Findings Citing § 200.303

2025 – 016. Period of Performance Federal Agency: Department of Transportation Federal Program Title: Highway Safety Cluster Assistance Listing: 20.600 and 20.616 Federal Grant ID Number: Various Pass-Through Entity: Not applicable Award Period: October 1, 2023, through September 30, 2024 Type of Finding: Significant deficiency in internal control over compliance Criteria: 2 CFR § 200.303 requires that the recipient or subrecipient must establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The Academy failed to provide documentation to prove the existence of an internal control. Cause: There was an absence of documented evidence to support the internal control process. Effect: The costs charged outside the period of performance may not be allowable. Questioned Costs: None, as this finding relates to missing approvals, rather than a specifically identifiable unallowable amount. Context: For one of ten expenditures tested, the CFO was unable to provide sufficient documentation of a review and approval. This is a repeat finding from the fiscal year 2024 Single Audit. The Departments stated on its Summary Schedule of Prior Year Audit Findings that this issue was “Fully Corrected with Previously Reported Corrective Action Implemented”. Due to this issue repeating for fiscal year 2025, this issue has not been fully corrected. Prior Year Single Audit Report Finding Number: 2024-016 Recommendation: We recommend that the Academy strengthen controls to ensure that documentation is maintained to support that period of performance requirements are reviewed and approved. Views of responsible officials and planned corrective actions: See management’s response on page 190.

2025 – 017. Activities Allowed or Unallowed & Allowable Costs/Costs Principles Federal Agency: Environmental Protection Agency Federal Program Title: Drinking Water State Revolving Fund Assistance Listing: 66.468 Federal Grant ID Number: Various Pass-Through Entity: Not Applicable Award Period: Various Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 2 CFR § 200.430(g)(1)(vi) requires charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. 2 CFR § 200.303 requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. Condition: The Department did not accurately calculate time and effort costs associated with the grant. Cause: The Department’s internal control did not ensure that time and effort was allocated appropriately. Effect: The Department could improperly allocate additional labor cost to the grant. Questioned Costs: $678 was the amount overcharged to program after evaluation of time and effort documentation. Context: We tested eleven individuals to ensure time and effort requirements were being properly met. We determined the Department did not properly allocate time and effort for ten of the eleven individuals tested. Prior Year Single Audit Finding Number: Not applicable Recommendation: We recommended the Department strengthen its controls to ensure that time and effort is tracked and allocated accurately. Views of responsible officials and planned corrective actions: See management’s response on page 192.

2025 – 018. Cash Management Federal Agency: Environmental Protection Agency Federal Program Title: Drinking Water State Revolving Fund Assistance Listing: 66.468 Federal Grant ID Number: Various Pass-Through Entity: Not Applicable Award Period: Various Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 2 CFR § 200.303 requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. Condition: Supporting documentation was not adequate to determine if federal reimbursement requests had a separate preparer and reviewer prior to requesting a drawdown request as required by the Department's policies and procedures. Cause: The documentation that was provided was inadequate to support that the employee who completed the drawdown request was a different individual than the employee who reviewed and approved the drawdown request prior to the reimbursement request. Effect: The Department may request improper drawdowns due to a lack of segregation of duties. Questioned Costs: None. There were no federal expenditures associated when testing this area of compliance. Context: We tested ten drawdowns for set-asides to ensure there were two different signatures approving the draw. We determined the Department did not appropriately approve any of the ten drawdowns. Prior Year Single Audit Finding Number: Not applicable Recommendation: We recommended the Department strengthen its controls to ensure proper documentation of supervisory review is maintained and that there is a segregation of duties between the individual completing the drawdown request and the individual approving the drawdown request. Views of responsible officials and planned corrective actions: See management’s response on page 193.

2025 – 019. Cash Management Federal Agency: Environmental Protection Agency Federal Program Title: Drinking Water State Revolving Fund Assistance Listing: 66.468 Federal Grant ID Number: Various Pass-Through Entity: Not Applicable Award Period: Various Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 40 CFR § 35.3560(e) a State may draw cash through the Automated Clearing House for the full amount of costs incurred for set-aside expenditures based on Environmental Protection Agency approved workplans. A State may draw cash in advance to ensure funds are available to meet State payroll expenses. However, cash should be drawn no sooner than necessary to meet immediate payroll disbursement needs. 2 CFR § 200.303 requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. Condition: The Department overdrew federal funds. Cause: The Department's internal control did not ensure that drawdown requests were supported by adequate supporting documentation prior to the reimbursement request. Effect: The Department may request and drawdown inappropriate federal funds. Questioned Costs: None, as this finding relates to the timing of federal cash drawdowns and the holding of funds in excess of 45 days needs, rather than unallowable expenditures. Context: We tested ten drawdowns for set-asides to ensure compliance requirements were being met. We determined the Department overdrew federal funds for one of ten drawdowns for a total of $8,252. Prior Year Single Audit Finding Number: Not applicable Recommendation: We recommend the Department strengthen its controls to ensure that policies and procedures are followed to ensure expenditures are incurred prior to submitting drawdown requests. Views of responsible officials and planned corrective actions: See management’s response on page 193.

