.063 and 84.268 Award year: 2025 Criteria The Code of Federal Regulations, consisting of 2 CFR 200.303, 34 CFR 685.309, and 34 CFR 690.83(b)(2), requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Additionally, schools are required to certify enrollment at a minimum of every 60 days or every other month. Condition During our testing of NSLDS Enrollment Reporting for Salem State University, we noted 1 of the 40 students tested had a status change received by NSLDS outside of the 60-day reporting time frame. Cause The University’s Registrar was not made aware of the student’s status change in a timely manner by the student’s academic advisor. As a result, the student’s change in status was delayed in reporting to NSLDS. The University’s policies and procedures were not properly followed to ensure that student status changes were timely reported to NSLDS. Effect The NSLDS system is not updated with the student information which can cause over-awarding should the student transfer to another institution and the student may not properly enter the repayment period. Questioned Costs N/A Perspective Our sample was not, and was not intended to be, statistically valid. Of the 40 students selected for testing, 1 student, or 2.5% of our sample, had a change in status reported outside of the 60-day reporting time frame. Identification as a Repeat Finding, if applicable N/A Recommendation The University should review their reporting procedures to ensure that students’ statuses are timely reported to NSLDS as required by Federal regulations. View of Responsible Officials The University agrees with the finding. This issue was the result of human error, as established procedures were not followed in which a student withdrawal was not forwarded to the Registrar’s Office, preventing timely reporting to NSLDS. The student’s official withdrawal request was not transmitted by the office responsible for approving student leaves and withdrawals to the Registrar’s Office for processing, resulting in the absence of the required enrollment update in the student information system.

Reference Number: 2025-005 Prior Year Finding: 2024-007 Federal Agency: U.S. Department of Agriculture State Agency: Department of Education State Division Name: Child Nutrition Cluster Federal Program: 10.553, 10.555, 10.556, 10.559, 10.582 Assistance Listing Number: 1WV300301 (10/1/2024 – 9/30/2025) Award Number and Year: 1WV310309 (10/1/2024 – 9/30/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Department of Education (Department) did not report subaward information timely. Context: Sixty subawards were selected for testing and we noted the following exceptions: • 36 of 60 subawards were not reported timely. The subawards were reported from approximately 1 to 8 months late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department does not have sufficient procedures or internal controls to ensure that subaward information is reported timely. Effect: Subawards were not reported in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department review and enhance internal controls and procedures to ensure that all subawards are reported timely, no later than the end of the month following the month of issuance. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-006 Prior Year Finding: 2024-009 Federal Agency: U.S. Department of the Interior State Agency: Department of Environmental Protection Federal Program: Abandoned Mine Land Reclamation Assistance Listing Number: 15.252 Award Number and Year: S19AF20000-05 (1/1/2019 – 12/31/2026) S20AF20008-03 (1/1/2020 – 12/31/2026) S20AF20094-02 (1/1/2021 – 12/31/2026) S22AF00013-02 (1/1/2022 – 12/31/2026) S22AF00039-03 (1/1/2022 – 12/31/2024) S23AF00013-04 (10/1/2022 – 9/30/2027) S23AF00059-00 (1/1/2023 – 12/31/2025) S23AF00107-00 (1/1/2023 – 12/31/2025) S24AF00007-00 (1/1/2024 – 12/31/2026) S24AF00032-01 (1/1/2023 – 9/30/2028) S24AF00064-00 (10/1/2023 – 12/31/2026) S25AF00103-01 (10/1/2024 – 9/30/2029) S25AF00162-00 (1/1/2025 – 12/31/2027 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Environmental Protection did not report subaward information in accordance with FFATA reporting requirements. Context: Two of six subawards selected for testing were not reported timely. Of the two exceptions noted, one subaward was issued in April 2023 and one subaward was issued in July 2024. Both subawards were reported in November 2024. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department does not have sufficient procedures or internal controls to ensure that subaward information is reported timely. Effect: Subawards were not reported in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department review and enhance internal controls and procedures to ensure that all subawards are reported timely no later than the end of the month following the month of issuance. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-007 Prior Year Finding: 2024-015 Federal Agency: U.S. Department of Labor State Agency: Department of Commerce, Workforce West Virginia Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: 25A55UI000073 (10/1/2024 – 12/31/2027) 24A55UI000043 (10/1/2023 – 12/31/2026) 23A55UI039356 (10/1/2022 – 12/31/2025) Compliance Requirement: Special Tests and Provisions: UI Benefit Payments Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). The program estimates error rates, that is, numbers of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70% of cases must be completed within 60 days of the week ending date of the batch; • a minimum of 95% of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98% of cases for the year must be completed within 120 days of the ending date of the calendar year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department did not complete BAM case investigations within the requirements established in the ET Handbook No. 395. Context: The Department performed 481 reviews of paid cases and 151 reviews of denied cases during FY 2025. The Department did not meet the required time limits for closing paid or denied cases within 60, 90, or 120 days. Specifically, we noted the following exceptions: • 63% of paid cases were closed within 60 days, which is less than the required 70%. • 89% of paid cases were closed within 90 days, which is less than the required 95%. • 92% of paid cases were closed within 120 days, which is less than the required 98%. • The remaining paid cases were closed in more than 120 days. • 96% of denied monetary cases were closed within 120 days, which is less than the required 98%. Questioned costs: Undetermined. Cause: The Department’s procedures and internal controls over BAM case reviews were not sufficient to ensure that case reviews were closed within the time limits required by ET Handbook No. 395. Effect: Noncompliance with the time limits for closing cases could delay the detection and correction of inaccurate benefit payments. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that case reviews are completed timely in accordance with the time limits established in the ET Handbook No. 395. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-008 Prior Year Finding: 2024-013 Federal Agency: U.S. Department of Labor State Agency: Department of Commerce, Workforce West Virginia Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: 25A55UI000073 (10/1/2024 – 12/31/2027) 24A55UI000043 (10/1/2023 – 12/31/2026) 23A55UI039356 (10/1/2022 – 12/31/2025) Compliance Requirement: Special Tests and Provisions: UI Program Integrity – Overpayments Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or Specific Requirement: Compliance: States are (1) required to impose a monetary penalty (not less than 15 percent) on claimants whose fraudulent acts resulted in overpayments, and (2) states are prohibited from providing relief from charges to an employer’s UI account when overpayments are the result of the employer’s failure to respond timely or adequately to a request for information. States may continue to waive recovery of overpayments in certain situations and must continue to offer the individual a fair hearing prior to recovery. In addition, states may approve “blanket waivers” where individuals are eligible for payment under an unemployment benefit program for a given week, but through no fault of the individual, they were paid incorrectly under either the PUA or PEUC program at a higher WBA, or specific to PUA, when, through no fault of the individual, the state paid the individual a minimum WBA based on DUA guidance other than UIPL No. 03-20 (UIPL No. 20-21, section 4.d.ii). Program requirements for overpayments include the State must identify the basis for the overpayment consistent with its written procedures. An overpayment memorandum is created summarizing the details of the overpayment and submitted to UI cross-match staff or claims deputy for review. Upon review, the overpayment is established, and a Deputy Decision or WVUC-B-14-J Overpayment Determination is generated and sent to the claimant. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Commerce (Department) was not in compliance with program requirements for recovering overpayments. Context: For 1 of 60 claimants selected for testing, the Department did not establish an overpayment memo. Questioned costs: Undetermined. Cause: The Department’s procedures and controls are not sufficient to ensure that overpayments are recovered in accordance with program requirements. Effect: Failure to recover overpayments in accordance with federal requirements compromises the integrity and sustainability of the UI program. Unrecovered overpayments reduce funds available to pay legitimate benefits, increase the risk of fraud and improper payments, and undermine compliance with federal program standards. Recommendation: The Department should strengthen its procedures and controls to ensure overpayments are identified, recorded, and recovered in a timely manner and in full compliance with federal requirements. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-009 Prior Year Finding: 2024-035 Federal Agency: U.S. Department of the Treasury State Agency: Office of the Governor Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: SLFRP0004 (2021-2024) SLFRP2625 (2021-2024) Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per the Compliance and Reporting Guidance issued by the Department of the Treasury (Treasury), recipients must submit quarterly Project and Expenditure Reports. Required project information includes current period obligation, cumulative obligation, current period expenditure, and cumulative expenditure. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The West Virginia Office of the Governor (Office) incorrectly reported expenditures for multiple projects on quarterly Project and Expenditure Reports submitted during FY 2025. The Office was also unable to provide documentation supporting obligations reported for one project. Context: Twenty-eight projects were selected for testing Project and Expenditure Reports, consisting of nine projects in the 9/30/2024 quarter and nineteen projects in the 3/31/2025 quarter. The Office contracts with a third-party to compile and submit quarterly Project and Expenditure reports. The contractor relies on the Office to populate the upload worksheets that are submitted to Treasury’s reporting portal. The following exceptions were noted: Expenditures: For 2 of 9 projects selected for testing in the 9/30/2024 quarter, expenditures reported were incorrect. • For the Revenue Replacement project, an expenditure summary analysis prepared by the contractor during the FY 2025 Single Audit identified $3.4 million in expenditures from the 6/30/2023 quarter that were not reported as of 6/30/2025. • For the Revenue Replacement project, reporting errors identified during the FY 2024 Single Audit continued through the 9/30/2024 quarter. Prior quarter cumulative reporting errors in the amount of $375 million were corrected in the 12/31/2024 quarterly report as part of the prior year corrective action plan. • For the Broadband project, an internal review by the contractor during FY 2025 identified that duplicate expenditures had been reported through the 12/31/2024 quarterly report. An adjustment was made in the 3/31/2025 quarter to correct the cumulative expenditures reported in prior quarters. Obligations: For 1 of 9 projects selected for testing in the 9/30/2024 quarter, auditors were unable to verify obligations reported. • The project for the Dilapidated Properties Program contains multiple subawards. The contractor relies on reporting upload worksheets prepared by the Office for submission to the Treasury reporting portal. The Office was unable to provide supporting documentation that agreed with the subaward current and cumulative obligations included on the upload worksheet. Cause: The Office’s corrective action plan from the prior year’s audit was in-process during FY 2025. In addition, internal reviews conducted during FY 2025 and during the audit identified additional reporting errors. Effect: Significant adjustments were required to be made to expenditures reported through the 12/31/2024 quarter, $3.4 million in expenditures from the 6/30/2023 quarter were not reported as of 6/30/2025, and supporting documentation for obligations for the Dilapidated Properties Program was not readily available for audit. Questioned costs: Undetermined. Recommendation: The Office should enhance its procedures and internal controls to ensure that the project expenditures and obligations reported are accurate, allowable, and agree to supporting documentation. In addition, supporting documentation should be readily available for audit. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-019 Prior Year Finding: 2024-052 Federal Agency: National Science Foundation State Agency: Higher Education Policy Commission Federal Program: Research and Development Cluster Assistance Listing Number: 47.076 Award Number and Year: 1834586 (09/01/2018 – 08/31/2025) Compliance Requirement: Suspension and Debarment Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or Specific Requirement: Compliance: 2 CFR 200.214 Suspension and Debarment restricts awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. 2 CFR 180.300 states that an entity may determine suspension and debarment status by: (a) Checking SAM (System for Award Management) Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person Control: Per 2 CFR Section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Higher Education Policy Commission (HEPC) did not properly verify and document the suspension and debarment status of subrecipients. Context: Nine transactions were selected for testing, including five for West Virginia University, one for Shepherd University, two for HEPC, and one for the Department of Agriculture. The following exceptions were noted: HEPC: • For 1 of 2 transactions selected for testing, HEPC performed the suspension and debarment verification after the subaward issuance date. The subaward was issued on 10/31/2023 but the suspension and debarment verification occurred on 12/4/2024. • For 1 of 2 transactions selected for testing, HEPC performed a suspension and debarment verification, but it was not dated and auditors were unable to determine if it occurred prior to issuance of the subaward. Questioned costs: None noted. The subrecipients were not suspended or disbarred. Cause: HEPC’s procedures and internal controls were not sufficient to ensure that it performed suspension and debarment verifications prior to issuance of subawards nor that documentation of the verifications was maintained and was complete. Effect: Failure to verify the suspension and debarment status of subrecipients prior to issuance of subawards could result in HEPC entering into agreements with subrecipients who are ineligible to participate in the program. Recommendation: HEPC should review and enhance its controls and procedures to ensure that it verifies the suspension and debarment status of subrecipients prior to issuance of subawards and include documentation for when the check occurred. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-010 Prior Year Finding: 2024-039 Federal Agency: U.S. Department of Education State Agencies: Glenville State University (GSU), Southern West Virginia Community and Technical College (SWVCTC) Federal Program: Student Financial Assistance Cluster Assistance Listing Number: 84.063, 84.268 Award Number and Year: Various (7/1/2024-6/30/2025) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matter Criteria or Specific Requirement: Compliance: The Code of Federal Regulations, 34 CFR 685.300(b)(5) requires the College on a monthly basis, to reconcile the institutional records with the Direct Loan funds received from the Secretary and the Direct Loan disbursement records submitted to and accepted by the Secretary. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: GSU - Direct loan reconciliations between the COD, G5 and student accounts were not being performed monthly. SWVCTC - Direct Loan reconciliations among COD, G5, and student accounts were not subjected to monthly review. Context: GSU did not prepare the required monthly direct loan reconciliation between COD, G5, and student accounts for one out of two months selected for testing. SWVCTC was unable to provide documentation supporting the review of monthly reconciliations for two months selected for testing. Questioned costs: None. Cause: GWU - The department did not have sufficient procedures or internal controls in place to ensure appropriate review and sign-off of federal student aid reconciliation amounts. SWVCTC - The process of review was being completed, however, there wasn’t adequate documentation to reflect the review of the reconciliations. Effect: The institutions are not compliant with internal policy and federal requirements to ensure funds are properly reconciled. Recommendation: Management at GSU should implement a monthly Direct Loan reconciliation in accordance with 34 CFR 685.300(b)(5). In addition, documentation over review and approval of the reconciliation for accuracy and completeness should be retained to evidence the operating effectiveness of internal controls. Management at SWVCTC should strengthen its existing internal control to ensure the monthly Direct Loan reconciliation is consistently prepared, reviewed, and approved to evidence the operating effectiveness of internal controls. In addition, documentation over review and approval of the reconciliation for accuracy and completeness should be retained to evidence the operating effectiveness of internal controls. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-012 Prior Year Finding: 2024-047 Federal Agency: U.S. Department of Education State Agencies: West Virginia University (WVU), West Virginia School of Osteopathic Medicine (WVSOM), Southern West Virginia Community and Technical College (SWVCTC) Federal Program: Student Financial Aid Assistance Listing Number: 84.063, 84.268 Award Number and Year: Various (7/1/2024 - 6/30/2025) Compliance Requirement: Special Tests and Provisions: NSLDS Reporting Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or Specific Requirement: Compliance: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in their next scheduled enrollment submission if the schedule submission is within 60 days. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: WVU & WVSOM - There were discrepancies between the program enrollment effective date and the campus enrollment effective date. SWVCTC - There were discrepancies in enrollment reporting. Context: WVU - Ten out of twenty-six samples tested have instances where the program enrollment effective date did not match the campus enrollment effective date reported to NSLDS. WVSOM - Four out of six samples tested have instances where the program enrollment effective date did not match the campus enrollment effective date reported to NSLDS. SWVCTC - One sample tested had multiple discrepancies in enrollment reporting: • The date of the student’s status change was inconsistent between the College’s records and NSLDS. • The student’s enrollment status was not certified within the required 60-day timeframe. • The program enrollment status did not align with the campus enrollment status. • The program enrollment effective date differed from the campus enrollment effective date. Questioned costs: None. Cause: WVU - The department did not have sufficient procedures or internal controls in place to ensure the accuracy and reliability of National Student Clearinghouse (NSC) file generation following the Information Technology Services (ITS) system upgrade. WVSOM - The cause was updated process and a missed parameter in a large spreadsheet submitted to NSLDS upload. SWCTC - Data files weren’t being transmitted from the school to the Clearinghouse to NSLDS correctly. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Recommendation: We recommend the institutions review their reporting procedures and controls to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-011 Prior Year Finding: 2024-040 Federal Agency: U.S. Department of Education State Agency: West Virginia State University (WVSU) Federal Program: Student Financial Assistance Cluster Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Number and Year: Various (7/1/2024-6/30/2025) Compliance Requirement: Special Tests and Provisions: Gramm-Leach-Bliley Act Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or Specific Requirement: Compliance: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Certain elements of the University’s information security program were not maintained in written form. Context: The University did not have adequate documentation retained to evidence that a review and approval of the information security program were performed during the fiscal year to ensure compliance with Federal regulations. The University’s written information security program did not cover the following requirements: • Assess apps developed by the institution • Implement multi-factor authentication for anyone accessing customer information on the institution’s system • Dispose of customer information securely • Anticipate and evaluate changes to the information system or network. • Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). Questioned costs: None. Cause: WVSU did not have sufficient procedures or internal controls in place to ensure the timely development, completion, and approval of a formal cybersecurity policy. Effect: Information security management may not be optimized and responses delayed without the written plan. Recommendation: We recommend the University ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Agriculture Federal Program: Research and Development Cluster Assistance Listing Number: 93.103 Award Number and Year: Various Compliance Requirement: Equipment and Real Property Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR 200.313 prescribes the requirements for non-federal entities regarding equipment and real property management. Requirements include the following: Property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property (including the federal award identification number), who holds title, the acquisition date, cost of the property, percentage of federal participation in the project costs for the federal award under which the property was acquired, the location, use and condition of the property, and any ultimate disposition data including the date of disposal and sales price of the property. A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Agriculture did not manage equipment purchased with federal program funds in accordance with federal requirements. Context: Sixty items were selected for testing which included three from the Department of Agriculture (Department), five from Bluefield State College (BSC), and fifty-two from West Virginia University. We noted the following exceptions: Department of Agriculture: For one of three property records selected for testing, the Department did not maintain property records. Cause: The Department does not have sufficient procedures or internal controls to ensure that equipment and property acquired with federal funds is maintained in accordance with federal requirements. Effect: Failure to adequately manage federal equipment and property could allow for undetected loss, theft, damage, or unauthorized use of the property. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance internal controls and procedures to ensure that equipment and property acquired using federal funds is managed in accordance with federal requirements. The Department should maintain property records and perform a physical inventory for all equipment. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-021 Prior Year Finding: 2024-054 Federal Agency: Department of Health and Human Services State Agency: Department of Agriculture Federal Program: Research and Development Cluster Assistance Listing Number: 93.103 Award Number and Year: 5U2FFD007445-04 (7/01/2024 – 06/30/2026) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Agriculture did not include all required information in subaward agreements. Context: One of eight subawards selected for testing were missing required federal award information. The eight subawards tested consisted of six subawards from West Virginia University (WVU), one subaward from the Department of Agriculture (Department) and one subaward from the Higher Education Policy Commission (HEPC). The following exceptions were noted: Department of Agriculture: The subaward tested did not contain all required federal award information. The Assistance Listing Number and identification of whether the Federal award was for research and development was omitted from the subaward agreement. Questioned costs: None noted. Cause: The Department does not have sufficient procedures and internal controls to ensure that subawards are issued in compliance with Federal requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subaward agreements. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-022 Prior Year Finding: 2024-021 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Temporary Assistance for Needy Families Assistance Listing Number: 93.558 Award Number and Year: 2401WVTANF (10/1/2023 – 9/30/2024) 2503WVTANF (10/1/2024 – 9/30/2025) Compliance Requirement: Special Tests and Provisions - Income Eligibility and Verification System Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Each state shall participate in the Income Eligibility and Verification System (IEVS) required by Section 1137 of the Act as amended. Under the state plan the state is required to coordinate data exchanges with other federally assisted benefit programs, request and use income and benefit information when making eligibility determinations and adhere to standardized formats and procedures in exchanging information with other programs and agencies. Specifically, the state is required to request and obtain information as follows: (a) Wage information from the state Wage Information Collection Agency should be obtained for all applicants at the first opportunity following receipt of the application, and for all recipients on a quarterly basis. (b) Unemployment Compensation (UC) information should be obtained for all applicants at the first opportunity, and in each of the first three months in which the individual is receiving aid. This information should also be obtained in each of the first three months following any recipient-reported loss of employment. If an individual is found to be receiving UC, the information should be requested until benefits are exhausted. (c) All available information from the Social Security Administration (SSA) for all applicants at the first opportunity. (d) Information from the US Citizenship and Immigration Services and any other information from other agencies in the state or in other states that might provide income or other useful information. (e) Unearned income from the Internal Revenue Service (IRS). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not perform data exchange matches on cases or did not perform the data matches prior to disbursement of benefits. Context: Sixty cases were selected for testing, and the following exceptions were noted: • 10 of 60 cases did not perform a data match with other federally assisted benefit programs as required by the program. Benefits selected for testing were disbursed on 5/1/2025 and 6/1/2025 but the Department was unable to provide documentation that a data match had been performed. • 4 of 60 cases did not perform a data match with other federally assisted benefit programs prior to disbursement of benefits to the participants. The match check was performed from twelve to twenty-four days after benefits were disbursed. Cause: The Department’s procedures and internal controls were not sufficient to ensure that it complied with IEVS data match requirements prior to issuance of benefits to participants in the program. The Department had not fully implemented its corrective action plan from the prior audit year. Effect: Failure to perform data exchanges with other federally assisted benefit programs could allow ineligible participants to receive benefits under the program. Questioned costs: Undetermined. Based upon information available at the time of audit, auditors were unable to determine if benefits were paid to ineligible participants. Recommendation: We recommend the Department complete implementation of its corrective action plan from theprior audit year. The Department should reevaluate its current process, implement proper controls, and perform additional training to ensure that, prior to disbursing benefits to participants, it has performed a data match with other federally assisted benefit programs and ensure that only eligible participants receive benefits under the program. Supporting documentation should be maintained and be readily available for audit. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-013 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2401WVLIEA (10/1/2023 – 9/30/2025) Compliance Requirement: Reporting – Special Reporting – LIHEAP Carryover and Reallotment Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Grant recipients must submit an initial LIHEAP Carryover and Reallotment Report no later than August 1 and a final report by December 31 indicating the amount expected to be carried forward for obligation in the following fiscal year and the planned use of those funds. Funds more than the maximum carryover limit are subject to reallotment to other LIHEAP recipients in the following federal fiscal year and must also be reported. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not submit the final LIHEAP Carryover and Reallotment Report timely. Context: The final Carryover and Reallotment Report for FFY 2024 was due 12/31/2024 but was not filed by the Department until 1/21/2025, or 21 days late. Cause: The Department controls failed to ensure that the final LIHEAP Carryover and Reallotment Report was submitted timely. Effect: Failure to submit the LIHEAP Carryover and Reallotment Report timely could impact the Federal agency’s ability to manage the program. Questioned costs: None noted. Recommendation: We recommend that the Department review and enhance internal controls and procedures to ensure that the final LIHEAP Carryover and Reallotment Report is submitted by December 31 each year. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-015 Prior Year Finding: 2024-025 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Foster Care – Title IV-E Assistance Listing Number: 93.658 Award Number and Year: 2502WVFOST (10/1/2024 – 9/30/2025) 2401WVFOST (1/1/2024 – 3/31/2025) Compliance Requirement: Allowable Costs/Cost Principles, Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Allowable Costs/Cost Principles – Per 2 CFR section 200.403, except where otherwise authorized by statute, costs must meet certain criteria to be allowable under Federal awards. Criteria includes that costs must be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. Costs must also conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. Eligibility – Funds may be expended for foster care maintenance payments on behalf of eligible children, in accordance with the Title IV-E agency’s foster care maintenance payment rate schedule and in accordance with 45 CFR section 1356.21, to individuals serving as foster family homes, to child-care institutions, directly to a youth aged 18 or older who is in a supervised independent living setting if no actual provider or other child placing intermediary is involved, or public or private child-placement or child-care agencies. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) charged the Foster Care program for payments made to psychiatric facilities which is an unallowable cost under the program. Context: One of sixty cases selected for testing included payments to a psychiatric facility. Payments to psychiatric facilities are not allowable under the Foster Care program. Cause: The Department’s corrective action plan from the prior audit indicated that a system change was made during FY 2025 to prevent future payments to psychiatric facilities from being charged to the Foster Care program. The exception noted was prior to the implementation of the correction action plan. Effect: Ineligible expenditures were charged to the Foster Care program. Questioned costs: $665, the amount paid to the psychiatric facility for the case tested. Recommendation: The Department should ensure its corrective action plan from the prior audit has been fully implemented and ensure that payments to psychiatric facilities are no longer charged to the Foster Care program. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-016 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Foster Care – Title IV-E Assistance Listing Number: 93.658 Award Number and Year: 2502WVFOST (10/1/2024 – 9/30/2025) 2401WVFOST (1/1/2024 – 3/31/2025) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) was unable to provide supporting documentation for costs charged to the program. Context: For two of sixty cases selected for testing, the Department was unable to provide supporting documentation for the transactions. Auditors were unable to verify that the expenditures were allowable nor that they had been reviewed and approved prior to issuance. Cause: While the Department has established procedures in place, a clerical error resulted in supporting documentation not being properly maintained for certain program expenditures. Although the Department's multi-layered review process identified the missing documentation before the automated financial system issued payment, the error was not corrected prior to issuance. Consequently, internal controls did not prevent these errors. Effect: Expenditures without supporting documentation were charged to the Foster Care program. Questioned costs: $50, the amount charged to the program without supporting documentation. Recommendation: The Department should reevaluate its current process, implement proper controls, and perform additional training to ensure that, prior to charging costs to the program, it has supporting documentation which is reviewed and approved by a supervisor who is knowledgeable of the regulations regarding allowable program costs. Supporting documentation should be maintained and be readily available for audit. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-017 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Adoption Assistance Assistance Listing Number: 93.659 Award Number and Year: 2502WVADPT (10/1/2024 – 9/30/2025) 2502WVADPT (1/1/2024 – 3/31/2025) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) was unable to provide supporting documentation for costs charged to the program. Context: For one of sixty cases selected for testing, the Department was unable to provide supporting documentation for the transaction. Auditors were unable to verify that the expenditure was allowable nor that it had been reviewed and approved prior to issuance. Cause: While the Department has established procedures in place, a clerical error resulted in supporting documentation not being properly maintained for certain program expenditures. Although the Department's multi-layered review process identified the missing documentation before the automated financial system issued payment, the error was not corrected prior to issuance. Consequently, internal controls did not prevent these errors. Effect: An expenditure without supporting documentation was charged to the Adoption Assistance program. Questioned costs: $26, the amount charged to the program without supporting documentation. Recommendation: The Department should reevaluate its current process, implement proper controls, and perform additional training to ensure that, prior to charging costs to the program, it has supporting documentation which is reviewed and approved by a supervisor who is knowledgeable of the regulations regarding allowable program costs. Supporting documentation should be maintained and be readily available for audit. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-018 Prior Year Finding: No Federal Agency: Various State Agency: Higher Education Policy Commission (HEPC) Bluefield State University Federal Program: Research and Development Cluster Assistance Listing Number: Various Award Number and Year: Various Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR 200.320 (a)(1)(iv) states that a recipient or subrecipient may establish a micro-purchase threshold higher than the micro-purchase threshold identified in the FAR in accordance with the requirements of this section. The recipient or subrecipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the Federal agency or pass-through entity and auditors in accordance with § 200.334. The self-certification must include a justification, clear identification of the threshold, and supporting documentation of any of the following: A. A qualification as a low-risk auditee, in accordance with the criteria in § 200.520 for the most recent audit; B. An annual internal institutional risk assessment to identify, mitigate, and manage financial risks; or, C. For public institutions, a higher threshold is consistent with State law. Control: Per 2 CFR Section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HEPC and Bluefield State University utilized micro‑purchase procedures for purchases charged to Federal awards at amounts exceeding the Federal micro‑purchase threshold based on thresholds established in its Board approved policies. However, the entities did not complete and retain the required annual self‑certification supporting the higher thresholds utilized. Context: HEPC applied a micro‑purchase threshold of $50,000 and Bluefield State University applied a micro‑purchase threshold of $25,000. Questioned costs: None noted. Cause: HEPC’s and Bluefield State University’s internal control processes did not include a documented control activity to ensure annual self‑certification of the micro‑purchase threshold was completed, approved by appropriate authority, and retained in accordance with Uniform Guidance requirements. Effect: By applying micro‑purchase procedures to transactions exceeding the Federal micro‑purchase threshold without maintaining required self‑certification documentation, the entities increase the risk of noncompliance with Uniform Guidance procurement standards, insufficient competition or price reasonableness documentation, and the potential for unallowable or unsupported costs charged to Federal awards. Recommendation: HEPC and Bluefield State University should formally establish and document an annual self‑certification of their micro‑purchase thresholds in accordance with 2 CFR §200.320(a)(1)(iv). The self‑certification should clearly identify the approved threshold, include a written justification, and retain supporting documentation demonstrating compliance with one of the allowable criteria. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-004 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury, U.S. Department of Agriculture, U.S. Department of Labor, U.S. Department of Education, U.S. Department of Health and Human Services, U.S. Department of Homeland Security State Agency: State Treasurer’s Office Federal Program: SNAP Cluster National School Lunch Program Unemployment Insurance Title I Grants to Local Educational Agencies Special Education -- Grants to States Education Stabilization Fund Temporary Assistance for Needy Families Low-Income Home Energy Assistance Child Care and Development Block Grant Foster Care -- Title IV-E Adoption Assistance Children's Health Insurance Program Medical Assistance Program Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 10.551, 10.561, 10.555, 17.225, 84.010, 84.027, 84.425, 93.558, 93.568, 93.575, 93.658, 93.659, 93.767, 93.778, 97.036 Award Number and Year: Various Compliance Requirement: Reporting - Cash Management Improvement Act Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The State Treasurer’s Office (Department) did not submit the FY 2025 Annual Report timely. Context: Treasury granted the Department an extension until January 9, 2026 to submit the FY 2025 Annual Report. The Department did not submit the report until January 14, 2026. Cause: Due to extenuating circumstances, the Department requested an extension beyond the regulatory filing deadline but did not seek an additional extension when the issues remained unresolved. Effect: Untimely submission of the Annual Report may delay Treasury’s settlement of applicable annual interest payments. Questioned costs: None noted. Recommendation: The Department should enhance its procedures and internal controls to ensure that the Annual Report is submitted timely in accordance with CMIA requirements and the terms of deadline extension, if applicable. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Community Project Funding/Congressionally Directed Spending ‐ Construction Assistance Listing Number: 93.493 Federal Award Identification Number and Year: 6-CE1HS52375-07 - 2023 Award Period: September 30, 2023, through September 29, 2026 Type of Finding: • Material Weakness in Internal Control over Compliance – Subrecipient Monitoring • Other Matters Criteria or specific requirement: CFR Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, §200.303 specifies that a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: Evidence of subrecipient monitoring was not available for the five subrecipients selected for testing. Questioned costs: None. Context: Of the five subrecipients selected for testing, we noted that none of them had proper monitoring in place. Cause: The Association did not have internal control systems in place to adequately monitor subrecipients to ensure that the non-federal entity was in compliance with terms of the federal award. Effect: The Association could pass through federal funding to subrecipients who are not responsible or capable recipients of the funds. Funding could be used by the subrecipients in ways that are incompatible with program goals and compliance requirements. Repeat Finding: N/A. Recommendation: We recommend that the Association implement policies and procedures to ensure the performance of subrecipient monitoring and that the monitoring is formally documented and approved. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Community Project Funding/Congressionally Directed Spending ‐ Construction Assistance Listing Number: 93.493 Federal Award Identification Number and Year: 6-CE1HS52375-07 - 2023 Award Period: September 30, 2023, through September 29, 2026 Type of Finding: • Material Weakness in Internal Control over Compliance – Reporting • Other Matters Criteria or specific requirement: 2 CFR Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, §200.303 specifies that recipients must evaluate and monitor the recipient's or subrecipient's compliance with statutes, regulations, and the terms and conditions of Federal awards. This includes semiannual performance reporting requirements. Condition: Evidence of review and approval of semiannual progress reports was not available for items selected for testing. Questioned costs: None. Context: Of the two samples selected for testing, we noted that neither had proper review or approval processes in place. Cause: The Association did not have internal controls in place to ensure proper review and approval of semiannual progress reports prior to submission Effect: The Association risks submitting federal awards reports that are incomplete or not fairly presented in accordance with applicable program requirements. This could lead to inaccuracies in reported activity for the applicable reporting period. Repeat Finding: N/A. Recommendation: We recommend that the Association implement formal policies and procedures requiring the review and approval of performance, with such review and approval clearly documented. Views of responsible officials: There is no disagreement with the audit finding.

Identification of the Federal Program: U.S. Department of Health and Human Services, Health Resources and Services Administration (HRSA) Federal Agency and Program Name: Maternal and Child Health Federal Consolidated Programs (MCH) Assistance Listing #: 93.110 Award: 5 T73MC30767‐09 Award Year(s): 7/1/2024-6/30/2025 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR 200.303 requires that the non-Federal entity must “(a) establish, document and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under the requirements of the Federal Funding Accountability and Transparency Act (Transparency Act) that are codified in 2 CFR Part 170, “unless the recipient is exempt as provided in paragraph d. of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward”. The recipient must report each subaward described to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the end of the month following the month in which the subaward was issued. Condition: During our audit, we noted 3 Federal Funding Accountability and Transparency Act (FFATA) reports, for the subaward modifications made during fiscal year 2025, were not submitted in the FSRS/SAM.gov timely. Cause: Vanderbilt University Medical Center (VUMC) did not have sufficient internal controls to ensure that the required FFATA reports were submitted timely. Effect or Potential Effect: VUMC did not submit the necessary FFATA reports under the MCH project for each first-tier subaward modifications in FSRS/SAM.gov and consequently was not in compliance with the requirements under the Transparency Act. Questioned Costs: $0 Context: Under the MCH program, there were five subrecipients that had a total of five subaward modifications in FY 2025. The three subaward modifications for which FFATA reports were not submitted timely totaled $33,853. Upon eventual submission, we did not identify any errors in the data reported. Total subrecipient’s costs are $326,025 in FY 2025. The total federal expenditures for the MCH program for FY 2025 were $5,760,179. Identification as a Repeat Finding: This is not a repeat finding. Recommendation: We recommend management strengthen its internal controls and procedures over the review of subrecipient awards and modifications to ensure the required FFATA reports are submitted timely to be in compliance with the Federal Transparency Act. Views of Responsible Officials: Management agrees with the finding and has strengthened our internal controls and procedures to ensure required FFATA reports are submitted timely in compliance with the Federal Transparency Act.