2025 – 020. Activities Allowed or Unallowed and Allowable Costs/Cost Principles – Payroll and Indirect Costs Federal Agency: Environmental Protection Agency Federal Program Title: Performance Partnership Grants Assistance Listing: 66.605 Federal Grant ID Number: Various Pass-Through Entity: Not Applicable Award Period: Various Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 2 CFR §200.404 states that a cost is reasonable when the charge is consistent with the recipient’s or subrecipient’s established written personnel policies. 2 CFR § 200.430 requires that charges to federal awards for salaries and wages must be supported by accurate time and effort records that reflect the actual work performed. The records must: be supported by a system of internal controls that provides reasonable assurance payroll costs are accurate, allowable, and properly allocated; be incorporated into the recipient’s official accounting records; reasonably reflect the employee’s total compensated activity, not exceeding 100 percent of compensated time; properly allocate payroll costs when employees work on multiple cost objectives, including federal and non-federal activities; comply with the recipient’s established accounting policies and procedures. Charges should not rely solely on budget estimates unless: the estimates reasonably approximate actual work performed; significant changes in work activity are promptly identified and recorded and periodic after-the-fact reviews and adjustments are performed to ensure final charges are accurate, allowable, and properly allocated. 2 CFR § 200.303 requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The Department did not maintain adequate time and effort documentation to support salaries and wages charged to federal awards. Specifically, payroll charges were not consistently supported by records that accurately reflected actual work performed and/or did not properly document the allocation of time between federal and non-federal activities. Indirect costs are directly correlated to the payroll expenditures thus if the payroll expenditures are inaccurate then the indirect cost will also be inaccurate. Cause: The Department lacked sufficient internal controls and/or written procedures to ensure time and effort was allocated among payroll accurately. Effect: As a result, there is an increased risk that salaries and wages charged to federal awards were inaccurate, unallowable, or improperly allocated, which could result in questioned costs and noncompliance with federal grant requirements. Questioned Costs: $17,445 for payroll testing. The overall variance between hours worked and amounts paid represents the questioned costs for payroll. Unknown for journal entry testing. Indirect costs were allocated based on budgeted personnel amounts rather than actual time and effort recorded in the Personnel Cost Account System (PCAS) and discrepancies were identified during our testing of time and effort requirements. Context: We selected thirty-six individuals to ensure time and effort requirements were properly met. Eleven out of thirty-six employees tested were paid more from the grant funds than they actually worked during the pay period. Twenty-three out of thirty-six employees tested, were paid less from the grant funds than they worked during the pay period. We selected seven indirect cost transactions to ensure time and effort requirements were being met properly. Because the journal entries related to indirect cost were made based on the budget for the grant and not the actual time and effort contributed by the individual employees per the PCAS, we were unable to provide reasonable assurance that time and effort was calculated accurately. Prior Year Single Audit Finding Numbers: Not applicable Recommendation: We recommend the Department develop and/or strengthen written policies and procedures for time and effort reporting; Ensure time and effort recordings accurately reflect actual work performed and total compensated activity; Implement supervisory review of time and effort documentation; and perform periodic after-the-fact reviews and adjustments to payroll charges to ensure compliance with federal requirements. Views of responsible officials and planned corrective actions: See management’s response on page 194.

2025 – 021. Cash Management Federal Agency: Environmental Protection Agency Federal Program Title: Performance Partnership Grants Assistance Listing: 66.605 Federal Grant ID Number: Various Pass-Through Entity: Not Applicable Award Period: Various Type of Finding: Significant deficiency in internal control over compliance Criteria: 2 CFR § 200.303 requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. Condition: The Department provided documentation that does not show a separate preparer and reviewer signature. Cause: The Department lacked sufficient internal controls to ensure that the drawdowns had separate preparers and reviewers. Effect: The Department may request improper drawdowns due to a lack of segregation of duties. Questioned Costs: None: The finding is related to insufficient documentation due to lack of approval signatures and thus we do not question any of the drawdown amounts. Context: We tested six drawdowns to ensure there were two different signatures approving the draw. We determined the Department did not appropriately approve for all six drawdowns. Prior Year Single Audit Finding Numbers: Not applicable Recommendation: We recommend that the Department strengthen its controls to ensure that drawdowns are reviewed appropriately. Views of responsible officials and planned corrective actions: See management’s response on page 195.

2025 – 022. Period of Performance Federal Agency: Environmental Protection Agency Federal Program Title: Performance Partnership Grants Assistance Listing: 66.605 Federal Grant ID Number: Various Pass-Through Entity: Not Applicable Award Period: Various Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 2 CFR § 200.403(h) requires costs must be incurred during the approved budget period. 2 CFR § 200.303 requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. Condition: The Department charged costs to a grant after the grant period ended. Cause: The Department lacked sufficient internal controls to ensure all costs to grants occurred during the grant period. Effect: Costs charged outside the period of performance may not be allowable. Questioned Costs: $2,771. The six transactions that occurred outside of the Period of Performance totaled this amount. Context: We tested the one journal entry transaction that occurred during the liquidation period for a grant that ended 9/30/2024. We determined that six of the transactions involved with the journal entry occurred after the grant period ended. Prior Year Single Audit Finding Numbers: Not applicable Recommendation: We recommend that the Department strengthen its controls to ensure that costs are incurred within the grant period. Views of responsible officials and planned corrective actions: See management’s response on page 195.

2025 – 023. Activities Allowed or Unallowed and Allowable Costs/Cost Principles Federal Agencies: Department of Health and Human Services Federal Program Titles: Adoption Assistance Assistance Listings: 93.659 Federal Grant ID Numbers: Various Pass-Through Entity: Not applicable Award Period: Various Type of Finding: Significant deficiency in internal control over compliance Criteria: 2 CFR § 200.303 requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms of conditions of the federal award. Condition: The Department did not document approved payments in the accounting system. Cause: The documentation that was provided was inadequate to support that the subsidy payments were appropriately approved in the accounting system. Effect: The Department could allocate incorrect payments to the grant. Questioned Costs: None, as this finding relates to missing approvals, rather than a specifically identifiable unallowable amount. Context: For four of sixty individual payments tested, the Department did not properly document approval. Prior Year Single Audit Finding Numbers: Not applicable Recommendation: We recommend the Department strengthen internal controls to ensure that batch payments are reviewed and approved prior to submission. Views of responsible officials and planned corrective actions: See management’s response on page 196.

2025 – 024. Eligibility Federal Agencies: Department of Health and Human Services Federal Program Titles: Adoption Assistance Assistance Listings: 93.659 Federal Grant ID Numbers: Various Pass-Through Entity: Not applicable Award Period: Various Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 42 USC § 673(A)(4)(a)(iii) requires a payment may not be made pursuant to this section to parents or relative guardians with respect to a child if the State determines that the child is no longer receiving any support from the parents or relative guardians, as the case may be. 2 CFR § 200.303 requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms of conditions of the federal award. Condition: The Department did not ensure benefits were properly terminated. Cause: The Department's controls did not ensure that the child was still the legal responsibility of the parents. Effect: The Department could continue providing benefits to ineligible individuals. Questioned Costs: $532. We determined that the Department overpaid federal expenditures associated with this area of compliance requirements. Context: We tested sixty individuals to ensure they were eligible for adoption assistance. We determined the Department did not terminate benefits timely for one of the sixty individuals. Prior Year Single Audit Finding Numbers: Not applicable Recommendation: We recommend the Department strengthen internal controls to ensure that individuals are removed from the program when deemed ineligible. Views of responsible officials and planned corrective actions: See management’s response on page 196.

2025 – 025. Eligibility Federal Agencies: Department of Health and Human Services Federal Program Titles: Adoption Assistance Assistance Listings: 93.659 Federal Grant ID Numbers: Various Pass-Through Entity: Not applicable Award Period: Various Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 2 CFR § 200.303 requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms of conditions of the federal award. Condition: The Department approved inappropriate eligibility criteria documentation. Cause: The Department reviewed and approved inappropriate documentation that determines program eligibility. Effect: The Department could inappropriately deem individuals eligible. Questioned Costs: None. There were no federal expenditures associated with this area of compliance. Context: We tested sixty individuals against program eligibility requirements. We determined the Department approved inappropriate eligibility determination checklists for three of sixty individuals Prior Year Single Audit Finding Numbers: Not applicable Recommendation: We recommend the Department strengthen its internal control procedures to ensure individuals are deemed eligible using appropriate eligibility criteria. Views of responsible officials and planned corrective actions: See management’s response on page 197.