Identification of the Federal Program: Department of Homeland Security Federal Agency and Program Name: COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (FEMA) Assistance Listing #: 97.036 Pass-Through Entity: State of Tennessee Award: All FEMA Projects (Projects 435263, 550461, 684580) Award Year(s): Project 435263: 1/1/2020-7/31/2021 Project 550461: 1/1/2020-7/31/2021 Project 684580: 8/1/2020-6/30/2022 Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): 2 CFR 200.303 requires that the non-Federal entity must “(a) establish, document and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control - Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Management did not retain documentation over their review and approval of FEMA expenditures prior to submission in the FEMA Portal. Cause: Management represented that FEMA expenditures were reviewed and approved prior to submission; however, supporting documentation over the review and approval was not maintained. Effect or Potential Effect: Unallowable expenditures could have been charged to the federal program. Questioned Costs: $0. Context: There were three project worksheets obligated in FY2025. Management did not maintain documentation over the review and approval over the expenditures submitted to the FEMA . We selected 40 expenditures charged to FEMA, noting no instances of non-compliance. Total FEMA expenses reported on the SEFA for the year ended June 30, 2025, is $9,857,313. Identification as a Repeat Finding: This is not a repeat finding. Recommendation: We recommend Management ensure that appropriate documentation be retained over the review and approval of FEMA expenditures. Views of Responsible Officials: Management understands that additional audit evidence must be retained at a detailed enough level to allow the auditor to meet their reperformance standard. All expenses claimed were eligible and were reviewed by management prior to the submission. The control issue identified is due to the lack of evidence to support approval. Should management have a future FEMA claim we will retain additional audit evidence to enable auditor reperformance of the controls regarding approval of expenditures.

FINDING 2025-003 Subject: COVID-19 - Education Stabilization Fund - Equipment and Real Property Management Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425U Federal Award Number and Year (or Other Identifying Number): S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Equipment and Real Property Management Audit Findings: Material Weakness, Modified Opinion Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2023-009. Condition and Context The School Corporation had not properly designed or implemented a system of internal controls, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance related to the Equipment and Real Property Management compliance requirement. The School Corporation made a real property purchase, 200 N Preston Street (Church Property), in the amount of $27,951 with grant funds. The Church Property was acquired in January 2024, and the expenditure was reimbursed under the ESSER III award in January 2024. The School Corporation did not maintain a capital asset ledger during the audit period, so the equipment purchased was not properly added to an asset ledger or property record. In addition, the School Corporation did not perform a physical inventory of equipment/property at least once every two years as required. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 17 CROTHERSVILLE COMMUNITY SCHOOLS SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.313(d) states in part: "Management requirements. Procedures for managing equipment (including replacement equipment), whether acquired in whole or in part under a Federal award, until disposition takes place will, as a minimum, meet the following requirements: (1) Property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property (including the FAIN), who holds title, the acquisition date, and cost of the property, percentage of Federal participation in the project costs for the Federal award under which the property was acquired, the location, use and condition of the property, and any ultimate disposition data including the date of disposal and sale price of the property. (2) A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. (3) A control system must be developed to ensure adequate safeguards to prevent loss, damage, or theft of the property. Any loss, damage, or theft must be investigated. . . ." Cause The School Corporation's management had not designed or implemented a system of internal controls that would have ensured procedures were in place so that the School Corporation would be in compliance with the provisions of the grant agreements and the Equipment and Real Property Management compliance requirement. Effect The failure to design and implement an effective system of internal controls enabled material noncompliance to go undetected. Noncompliance with the provisions of the grant agreements and the Equipment and Real Property Management compliance requirement could result in the loss of future federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 18 CROTHERSVILLE COMMUNITY SCHOOLS SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management design and implement a system of internal controls to ensure compliance with the grant agreements and the Equipment and Real Property Management compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2025-004 Subject: COVID-19 - Education Stabilization Fund - Earmarking Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425U Federal Award Number and Year (or Other Identifying Number): S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Matching, Level of Effort, Earmarking Audit Findings: Material Weakness, Modified Opinion Condition and Context The School Corporation had not properly designed or implemented a system of internal controls, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance related to the Matching, Level of Effort, Earmarking compliance requirement. A portion of the ESSER III allocation is required to be set aside for learning loss. The required amount to be set aside is indicated in the ESSER III grant application. The School Corporation is responsible for monitoring each required set aside throughout the life of the grant to ensure the obligation is met. There was no oversight or review process in place to ensure monitoring of the required set aside. The School Corporation did not provide documentation to show that the set aside for the learning loss obligation was met or not met due to COVID-19 pandemic. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Section 2001(e)(1) of the ARP Act states in part: "(e) Uses of Funds--A local educational agency that receives funds under this section— INDIANA STATE BOARD OF ACCOUNTS 19 CROTHERSVILLE COMMUNITY SCHOOLS SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (1) shall reserve not less than 20 percent of such funds to address learning loss through the implementation of evidence-based interventions, such as summer learning or summer enrichment, extended day, comprehensive afterschool programs, or extended school year programs, and ensure that such interventions respond to students' academic, social, and emotional needs and address the disproportionate impact of the coronavirus on the student subgroups . . ." Cause Management had not developed a system of internal controls that would have ensured compliance with the grant agreement and the Matching, Level of Effort, Earmarking compliance requirement. Effect The failure to establish an effective internal control system and maintain adequate supporting documentation enabled material noncompliance to go undetected. Noncompliance with the grant agreement and the Matching, Level of Effort, Earmarking compliance requirement could result in the loss of federal funds to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish an effective system of internal controls and maintain adequate supporting documentation to ensure compliance and with the grant agreement and the Matching, Level of Effort, Earmarking compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2025-005 Subject: COVID-19 - Education Stabilization Fund - Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425U Federal Award Number and Year (or Other Identifying Number): S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Allowable Costs/Cost Principles Audit Findings: Significant Deficiency, Other Matters Condition and Context The School Corporation had not properly designed or implemented a system of internal controls, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance related to the Allowable Costs/Cost Principles compliance requirement. INDIANA STATE BOARD OF ACCOUNTS 20 CROTHERSVILLE COMMUNITY SCHOOLS SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) A sample of 13 claims charged to the COVID-19 - Education Stabilization Fund program for which reimbursement was received during the audit period was selected for testing to verify the expenditures were in conformance with the applicable cost principles. Of the 13 claims tested, 3 were found to include unallowable costs. The description of the claims are as follows: • The School Corporation had 2 claims for supplies/building materials to build a storage building totaling $5,932. The building was not able to be completed due to the Fire Marshal's report. The School Corporation decided to not complete this project and used these materials/supplies within the School Corporation for other projects. There was no documentation presented for review to show where these materials were used; therefore, it could not be determined if the expenses were allowable. • The School Corporation had 1 claim for concrete for the storage building. The concrete pad was completed, and the building was never completed. Total cost of this claim was $3,619. There are no plans for the use of the concrete so it could not be determined if the expense was allowable. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. . . . (g) Be adequately documented. . . ." Cause Management had not developed a system of internal controls that would have ensured compliance with the grant agreement and the Allowable Costs/Cost Principles compliance requirement. Once the original project was discontinued no documentation was created to show how the purchased materials were used and for what purpose. INDIANA STATE BOARD OF ACCOUNTS 21 CROTHERSVILLE COMMUNITY SCHOOLS SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect The failure to establish an effective internal control system and maintain adequate supporting documentation enabled noncompliance to go undetected. Noncompliance with the grant agreement and the Allowable Costs/Cost Principles compliance requirement could result in the loss of federal funds to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish an effective system of internal controls and maintain adequate supporting documentation to ensure compliance with the grant agreement and the Allowable Costs/Cost Principles compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2025-006 Subject: Child Nutrition Cluster - Reporting Federal Agency: Department of Agriculture Federal Program: School Breakfast Program, National School Lunch Program, Summer Food Service Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.559 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023-2024, FY2024-2025 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Condition and Context The School Corporation had not properly designed or implemented a system of internal controls, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance related to the Reporting compliance requirement. The School Corporation had not developed a system of internal controls over the reimbursement requests to ensure that the correct amounts are being requested for reimbursement in conformance with Reporting requirements. The Deputy Treasurer prepared the reimbursement requests without any oversight, review, or approval prior to submission. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 22 CROTHERSVILLE COMMUNITY SCHOOLS SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause A proper system of internal controls was not designed by management of the School Corporation, which would include segregation of key functions. One employee was responsible for this compliance requirement, and no others were involved in any type of review or approval process. Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of preventing, or detecting and correcting, material noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish an effective system of internal controls to ensure compliance with the grant agreement and the Reporting compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report. INDIANA STATE BOARD OF ACCOUNTS 23

FINDING 2025-002 Subject: Child Nutrition Cluster - Eligibility Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program Assistance Listings Numbers: 10.553, 10.555 Federal Award Numbers and Years (or Other Identifying Numbers): FY 23/24, FY 24/25 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Eligibility Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2023-002. Condition and Context The School Corporation had not properly designed or implemented a system of internal controls, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance related to the eligibility determination of a child receiving meals and to the verification of free and reduced-price applications. INDIANA STATE BOARD OF ACCOUNTS 17 SILVER CREEK SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Any child enrolled in a participating school who meets the applicable program's definition of "child," may receive meals under the applicable program. In the case of the National School Lunch Program and the School Breakfast Program, children belonging to households meeting nationwide income eligibility requirements may receive meals at no charge or at reduced price. Children who have been determined ineligible for free or reduced-price school meals pay the full price, set by the School Food Authority, for their meals. Children attending SFSP meal service sites receive their meals at no charge. As a general rule, a child's eligibility for free or reduced-price meals under a Child Nutrition Cluster program may be established by the submission of an annual application or statement which furnishes such information as family income and family size. Local educational agencies, institutions, and sponsors then determine eligibility by comparing the data reported by the child's household to published income eligibility guidelines. Additionally, a child may be direct certified. For a direct certification, annual eligibility determinations are based on the child's household receiving benefits under SNAP, FDPIR, the Head Start Program (ALN 93.600), or, under most circumstances, the TANF program (ALN 93.558). A household may furnish documentation of its participation in one of these programs; or the school, institution, or sponsor may obtain the information directly from the state or local agency that administers these programs. Certain foster, runaway, homeless, and migrant children are categorically eligible for free school lunches and breakfasts. Direct certified households do not need to complete an application. The system parameters, including income guidelines, were entered by the software vendor without a documented review or oversight process by the School Corporation to ensure the parameters entered were accurate. In addition, the Food Service Director was responsible for generating and the IT Department was responsible for inputting the Direct Certification Reports into the School Corporation's software system (Infinite Campus). There was no evidence of an oversight, review, or approval process to ensure that the Direct Certification Reports were generated and input into the system correctly and periodically reviewed for updates. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause The School Corporation's management had not developed or documented an oversight or review process to ensure that income guidelines were properly entered into the software system and the direct certification report was properly processed. INDIANA STATE BOARD OF ACCOUNTS 18 SILVER CREEK SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect The failure to design or implement a system of internal controls places the School Corporation at risk of noncompliance with the grant agreement and the compliance requirements. Noncompliance could result in students either receiving benefits they are not entitled to or not receiving benefits they would otherwise be entitled to. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the School Corporation design and implement a proper system of internal controls, including policies and procedures that would provide segregation of duties to ensure appropriate reviews, approvals, and oversight are taking place regarding the input of income guidelines and direct certifications into the software system. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2025-003 Subject: COVID-19 - Education Stabilization Fund - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U200013 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2023-008. Condition and Context The School Corporation had not properly designed or implemented a system of internal controls, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance related to the Activities Allowed or Unallowed and the Allowable Costs/Cost Principles compliance requirements. INDIANA STATE BOARD OF ACCOUNTS 19 SILVER CREEK SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Reimbursement requests for the program were prepared by one employee and reviewed by another employee; however, the supporting documentation that was provided to the reviewer did not give a clear distinction as to what expenditures were included in the reimbursement. As the documentation provided was not adequate that accompanied the reimbursement request, and the reimbursement requests, as noted below, did not agree to the ledger, the reviewer could not have ensured expenses were allowed per the federal program and if the cost were in conformance with the allowable cost principles. In addition, while reviews of payroll and vendor claims took place prior to the reimbursement request being compiled, no reviewers had enough detailed information (i.e., fund being charged) or knowledge to determine if the expense was allowable from the federal award funds or was compliant with the cost principles. The lack of internal controls were systemic issues throughout the audit period for ESSER II and ESSER III. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause A proper system of internal controls was not designed by management of the School Corporation. Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the School Corporation's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. Reimbursement requests for the program were prepared by one employee and reviewed by another employee; however, detailed supporting documentation was not provided to the reviewer to determine if the expense was allowable from the federal award funds or was compliant with the cost principles. Effect The failure to establish an effective system of internal controls could have enabled noncompliance with the grant agreement and the Activities Allowed or Unallowed and the Allowable Cost/Cost Principles compliance requirements. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 20 SILVER CREEK SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a system of internal controls to ensure compliance with the grant agreement and the Activities Allowed or Unallowed and the Allowable Cost/Cost Principles compliance requirements and that sufficient detailed supporting documentation accompanies all reimbursement requests. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2025-004 Subject: COVID-19 - Education Stabilization Fund - Cash Management Federal Agency: Department of Education Federal Program: COVID - 19 - Education Stabilization Fund Assistance Listings Numbers: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U200013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Cash Management Audit Findings: Material Weakness, Other Matters Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2023-009. Condition and Context The School Corporation had not properly designed or implemented a system of internal controls, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance related to the Cash Management compliance requirement. Reimbursement requests for the program were prepared by one employee and reviewed by another employee; however, the supporting documentation that was provided to the reviewer did not give a clear distinction as to what expenditures were included in the reimbursement. As the documentation provided was not adequate that accompanied the reimbursement request, and the reimbursement requests, as noted below, did not agree to the ledger, the reviewer could not have ensured expenses were paid prior to requesting reimbursement. For 5 of 25 expenditures tested, the School Corporation was unable to provide supporting documentation traceable to the reimbursement request. There were 2 of those expenditures, totaling $1,715, that were for ESSER II's final reimbursement which requested the remainder of the grant award and expenses could not be traced to the documentation provided for the reimbursement amount. There were 3 of the expenditures, totaling $6,665, that were not traceable to an ESSER III reimbursement request. Therefore, as the expenditure could not be traced to a reimbursement request, it could not be determined if the School Corporation paid for the expense prior to requesting reimbursement. INDIANA STATE BOARD OF ACCOUNTS 21 SILVER CREEK SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Additionally, 1 of 25 expenditures tested, for $154, was an expense that occurred after the School Corporation requested reimbursement. The lack of internal controls and noncompliance were systemic issues throughout the audit period for ESSER II and ESSER III. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.305(b) states in part: "For non-Federal entities other than states, payments methods must minimize the time elapsing between the transfer of funds from the United States Treasury or the pass-through entity and the disbursement by the non-Federal entity whether the payment is made by electronic funds transfer, or issuance or redemption of checks, warrants, or payment by other means. . . . (3) Reimbursement is the preferred method when the requirements in this paragraph (b) cannot be met, when the Federal awarding agency sets a specific condition per § 200.208, or when the non-Federal entity requests payment by reimbursement. . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." Cause A proper system of internal controls was not designed and implemented by management of the School Corporation, which would include segregation of key functions. Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. The School Corporation had not developed any policies that would have ensured compliance or that supporting documentation would have been maintained and available for audit related to the Cash Management compliance requirement. INDIANA STATE BOARD OF ACCOUNTS 22 SILVER CREEK SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect The failure to retain and provide appropriate supporting documentation prevented the determination of the School Corporation's compliance with the Cash Management compliance requirement. Noncompliance with the grant agreement and the Cash Management compliance requirement could result in the loss of future federal funds to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls to ensure that documentation will be maintained and available for audit and comply with the grant agreement and the Cash Management compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Criteria: In accordance with 2 CFR 200.303(a), a formalized system of internal control should be established, documented, and maintained to ensure that performance reporting information for each award is reliably captured and included in the applicable reports. Condition/Context: During our testing of the Reporting compliance requirement, specifically performance reporting, we noted that the Organization did not have any formal internal control procedures in place to ensure the accuracy, completeness, and timely submission of required performance reports. For the three performance reports tested, there were no documented review procedures or approvals to validate the information reported to the funding agencies. Our testing did not identify any instances of noncompliance; however, the absence of an internal control represents a breakdown in the control activities for the compliance area. Cause: Management had not implemented a formal internal control policy over the performance reporting process. Effect/Possible Effect: Failure to adequately maintain a system of internal control increases the risk of submitting inaccurate, incomplete, unsupported, or untimely reports. Questioned Costs: No questioned costs were identified as part of this finding. Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the Organization design and implement formal internal control policies and procedures over the Reporting compliance requirement which includes, but is not limited to, documented preparation, review and approval of the reports and retention of supporting documents for all applicable information included within the reports. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the recommendation to design and implement formalized internal control policies and procedures specific to the Reporting compliance requirement and are in the process of doing so.

Significant Deficiency 2025-001 – Allowable Activities/Allowable Costs Federal Program Information: U.S. Department of Agriculture Passed through the State of Maine Department of Education: ALN 10.553,10.555, 10.559 & 10.579 Child Nutrition Cluster Criteria: The following CFR(s) apply to this finding: 2 CFR 200.303 Condition: During audit procedures, it was identified that the Unit did not have consistent internal controls over program expenditures. Cause: The Unit does not have the necessary internal controls over compliance. Effect: Insufficient controls could result in unallowable expenses being charged to the program and subsequently improperly reimbursed by federal funds Identification of Questioned Costs: None identified. Context: During audit procedures, 23 of the 25 disbursement samples did not have the proper approval on the invoices or supporting documents. This is not a statistically valid sample. Repeat Finding: This is not a repeat finding. Recommendation: It is recommended that the Unit develop and implement internal control policies and procedures for a consistent, documented approval process to ensure that only allowable costs are charged to the program. Views of Responsible Officials and Corrective Action Plan: Please see the Corrective Action Plan issued by the Regional School Unit No. 29.

Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Information on the Major Federal Program: Federal agency: National Science Foundation (NSF) and Department of Health and Human Services – National Institute of Health (HHS-NIH) Assistance listing number: 47.076 and 93.859 Assistance listing name and award number: NSF Indigenous Climate Journalism - #42-10059-24006 and Biomedical Research and Research Training - #45-14000-24002 Award year: NSF: 09/01/2023 - 04/25/2025 HHS-NIH: 07/20/2023 - 06/30/2028 Criteria – The Uniform Guidance in 2 CFR Section 200.303, Internal Control requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 200.430 Compensation – Personal Services: “Costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1)Is reasonable for the services rendered and conforms to the establish written policy of thenon-Federal entity consistently applied to both Federal and non-Federal activities; (2)Follows an appointment made in accordance with a non-Federal entity’s laws and/or rules orwritten policies and meets the requirements of Federal statute, where applicable; and (3)Is determined and supported as provided in paragraph (i) of this section, Standards forDocumentation of Personnel Expenses, when applicable.” 2 CFR Section 200.430 (g): “Standards for Documentation of Personnel Expenses (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i)Be supported by a system of internal control that provides reasonable assurance that thecharges are accurate, allowable, and properly allocated; (ii)Be incorporated into the official records of the recipient or subrecipient; (iii)Reasonably reflect the total activity for which the employee is compensated by the recipientor subrecipient, not exceeding 100 percent of compensated activities; (iv)Encompass federally-assisted and all other activities compensated by the recipient orsubrecipient on an integrated basis but may include the use of subsidiary records as definedin the recipient's or subrecipient's written policy; (v)Comply with the established accounting policies and procedures of the recipient orsubrecipient; (vi)Support the distribution of the employee's salary or wages among specific activities or costobjectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirectactivities allocated using different allocation bases; or an unallowable activity and a direct orindirect cost activity. (vii)Budget estimates (i.e., estimates determined before the services are performed) alone donot qualify as support for charges to Federal awards.” Condition – During the fiscal year ended June 30, 2025, the Organization allocated payroll expenditures charged to the Research and Development Program (major program) based on estimated percentages of personnel time dedicated to the grant. Management did not maintain documentation evidencing that the allocation methodology and resulting payroll distributions were reviewed and approved on a timely basis during the fiscal year. Compensating controls and audit results noted include: (i) payroll costs were budgeted by program and program budgets were approved, (ii) payroll charges were reconciled to the general ledger and reviewed, and (iii) substantive testing of payroll costs charged to the major program identified no exceptions in a sample of 10 payroll transactions tested. Cause – Although the Organization has established policies and procedures intended to support and evidence review and approval of payroll allocations charged to the major program, these procedures were not performed and/or retained in a timely manner during the fiscal year. As a result, management did not maintain contemporaneous documentation supporting that payroll allocation percentages and resulting payroll distributions were reviewed and approved in accordance with the Organization’s established guidelines and applicable regulations. Effect – The lack of timely documented review and approval of payroll allocation support increases the risk that payroll costs could be inaccurately allocated to the federal award and therefore not comply with 2 CFR 200.430 requirements for documentation of personnel expenses. However, based on compensating controls and our substantive testing (no exceptions noted in a sample of 10 transactions), there are no known or likely questioned costs and no misallocations were identified in the items tested. Questioned Costs – There are no known or likely questioned costs. Context – This is a condition identified per review of the Organization’s compliance with specified requirements of the Uniform Guidance. The prevalence of this finding is detailed in the condition section above. Repeat Finding – This is not a repeat finding. Recommendation – We recommend that management ensure established policies and procedures for the timely review and approval of payroll allocation methodologies and payroll expenditures charged to the major program are consistently performed. Management should also retain documentation evidencing the review and approval (including reviewer, date, and scope of review) to demonstrate compliance with 2 CFR 200.430. Views of Responsible Officials – Management agrees with the finding. Please see appendix A for Management’s Corrective Action Plan.