2025 – 026. Reporting Federal Agencies: Department of Health and Human Services Federal Program Titles: Refugee and Entrant Assistance-State/Replacement Designee Administered Programs Assistance Listings: 93.566 Federal Grant ID Numbers: 2201SCRSSS & 2401SCRSSS Pass-Through Entity: Not applicable Award Period: October 1, 2022 through September 30, 2025 Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 2 CFR § 200.303(a) requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. 2 CFR § 170 Appendix A requires that recipients of grants or cooperative agreements report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS) no later than the end of the month following the month in which the obligation was made. Condition: The Department did not report accurate financial information to the federal reporting agency. Cause: The Department did not fully implement the corrective action associated with this finding from the prior year. Effect: The Department reported inaccurate financial information to the federal reporting agency. Questioned Costs: None. We did not question any costs, the costs were only reported incorrectly. Context: In two of the six SF-425 reports (FFR) tested, the Department failed to report the accurate amount of expenditures either through not matching cash receipts and disbursements, not drawing upon the appropriate information from the general ledger, or failing to provide the general ledger detail to substantiate reported costs. In one of the five ORR-2 reports tested, the Department failed to report the accurate amount of expenses for administrative costs (Refugee Cash Assistance (RCA) and Refugee Medical Assistance (RMA) Administration). This took place because the underlying general ledger had an error that caused RCA and RMA administrative costs to have a credit balance. The Department appeared to make an adjustment to take from overall expenditures to eliminate the credit balances, resulting in a second layer of errors. In two of the six FFATA reports submitted, the report was not submitted by the designated deadline. Prior Year Single Audit Finding Numbers: 2024-019 and 2024-020 Recommendation: We recommend the Department strengthen its internal controls to ensure all reports are accurately prepared and submitted by the appropriate deadline. Views of responsible officials and planned corrective actions: See management’s response on page 197.

2025-027. Subrecipient Monitoring Federal Agencies: Department of Health and Human Services Federal Program Titles: Refugee and Entrant Assistance-State/Replacement Designee Administered Programs Assistance Listings: 93.566 Federal Grant ID Numbers: 2201SCRSSS & 2401SCRSSS Pass-Through Entity: Not applicable Award Period: October 1, 2022 through September 30, 2025 Type of Finding: Material weakness in internal control over compliance, material noncompliance Criteria: 2 CFR § 200.303(a) requires that the recipient and subrecipient establish and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. 2 CFR § 200.332(c) requires that all pass-through entities evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. 2 CFR § 200.332(e) requires that all pass-through entities monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition: The Department did not maintain the subrecipient monitoring and did not comply with federal subrecipient monitoring requirements. Cause: The Department has not fully implemented the corrective action associated with this finding from the prior year. Effect: The Department is not in compliance with federal subrecipient monitoring requirements. Questioned Costs: None, as the finding relates to monitoring and not unallowable expenditures. Context: The checklists were not maintained, and the Department could not provide the completed checklist to demonstrate monitoring of any subrecipients during FY 2025. For one subrecipient, the Department did not provide documentation to demonstrate that a verification was performed to confirm the subrecipient was not excluded or disqualified. Additionally, the Department failed to evaluate subrecipients for risks, create a monitoring plan that considered those risks, or sufficiently monitor and address the audit findings of the subrecipient. Prior Year Single Audit Finding Number: 2024-021 Recommendation: We recommend the Department continue its efforts to strengthen their current policies and procedures and to ensure that the subrecipient monitoring checklist is being completed and maintained. Views of responsible officials and planned corrective actions: See management’s response on page 198.