FINDING 2025-002 Subject: Child Nutrition Cluster - Allowable Costs/Cost Principles Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Summer Food Service Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.559 Federal Award Numbers and Years (or Other Identifying Numbers): 2023-2024, 2024-2025 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Allowable Costs/Cost Principles Audit Findings: Material Weakness, Other Matters INDIANA STATE BOARD OF ACCOUNTS 16 LINTON-STOCKTON SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Condition and Context The School Corporation did not have adequate procedures in place to ensure that allocation of costs related to compensation and fringe benefits of the food service director was appropriately documented. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. . . . (g) Be adequately documented. . . ." 2 CFR 200.430 states in part: ". . . Compensation for personal services includes all remuneration, paid currently or accrued, for services of employees rendered during the period of performance under the Federal award, including but not necessarily limited to wages and salaries. Compensation for personal services may also include fringe benefits . . . (i) Standards for Documentation of Personal Expenses (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; INDIANA STATE BOARD OF ACCOUNTS 17 LINTON-STOCKTON SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities (for IHE, this per the IHE's definition of IBS); (iv) Encompass federally-assisted and all other activities compensated by the non- Federal entity on an integrated basis but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity (See paragraph (h)(1)(ii) above for treatment of incidental work for IHEs.); and . . . (vii) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. . . ." Cause The School Corporation's Management had not developed nor implemented a system of internal controls that would have ensured that the allocation of costs are appropriately documented, and made available for audit, as it related to the grant agreement and the Allowable Costs/Cost Principles compliance requirement. Effect Without the proper implementation of an effectively designed system of internal controls, the School Corporation did not retain and provide appropriate supporting documentation to ensure compliance with allowable cost and cost principles requirements. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's Management establish an effective system of internal controls and develop policies and procedures to ensure the allocation of costs are appropriately documented, which are to be maintained and made available for audit as related to the Allowable Cost/Cost Principles compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2025-003 Subject: Child Nutrition Cluster - Eligibility Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program Assistance Listings Numbers: 10.553, 10.555 Federal Award Numbers and Years (or Other Identifying Numbers): 2023-2024, 2024-2025 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Eligibility Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2023-003. Condition and Context The School Corporation had not properly designed or implemented a system of internal controls, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance related to the eligibility determination of a child receiving meals. Eligibility Any child enrolled in a participating school who meets the applicable program's definition of "child," may receive meals under the applicable program. In the case of the National School Lunch Program and the School Breakfast Program, children belonging to households meeting nationwide income eligibility requirements may receive meals at no charge or at reduced price. Children who have been determined ineligible for free or reduced-price school meals pay the full price, set by the School Food Authority, for their meals. Children attending SFSP meal service sites receive their meals at no charge. As a general rule, a child's eligibility for free or reduced-price meals under a Child Nutrition Cluster program may be established by the submission of an annual application or statement which furnishes such information as family income and family size. Local educational agencies, institutions, and sponsors then determine eligibility by comparing the data reported by the child's household to published income eligibility guidelines. Additionally, a child may be direct certified. For a direct certification, annual eligibility determinations are based on the child's household receiving benefits under SNAP, FDPIR, the Head Start Program (ALN 93.600), or, under most circumstances, the TANF program (ALN 93.558). A household may furnish documentation of its participation in one of these programs; or the school, institution, or sponsor may obtain the information directly from the state or local agency that administers these programs. Certain foster, runaway, homeless, and migrant children are categorically eligible for free school lunches and breakfasts. Direct certified households do not need to complete an application. The system parameters, including income guidelines, were entered by the software vendor without a documented review or oversight process by the School Corporation to ensure the parameters entered were accurate. In addition, the food service management provider was responsible for processing online application eligibility in the School Corporation's software system. The Food Service Director was responsible for randomly reviewing the eligibility status of online and paper applications; however, documentation of which applications were reviewed was not maintained. Therefore, we could not determine if there was an oversight, review, or approval process to ensure that eligibility determinations were correct. INDIANA STATE BOARD OF ACCOUNTS 19 LINTON-STOCKTON SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Finally, the Food Service Director was responsible for generating and inputting the Direct Certification Reports into the School Corporation's software system. There was no evidence of an oversight, review, or approval process to ensure that the Direct Certification Reports were generated and input into the system. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause The system of internal controls over the review of the income eligibility guidelines saved in the system, the manual determinations of eligibility, and the direct certification uploads were not properly implemented. Documentation was not maintained that the review process occurred. Effect Without the proper design or implementation of the components of a system of internal control, including policies and procedures that provide segregation of duties and additional oversight as needed, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the School Corporation design and implement a proper system of internal control, including policies and procedures that would provide segregation of duties, to ensure appropriate reviews, approvals, and oversight are taking place. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Finding 2025-041 AWARE – Information Security and Change Management Government Auditing Standards allow for information that is considered sensitive in nature, such as detailed information related to IT system security, to be issued through a separate “classified or limited use” report because of the potential damage that could be caused by the misuse of this information. We consider the specific technical details of this finding, along with the response, to be sensitive in nature and not appropriate for public disclosure. Therefore, the details of the following finding and response have been provided to the Department in a separate, confidential memorandum. The Department of Labor and Employment’s Division of Vocational Rehabilitation administers the federal Rehabilitation Services – Vocational Rehabilitation Grants to States [ALN 84.126] (Vocational Rehabilitation) program and relies on its Accessible Web-Based Activity and Reporting Environment (AWARE) IT system to aid with management of the program and to track expenditures. The AWARE system is a configurable, off-the-shelf (COTS) system that is managed and hosted by the Department’s third-party IT service provider, Alliance Enterprises (Alliance). Department staff access the system via a secure Web portal. Program information is stored on servers and databases managed by Alliance. Alliance developed the AWARE system specifically to meet federal requirements for Vocational Rehabilitation program services and is used by multiple states. In order for the Department to achieve its objectives and respond to risks, including those related to the federal programs it administers, management should establish a strong framework of internal controls that also includes information system controls. Specifically, information system controls typically start with management documenting IT policies that address IT general control responsibilities and procedures that document the more granular details of how to implement Department policies. These IT general control policies and procedures should include those policies and procedures that are specific to information security and access management. The Department has policies that define the rules for various software systems based on the Department’s needs and security requirements; and the AWARE System Security Plan (SSP), which lists security requirements and describes the controls that must be in place to ensure all the security policy requirements are met. Once policies and procedures have been formalized and communicated to responsible staff and the Department’s contractor, specific internal control activities can be implemented and operationalized. What was the purpose of our audit work and what work was performed? The purpose of the audit work was to gain an understanding of, and determine whether the Department had designed and implemented IT general controls, specifically information security and change management controls, over the AWARE system. Our audit work consisted of inquiries to the Department to gain an understanding of these IT general control areas, along with a review of related documentation provided by the Department staff. How were the results of the audit work measured? We applied the following criteria when evaluating the design effectiveness of the IT general controls: • The Governor’s Office of Information Technology (OIT)’s Colorado Information Security Policies (Security Policies). • Federal regulations [2 CFR 200.303] require the Department to establish and maintain effective internal controls, including IT general controls, over federal awards that provide reasonable assurance that the Department is managing its federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award. • Standards for Internal Control in the Federal Government (Green Book), published by the U.S. Government Accountability Office (GAO), is a leading industry internal control framework. The Office of the State Controller (OSC) has adopted the Green Book as the State’s standard for internal controls, which all state agencies must follow. Green Book, Paragraphs 3.09, Documentation of the Internal Control System, and 12.02, Documentation of Responsibilities through Policies, requires that management develop and maintain documentation of its internal control system and document in policies the internal control responsibilities of the organization. Green Book, Paragraph 12.05, Periodic Review of Control Activities, also requires that management periodically review policies and procedures for continued relevance and effectiveness in achieving the entity’s objectives or addressing related risks. If there is a significant change in an entity’s process, management should review this process in a timely manner after the change to verify that the control activities are designed and implemented appropriately. • Green Book, Paragraph 14.03, Communication throughout the Entity, prescribes that management should communicate quality information to enable personnel to perform key roles in achieving objectives, addressing risks, and supporting the internal control system. In these communications, management should assign the internal control responsibilities for key roles. What problems did the audit work identify? During Fiscal Year 2025, we identified problems with the Department’s information security and change management IT general controls for the AWARE system. Why did these problems occur? According to the Department, it is in the final stages of modernizing a new case management system that will replace its current AWARE system and, therefore, did not update its SSP or policies and procedures for AWARE during Fiscal Year 2025. Department staff indicated that they expected AWARE to be decommissioned prior to the end of Fiscal Year 2025, and therefore determined it was not feasible to update the AWARE SSP during Fiscal Year 2025 to comply with OIT’s Security Policies. However, deployment of the new system was delayed due to the Department working through the new system’s User Acceptance Testing. The Department indicated that it will develop policies for the new case management system during the modernization process, which it expects to be finalized with the decommissioning of AWARE in January 2026. Why do these problems matter? It is important for the Department to have an effective system of internal controls in place in order to meet its objectives and comply with federal requirements for the Vocation Rehabilitation program. Without an effective internal control system, the reliability of the data processed, stored, and reported on by the Department’s IT system for the Vocational Rehabilitation program can be adversely impacted. When IT policies and procedures are not maintained, updated, and communicated, Department staff, and others who are subject to the requirements and processes, may not be able to adequately manage or consistently apply IT policy requirements and processes to meet management’s objectives and expectations, respond to risks appropriately, and ensure the confidentiality, integrity, and availability of the Department’s information systems. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-041 The Department of Labor and Employment should improve its overall IT governance and information security IT general controls for the information system used for the Rehabilitation Services – Vocational Rehabilitation Grants to States program by: A. Implementing recommendation Part A as noted in the confidential finding. B. Implementing recommendation Part B as noted in the confidential finding. Response Department of Labor and Employment A. Agree Implementation Date: July 2026 The Department will implement Part A of the confidential finding. B. Agree Implementation Date: July 2026 The Department will implement Part B of the confidential finding.

Finding 2025-042 MyUI+ – IT Governance and Information Security Government Auditing Standards allow for information that is considered sensitive in nature, such as detailed information related to information technology system security, to be issued through a separate “classified or limited use” report because of the potential damage that could be caused by the misuse of this information. We consider the specific technical details of this finding, along with the response, to be sensitive in nature and not appropriate for public disclosure. Therefore, the details of the following finding and response have been provided to the Department in a separate, confidential memorandum. The Department administers the federal Unemployment Insurance (UI) program, and relies on its IT system, MyUI+, to aid with determining applicants’ eligibility for the UI program and to provide data necessary for federal reporting to the U.S. Department of Labor for the UI program. The Department is the business owner of the MyUI+ system and works with OIT and the Department’s external IT service provider to manage MyUI+. The OSC has adopted the GAO’s Green Book as the State’s standard for internal controls, which all state agencies must follow. For the Department to achieve its objectives and respond to risks, including those related to the federal programs it administers, management should establish a strong framework of internal controls that also address information system controls. Specifically, information system controls typically start with management documenting IT policies that address IT general control responsibilities and procedures that document the more granular details on how to implement Department policies. These IT general control policies and procedures should include those policies and procedures that are specific to information security, for example controls related to issuing new user credentials. Once the Department has formalized and communicated its policies and procedures to responsible staff, specific internal control activities can be implemented and operationalized. OIT has promulgated the Security Policies that apply to the Department and its systems, and outline specific business owner IT requirements with which the Department must comply. What was the purpose of our audit work and what work was performed? The purpose of our audit work was to determine whether the Department implemented our Fiscal Year 2024 audit recommendations related to MyUI+. As part of our recommendations, we recommended that the Department should improve its IT governance for the MyUI+ system by: • Formalizing and communicating IT procedures guidance to Department staff and the Department’s IT service provider performing IT general control activities, including a Department-defined periodic review process of OIT’s Security Policies to ensure the Department’s IT policies, procedures, and rules align with the most current version of the Security Policies. • Implementing the recommendation as noted in the confidential finding. The Department agreed with these recommendations and planned to implement them by June 2025. Our audit work consisted of assessing the design and implementation of the Department’s IT policies and procedures, through inquiry with Department staff and inspection of supporting documentation. How were the results of the audit work measured? We measured the results of our audit work against the following: • OIT Security Policies that are developed, published, and required to be followed by the Department and its external IT service providers state within the Policy section and the General Responsibilities section, specifically 8.3.1 and 8.3.2 for business owners, that all agencies, including the Department, must implement governance principles, which would include IT policies and procedures, for promoting data quality and integrity for their systems. OIT Security Policies also indicate that the Department, as the business owner for MyUI+, is responsible for following and adhering to all identified business owner requirements. • OIT Security Policies and IRS Publication 1075, Tax Information Security Guidelines for Federal State and Local Agencies. Department management stated that it aligns with IRS Publication 1075 for its systems even though MyUI+ does not contain Federal Tax Information, which is the focus of Publication 1075’s security requirements. • Federal regulations [2 CFR 200.303] require the Department to establish and maintain effective internal controls, including IT general controls, over federal awards that provide reasonable assurance that the Department is managing its federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award. • Green Book, Paragraphs 3.09, Documentation of Internal Control System, and 12.02, Documentation of Responsibilities through Policies, states that management should develop and maintain documentation of its internal control system and document in policies the internal control responsibilities of the organization. Paragraphs 11.06 and 11.07, Design Appropriate Types of Control Activities, state that management should design appropriate types of control activities in the entity's information system, including information system general controls that facilitate the proper operation of the entity’s systems. What problems did the audit work identify? The Department did not fully implement our prior audit recommendations to improve its IT governance related to MyUI+ during Fiscal Year 2025. Specifically: • The Department took steps to implement the recommendation by beginning to formalize IT procedures for MyUI+, including those that defined a required periodic review of OIT’s Security Policies; however, the Department did not have the formalized procedures in place nor had it communicated the procedures to employees or its IT service provider by the end of Fiscal Year 2025. • We found that the Department did not fully implement the confidential prior audit recommendation during Fiscal Year 2025, which put the Department at risk for not complying with Publication 1075. Why did these problems occur? According to the Department, the review, updating, and communication process of its procedures did not occur by the end of Fiscal Year 2025 due to turnover and contract renegotiations, resulting in partial implementation of the recommendations by fiscal year end. Why do these problems matter? The lack of established IT policies and procedures make it difficult for Department management to measure and hold staff accountable for meeting management’s expectations, as well as ensuring risks are addressed and overall objectives and missions are fulfilled. Without policies and procedures, staff may not perform processes and controls in a consistent manner. The identified deficiencies increase the risk of system compromise and can affect the confidentiality, integrity, and availability of the MyUI+ system, as well as adversely impact the reliability of data that is processed, stored, and generated by the system. Additionally, if the MyUI+ information security processes and controls are not appropriately implemented and operating effectively, the Department may not be able to ensure compliance with federal requirements, OIT’s Security Policies, and Publication 1075. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-042 The Department of Labor and Employment (Department) should improve its overall IT governance and information security IT general controls, and work with its IT service provider, as applicable, for the MyUI+ information system by: A. Prioritizing staffing to complete and communicate the formalized IT procedures, including a required Department-defined periodic review process of the Colorado Information Security Policies, developed and published by the Governor’s Office of Information Technology, to Department staff and the Department’s IT service provider performing IT general control activities for MyUI+. B. Implementing recommendation Part B as noted in the confidential finding. Response Department of Labor and Employment A. Agree Implementation Date: April 2026 The Department will complete and communicate formalized IT procedures to staff and IT service providers for IT general control activities for MyUI+ by April 2026. B. Agree Implementation Date: April 2026 The Department will implement Part B of the confidential finding.

Finding 2025-043 Compliance with Reporting for Community Development Block Grant program The Department administers the federal Community Development Block Grant/State’s program and Non-Entitlement Grants in Hawaii (Community Development Block Grant or CDBG) [ALN 14.228] for non-entitlement municipalities and counties to carry out community development activities. The federal government splits the Department’s CDBG program into sub-programs related to the CARES Act (CDBG-CV), Disaster Recovery (CDBG-DR), and the Neighborhood Stabilization Program (CDBG-NSP). The CARES (Coronavirus Aid, Relief, and Economic Security) Act, enacted March 27, 2020, appropriated $5.0 billion in CDBG-CV funds to be allocated to about 1,250 states, local governments, and insular areas to fund activities to prevent, prepare for, and respond to Coronavirus. CDBG-CV and CDBG grants are a flexible source of funding that can be used to pay costs that are not covered by other sources of assistance, particularly to benefit persons of low and moderate income. The primary objective for CDBG-DR is to provide disaster relief, long-term recovery, restoration of infrastructure and housing, and economic revitalization in the most impacted and distressed areas resulting from a major disaster, declared pursuant to the Robert T. Stafford Disaster Relief and Emergency Assistance Act of 1974. The objectives of the CDBG-NSP are to: (1) stabilize property values, (2) arrest neighborhood decline, (3) assist in preventing neighborhood blight, and (4) stabilize communities across America hardest hit by residential foreclosures and abandonment. These objectives have been achieved through the purchase and redevelopment of foreclosed and abandoned homes and residential properties that allows those properties to turn into useful, safe and sanitary housing. The grants are to be considered CDBG funds. The Department is required to submit financial information electronically to the federal Housing and Urban Development (HUD) Exchange IT system on an annual basis. The Department is required to submit various reports that include the following: • Performance reports titled, Performance and Evaluation Financial Summary Reports (PR28), are required to list all of the financial activity related to the CDBG program and CDBG-CV subprogram. • Quarterly Performance Reports for the CDBG-DR program and CDBG-NSP. The Quarterly Performance Reports include the Department’s activities related to the CDBG grant for these sub-programs on a quarterly basis. The Department is also required to comply with the Federal Funding Accountability and Transparency Act of 2006 (Transparency Act or FFATA) for its CDBG awards. The Transparency Act was created to empower Americans with the ability to hold the government accountable for each spending decision and, as a result, to reduce wasteful spending by the government. The Transparency Act requires the federal government to make certain information on federal awards, including information about amounts passed through to subrecipients, or subawards, given to other governments or nonprofit organizations, available to the public. Federal regulations [2 CFR 200.1] define a subaward as an award provided by a pass-through entity, in this case the Department, to an entity to carry out part of a federal grant award received by the pass-through entity. A subrecipient is defined in federal regulations [2 CFR 200.1] as an entity, usually but not limited to non-federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. The Department is required to submit FFATA information through the FFATA Subaward Reporting System (formerly FSRS)—the System for Award Management (SAM.gov). Once the Department submits a report to SAM.gov, the public can view information from the report, including the subrecipient’s name, subaward identification number, subaward obligation/action date, subaward amount, federal awarding agency and subagency, the Department’s name, and the Department’s grant award identification number. In Fiscal Year 2025, the Department made 25 CDBG subawards to 18 subrecipients totaling $10.2 million that were subject to FFATA reporting. What was the purpose of our audit work and what work was performed? The purpose of the audit work was to identify and review the operational effectiveness of the Department’s internal controls and compliance over the federal reporting process for the CDBG program, and determine whether the reports were prepared and submitted in accordance with state and federal regulations. During our audit, we reviewed two PR28 Performance and Evaluation Financial Summary Reports—one for CDBG overall and one for the CDBG-CV sub-program filed by the Department during Fiscal Year 2025—and the related supporting documentation. We also reviewed eight Quarterly Performance Reports—four reports for each of the CDBG-DR and CDBG-NSP subprograms filed by the Department for Fiscal Year 2025—and the related supporting documentation. Additionally, we received the Department’s sub-awardee report submitted to SAM.gov for FFATA reporting for Fiscal Year 2025 for the CDBG grant and tested 7 of the 25 subawards listed on the report. We used both performance and sub-awardee reports to determine if the financial activity in these reports could be traced to the expenditures recorded within the Colorado Operations Resource Engine (CORE), the State’s accounting system, for the CDBG grant program for Fiscal Year 2025. We also performed testwork to determine if the performance and sub-awardee reports were reviewed and approved internally, submitted in a timely manner, and approved by HUD. How were the results of the audit work measured? For the CDBG program, we measured the results of our audit work against the following requirements: • As noted previously, the Department is required to submit certain financial information electronically to HUD through its HUD Exchange system on an annual basis. HUD requires that the reports be prepared in accordance with Generally Accepted Accounting Principles (GAAP). Per the federal Office of Management and Budget’s (OMB) Compliance Supplement, the various reports that the Department must submit include the following: PR28 Performance and Evaluation Financial Summary Reports for the CDBG program and CDBG-CV sub-program. This report is required to list all of the financial activity related to the CDBG program, such as the overall benefit to low- and moderate-income persons, the maximum allowable costs for administration, technical assistance, and overall planning, management and administration, and must be submitted quarterly, 30 days after the reporting period end date. Quarterly Performance Reports for the CDBG-DR program and CDBG-NSP. The Quarterly Performance Reports must cover all expenditures on the cooperative agreement from the start date of the reporting period to the reporting period end date related to the CDBG grant for these sub-programs and must be submitted on a quarterly basis. • In accordance with federal regulations [2 CFR 170, Appendix A], the Department is required to report subawards of $30,000 or more to SAM.gov by the end of the month following the month in which the award was made. For example, the Department would have to submit a FFATA report to SAM.gov in May 2025 if it made an award or supplemental award equal to or greater than $30,000 in April 2025. • Federal regulations [2 CFR 200.303] state that recipients of federal funds must establish and maintain effective internal controls over their federal awards which provide reasonable assurance that the recipient is managing its federal grants in compliance with federal statutes, regulations, and the award terms and conditions. These internal controls should be in compliance with the Standards for Internal Control in the Federal Government (Green Book), published by the U.S. Government Accountability Office. Green Book states in Paragraphs 3.09 and 3.10 that management is to develop and maintain documentation of its internal control system, establishing the who, what, when, where, and why of internal control execution to personnel. What problems did the audit work identify? We identified problems in all of the Department’s reports for CDBG that we tested for Fiscal Year 2025. Specifically: • We identified issues in both of the two (100 percent) PR28 performance reports we reviewed. Specifically, we could not tie disbursement amounts for the CDBG program and CDBG-CV sub program totaling approximately $15,000 and $21.7 million, respectively, contained on the two PR28 performance reports to the Department’s accounting records. Additionally, the Department could not provide evidence that Department staff reviewed and approved the reports internally prior to submission to the federal government. • We identified issues in 7 of the 8 (88 percent) Quarterly Performance Reports we reviewed. The following table reflects quarterly amounts expended that could not be tied out for each programmatic report: See "Schedule of Findings and Questioned Costs" for table/chart. *The Department did not submit 4 of the 7 (57 percent) FFATA reports to SAM.gov within the required time period. We specifically noted that the Department submitted these four subawards to SAM.gov after the close of Fiscal Year 2025 in October 2025, which caused them to be out of compliance by up to 14 months. Why did these problems occur? The Department did not have adequate internal controls over its federal reporting processes, such as supervisory review and approval of the PR28 and FFATA reports prior to submission and publication. In addition, the Department failed to maintain adequate records of submissions and accounting support due to a lack of internal monitoring and review processes necessary for tracking report submissions and ensuring reports are submitted timely and are complete. The Department stated that the delay in the submission of the FFATA reports was due to technical difficulties experienced by the Department when the federal government switched from requiring the use of the previous FSRS system to SAM.gov on March 8, 2025. Why do these problems matter? By not providing accurate information to HUD or maintaining support for the Department’s performance reports, it is not meeting federal requirements. Further, the Department may not be addressing CDBG regulatory requirements that are intended to result in an overall benefit to lowand moderate-income persons and an overall benefit to the public. Additionally, inaccurate reporting could result in actual costs exceeding the maximum allowable costs for technical assistance, and overall planning, management and administration. By failing to report the subawards to SAM.gov in a timely manner, as required under FFATA, the Department is out of compliance with federal reporting requirements and risks federal sanctions. Additionally, by not reporting the relevant information—including subrecipient name, subrecipient Data Universal Numbering System number, amount of subaward, subaward obligation/action date, date of report submission, subaward number, subaward project description, subrecipient names, and compensation of highly compensated officers—the Department is failing to meet the federal intent of transparency for federal program spending. Furthermore, the Department not maintaining documentation of the review and approval of its federal reports can lead to a lack of accountability, making it difficult to verify compliance and potentially resulting in further scrutiny or penalties from federal oversight bodies. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-043 The Department of Local Affairs should strengthen its internal controls over federal reporting for its Community Development Block Grant/State’s program and Non-Entitlement Grants in Hawaii, including the Federal Funding Accountability and Transparency Act (FFATA) reporting, and ensure that its reporting meets federal requirements by: A. Ensuring that FFATA reporting occurs as required for subawards of $30,000 or more in the System for Award Management, SAM.gov, by the end of the month following the month the subawards are made. B. Documenting and implementing internal monitoring policies and procedures, including the performance of reconciliations of reports, to ensure that the required Performance and Evaluation Financial Summary Reports (PR28) and Quarterly Performance Reports are accurate and complete. This should include maintaining documentation of evidence of the review and approval of each report prior to its submission to the federal government. Response Department of Local Affairs A. Agree Implementation Date: April 2026 The Department will strengthen its internal controls over federal reporting by implementing policies and procedures that include a monitoring process to ensure that FFATA reporting occurs as required for subawards of $30,000 or more in SAM.gov by the end of the month following the month the subawards are made. B. Agree Implementation Date: April 2026 The Department will document and implement internal monitoring policies and procedures, including the performance of reconciliations of reports, to ensure that the required PR28 and Quarterly Performance Reports are accurate and complete. This will include maintaining documentation of evidence of the review and approval of each report prior to its submission to the federal government.