2025 – 028. Eligibility – Refugee Cash Assistance (RCA) Federal Agencies: Department of Health and Human Services Federal Program Titles: Refugee and Entrant Assistance-State/Replacement Designee Administered Programs Assistance Listings: 93.566 Federal Grant ID Numbers: 2201SCRCMA & 2401SCRCMA Pass-Through Entity: Not applicable Award Period: October 1, 2021 through September 30, 2025 Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 2 CFR § 200.303(a) requires that the recipient and subrecipient establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Standards for Internal Control in the Federal Government (the Green Book) as issued by the Comptroller General of the United States emphasize that "The effectiveness of a detective control activity depends on timeliness" (10.10) and when detective controls are employed "management strengthens and expedites detective control activities and may also expedite monitoring activities to enable the entity to effectively mitigate the risk to acceptable levels" (10.13). Condition: The Department did not maintain controls over eligibility for this program, forms necessary for determining eligibility were not appropriately completed, forms completed were not completed in a timely fashion. Cause: The Department did not develop a control with a 100% implementation target and is utilizing un-auditable stop-gap measures such as live documents to facilitate processing of program participant applications. Effect: The Department’s system can fail to catch errors in each applicant’s application or payments and has resulted in overcharging grants. Questioned Costs: $15,126. Payments to program participants with control findings. Context: The following discrepancies were encountered during our testing of forty-nine case files. • The Department did not have a preventive control to ensure all RCA eligibility criteria were reviewed, as the existing Quality Assurance Checklist was not designated to check all cases or be timely. • In the files of thirty-eight, the Authorization of Refugee Cash Assistance Payment (Form 1325) was not signed until after it had been approved and payments had already been issued, and for six cases, the form was either not dated or had no sign-offs at all. • We noted that applicant reviews and aid amount authorizations for the Refugee Employment Services Registration/Participation Status form and the Notification of Eligibility Determination for Refugee Resettlement Program form (Forms 1324 and 1326, respectively) were completed after applicants had already begun receiving aid, resulting in grant overcharges. • In forty-one cases, the employment service provider did not return Part II of the Form 1324, which, according to the form instructions, must be submitted prior to approval of RCA benefits. • In one case, Form 1326 did not specify the date on which participant payments would end, which is needed to evaluate compliance with the eligibility period. Prior Year Single Audit Finding Number: 2024-018 Recommendation: We recommend the Department continue its efforts to strengthen their current policies and procedures and to ensure that all RCA applicants are reviewed with the quality assurance audit checklist and that all appropriate forms are signed, dated, and reviewed in a timely manner. Views of responsible officials and planned corrective actions: See management’s response on page 198.

2025 – 030. Activities Allowed or Unallowed & Allowable Costs/Cost Principles Federal Agencies: Department of Health and Human Services Federal Program Titles: Refugee and Entrant Assistance-State/Replacement Designee Administered Programs Assistance Listings: 93.566 Federal Grant ID Numbers: 2201SCRCMA, 2401SCRCMA, 2201SCRSSS & 2401SCRSSS Pass-Through Entity: Not applicable Award Period: October 1, 2021 through September 30, 2025 Type of Finding: Material weakness in internal control over compliance, material noncompliance Criteria: 2 CFR § 200.303(a) requires that the recipient and subrecipient establish and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: Expenditures charged to the program were not adequately supported or were inappropriate. Cause: The Department did not maintain appropriate review and approval controls over program participant payments to RCA and RMA participants nor over invoice payments to subrecipients. Effect: The federal grants were overcharged through payments for unallowable costs or reimbursing ineligible program participants. Questioned Costs: $876,636. Payments for insufficiently reviewed invoices or to ineligible program participants Context: We identified several payments made to subrecipients that the Department did not review nor did the Department retain documentation at the appropriate level of detail to support the allowability of the costs. We noted that the Department did not have the details on RMA program participants (determined and paid via the South Carolina Department of Health and Human Services) sufficient to verify that the payments were allowable. Multiple ineligible payments were made (see finding 2025-029). Prior Year Single Audit Finding Number: 2024-017 Recommendation: We recommend that the Department ensure appropriate controls over subrecipient payments and payments to program participants. Views of responsible officials and planned corrective actions: See management’s response on page 200.

2025 – 031. Period of Performance Federal Agency: Department of Health and Human Services Federal Program Title: CCDF Cluster Assistance Listing: 93.575, 93.596, and 93.489 Federal Grant ID Number: 2201SCCCDD Pass-Through Entity: Not applicable Award Period: October 1, 2021, through September 30, 2024 Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 45 CFR § 98.60(d)(1) requires that discretionary funds (Assistance Listing 93.575) be obligated in the fiscal year in which funds are awarded or in the succeeding fiscal year. Unliquidated obligations as of the end of the succeeding fiscal year shall be liquidated within one year. 2 CFR § 200.303 requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. 2 CFR § 200.403(h) requires costs be incurred during the approved budget period. Condition: Expenditures were incurred after the end of the grant’s period of performance. Cause: The Department’s internal controls failed to identify and prevent charging costs incurred outside the applicable period of performance. Effect: Costs charged outside the period of performance may not be allowable. Questioned Costs: $11 is based on the sum of the three transactions that incurred program expenditures that were outside of the period of performance Context: Three of sixty expenditure transactions tested had incurred program expenditures at the end of the obligation period that were not obligated and expended in accordance with program requirements. Prior Year Single Audit Finding Number: Not applicable Recommendation: We recommend the Department review and update internal controls to ensure all expenditures charged to federal awards are incurred within the grant's period of performance. Views of responsible officials and planned corrective actions: See management’s response on page 200.