Finding 2025-044 Compliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles for the Coronavirus Capital Projects Fund The Department administers the federal Coronavirus Capital Projects Fund program (CCPF) [ALN 21.029] for non-entitlement municipalities, counties, and subcontractors to carry out capital development and infrastructure activities related to increasing awareness, education, and monitoring of the Coronavirus emergency by developing broadband infrastructure. Examples of activities related to CCPF include the development of fiber-optic broadband infrastructure and investments in improving broadband infrastructure within a municipality, addressing affordability and access to broadband infrastructure, and the development and improvement of buildings that directly enables work related to the education and monitoring of the Coronavirus emergency. The Department’s accounting section records all financial transactions within CORE and must ensure the accurate reporting of federal award expenditures and reimbursements and maintain adequate supporting documentation related to transactions recorded in CORE. The Department’s accounting section is also responsible for providing information through the submission of exhibits to the Office of the State Controller (OSC) to assist in preparation of the State’s financial statements, required note disclosures, and the State’s Schedule of Expenditures of Federal Awards (SEFA). For Fiscal Year 2025, the Department reported $33.7 million in expenditures for CCPF. What was the purpose of our audit work and what work was performed? The purpose of the audit work was to review the Department’s internal controls over the CCPF payment processes and to determine whether payments were processed and paid in accordance with state regulations and federal “allowable cost” requirements during Fiscal Year 2025. As part of our audit work, we obtained from the Department the Fiscal Year 2025 expenditures listing for CCPF, comprised of eight transactions. We tested five transactions as part of our testing of the Department’s compliance with federal allowable cost requirements for the CCPF program. We also reviewed the Department’s Exhibit K1, Schedule of Federal Assistance, which it submitted to the OSC for Fiscal Year 2025 year-end reporting, and the related supporting documentation, including CORE transaction detail for revenues and expenditures associated with CCPF, to determine whether Department accounting staff prepared the exhibit in accordance with the OSC’s Fiscal Procedures Manual (Manual), and to determine whether the Exhibit K1 was accurate and complete. How were the results of the audit work measured? We measured the results of our audit work against the following requirements: • Federal regulations [2 CFR 200.403] require that costs under federal awards must be necessary, reasonable, and allocable; conform to any limitations or exclusions; be consistent with policies and procedures; receive consistent treatment; adhere to GAAP; not be used for cost sharing of other programs; and be adequately documented. • Federal regulations [2 CFR 200.302] require that recipients must expend and account for the federal award in accordance with State laws and procedures for expending and accounting for the State’s funds. All recipients’ financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with federal statutes, regulations, and the terms and conditions of the federal award. • The OSC’s Manual contains instructions for the completion of exhibits. Specifically, the Exhibit K1 is used to report federal expenditure information to the OSC for inclusion in the State’s SEFA. • Federal regulations [2 CFR 200.303] state that each recipient of federal funds must establish and maintain effective internal controls over its federal awards, which provide reasonable assurance that the recipient is managing its federal grants in compliance with federal statutes, regulations, and the award terms and conditions. The OSC has adopted the Green Book as the State’s standard for internal controls, which all state agencies must follow. Green Book, Paragraphs 3.09 and 3.10, states that management is to develop and maintain documentation of its internal control system, establishing the who, what, when, where, and why of internal control execution to personnel. What problem did the audit work identify? Through our audit testwork, we identified an error with 1 of the 5 expenditures (20 percent) tested. Specifically, the Department recorded the expenditure transaction, which totaled $3,266,662, twice in CORE. Further, because CORE is programmed to automatically record earned federal revenue when a federal expenditure is recorded, the Department also recorded federal revenue in CORE to match the duplicate federal expenditure. As a result, the Department overstated both revenues and expenditures for CCPF by $3,266,662. In addition, the Department overstated its Fiscal Year 2025 CCPF expenditures on its Exhibit K1 by $3,266,662. After we notified Department staff of the errors, they provided a corrected Exhibit K1 to the OSC. The Department passed on correcting the overstated expenditures and revenues in CORE because, based on discussions with the auditors, the amount was not material. Why did this problem occur? The Department lacked sufficient internal controls during Fiscal Year 2025 over its financial management and federal allowable cost compliance requirements for the CCPF program. Specifically, the Department lacked sufficient training over the calculation of its year-end accrued liabilities. The Department incorrectly calculated and recorded the year-end accrual entry in CORE, and lacked adequate internal review processes, including a supervisory review process, to ensure the program’s accrued expenditures—and ultimately amounts reported on the Exhibit K1—were accurate and complete. Why does this problem matter? By failing to have strong internal controls over the recording and monitoring of federal expenditures and revenues, the Department cannot ensure that financial records are accurate, complete, and recorded in a timely manner. Internal review and approval processes reduce the risk of material misstatements affecting federal awards. Additionally, insufficient controls over federal program requirements can lead to a lack of accountability, making it difficult to demonstrate compliance and potentially resulting in further scrutiny or penalties from federal oversight bodies. Finally, failing to properly report expenditures of federal funds on its Exhibit K1, if uncorrected, could cause the State’s overall SEFA to be inaccurate and out of compliance with federal regulations. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-044 The Department of Local Affairs should strengthen its internal controls over the financial management of federal Coronavirus Capital Projects Fund grant expenditures by implementing an adequate supervisory review process and training for staff over year-end estimates/accruals to ensure transactions are accurately recorded in the Colorado Operations Resource Engine (CORE), the State’s accounting system; and that the Exhibit K1, Schedule of Federal Assistance, is accurate and complete. Response Department of Local Affairs Agree Implementation Date: April 2026 The Department of Local Affairs (Department) agrees with the recommendation to strengthen internal controls over the financial management of federal Coronavirus Capital Projects Fund grant expenditures and the accuracy and completeness of the Exhibit K1, Schedule of Federal Assistance. The Department will develop a corrective action plan that includes enhanced procedures for the performance of year-end estimates/accruals. The Department will create and implement staff training for staff that are responsible for preparing and reviewing the estimates/accruals, the Exhibit K1, grant transactions and enhancements.

Finding 2025-045 Compliance with Reporting for Immunization Cooperative Agreements – FFATA Reporting The Department is required to comply with the Federal Funding Accountability and Transparency Act of 2006 (Transparency Act or FFATA) for its Immunization Cooperative Agreements program [ALN 93.268] (Program). The Transparency Act was created to empower Americans with the ability to hold the government accountable for each spending decision and, as a result, to reduce wasteful spending by the government. The Transparency Act requires the federal government to make certain information on federal awards available to the public, including information about amounts passed through to subrecipients. The Department is required to report information about subgrants, or subawards, given to other governments or to nonprofit organizations, also referred to as subrecipients. Federal regulation [2 CFR 200.1] defines a subaward as an award provided by a pass-through entity, in this case the Department, to an entity to carry out part of a federal grant award received by the pass-through entity. A subrecipient is defined in federal regulation [2 CFR 200.1] as an entity, usually but not limited to non-Federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other Federal awards directly from a federal awarding agency. The Department is required to submit FFATA information through the federal government’s System for Award Management website, SAM.gov. Once the Department submits a report to SAM.gov, the public can view information from the report, including the subrecipient’s name, subaward identification number, subaward obligation/action date, subaward amount, federal awarding agency and subagency, the Department’s name, and the Department’s grant award identification number. In Fiscal Year 2025, the Department reported $112.0 million in total Program expenditures. Of this amount, the Department issued $15.8 million in subawards under the Program. The Department had 70 subrecipients with subawards for which it was required to submit FFATA information through SAM.gov during the fiscal year. What was the purpose of our audit work and what work was performed? The purpose of the audit work was to determine whether the Department had adequate internal controls over and complied with FFATA reporting requirements for the Program during Fiscal Year 2025. As part of our audit work, we requested the Department’s policies and procedures over FFATA reporting and a list of all subrecipients for the Program during Fiscal Year 2025. We also inquired with Department staff about its internal control processes related to FFATA reporting. How were the results of the audit work measured? We measured the results of our audit work against the following requirements: In accordance with federal regulations [2 CFR 170, Appendix A], the Department is required to report subawards of $30,000 or more to SAM.gov by the end of the month following the month in which the award was made. For example, the Department would have to submit a FFATA report to SAM.gov in May 2025 if it made an award or supplemental award equal to or greater than $30,000 in April 2025. Federal regulations [2 CFR 200.303] require the Department to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the Department is managing its federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The Department’s policies and procedures related to FFATA reporting state that its grants accountant is responsible for performing monthly FFATA reporting. What problem did the audit work identify? We determined that the Department did not comply with FFATA reporting requirements for the Program during Fiscal Year 2025. Specifically, the Department did not submit any FFATA reports to SAM.gov for the Program’s subawards issued during Fiscal Year 2025 and, as a result, did not report approximately $15.2 million in subawards for Fiscal Year 2025. Why did this problem occur? The Department did not have adequate internal controls over federal reporting requirements in place for the Program during Fiscal Year 2025. Specifically, the Department’s existing policies and procedures were not detailed enough to ensure that FFATA reporting was completed in accordance with federal requirements. The procedures in place designated one individual who was responsible for the FFATA reporting process, but did not include procedures to identify when FFATA reporting was required for subawards or to ensure that appropriate reporting was completed when required. Additionally, the Department’s procedures did not include any secondary review process over FFATA reporting or a process to ensure that FFATA reporting had been completed as required. Why does this problem matter? By failing to properly report FFATA subawards through SAM.gov, the Department is out of compliance with federal reporting requirements, risks federal sanctions, and does not meet the federal intent of transparency for federal program spending. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-045 The Department of Public Health and Environment should strengthen its internal controls over, and ensure it complies with, the Federal Funding Accountability and Transparency Act of 2006 (FFATA) reporting requirements for its Immunization Cooperative Agreements program. This should include updating its existing policies and procedures to include a monthly review of all subawards in order to identify those required to be reported each month and a secondary review process of the FFATA reports and submissions to ensure that FFATA reporting has been completed as required. Response Department of Public Health and Environment Agree Implementation Date: July 2026 CDPHE fiscal procedures have been updated to reflect changes to the reporting process, specifically noting the recent federal website change and adding the requirement of a secondary level of review. By July 31, 2026, all outstanding FFATA reports will be filed with the federal government and the monthly review process in the updated fiscal procedures will be implemented.