2025 – 032. Reporting Federal Agencies: Department of Health and Human Services Federal Program Titles: CCDF Cluster Assistance Listings: 93.575 Federal Grant ID Numbers: 2302SCCCDD & 2402SCCCDD Pass-Through Entity: Not applicable Award Period: Various Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 2 CFR § 170 Appendix A requires that recipients of grants or cooperative agreements report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS) no later than the end of the month following the month in which the obligation was made. 2 CFR § 200.303(a) requires that the recipient and subrecipient must establish and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms of conditions of the federal award. Condition: The Department did not report accurate financial information to the federal reporting agency. Cause: The Department's internal control failed to ensure retention of documentation. Effect: The Department could fail to appropriately report the FFATA. Questioned Costs: None. There were no federal expenditures associated with this area of compliance. Context: In our testing of the four subrecipients, it was determined that the department could not provide the FFATA submission documentation for one of them. Prior Year Single Audit Finding Numbers: Not applicable Recommendation: We recommend that the Department strengthen its internal controls to ensure that FFATA reports are submitted and documented appropriately. Views of responsible officials and planned corrective actions: See management’s response on page 201.

2025 – 033. Reporting and Earmarking Federal Agencies: Department of Health and Human Services Federal Program Titles: CCDF Cluster Assistance Listings: 93.575 and 93.596 Federal Grant ID Numbers: 2201SCCCDD and 2201SCCCDF Pass-Through Entity: Not applicable Award Period: October 1, 2021, through September 30, 2024 Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 2 CFR § 200.303(a) requires that the recipient and subrecipient must establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms of conditions of the federal award. 45 CFR § 98.50(f) requires that the Lead Agency shall: (1) Reserve the minimum amount required under paragraph (b) of section 45 CFR § 98.50 for quality activities, and the funds for administrative costs described at paragraph (d) of section 45 CFR § 98.50; and (2) From the remainder, use not less than 70 percent to fund direct services (provided by the Lead Agency). Condition: The Department did not ensure four key line-items were accurately reported on the financial report. Cause: The Department's internal controls failed to prevent inaccurate reporting of expenditures. Effect: The accuracy of the financial report could not be validated. Questioned Costs: None. We did not question any costs, the costs were only reported incorrectly. Context: In our testing of four key line-items, it was determined that the department miscategorized transactions when grouping the line-item totals on the report. Prior Year Single Audit Finding Numbers: Not applicable Recommendation: We recommend the Department strengthen its internal controls to ensure all reports are accurately prepared and submitted. Views of responsible officials and planned corrective actions: See management’s response on page 201.

2025 – 034. Eligibility Federal Agency: Department of Agriculture Federal Program Title: Child and Adult Care Food Program Assistance Listing: 10.558 Federal Grant ID Number: 5SC300329 Pass-Through Entity: Not Applicable Award Period: October 1, 2023, through September 30, 2025 Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: Per 7 CFR 226.6(b)(3), any new or renewing institution applying for participation in the Program must be notified in writing of approval or disapproval by the State agency, within thirty calendar days of the State agency's receipt of a complete application. 2 CFR § 200.303 requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The Department was unable to provide documentation to verify seven institutions were notified of approval or disapproval within thirty calendar days of the State agency's receipt of a completed application. Cause: Internal controls failed to ensure that subrecipients were notified of approval/disapproval. Effect: Without adequate controls in place, the Department will not be in compliance with eligibility requirements. Questioned Costs: None. There were no federal expenditures associated when testing this area of compliance. Context: The Department could not provide supporting documentation that seven out of sixty subrecipients tested received notification of approval/disapproval within thirty calendar days of completion of application. Prior Year Single Audit Finding Number: Not Applicable Recommendation: We recommend the Department strengthen controls to ensure that documentation exists that subrecipients were notified of approval/disapproval. Views of responsible officials and planned corrective actions: See management’s response on page 201.

2025 – 035. Reporting Federal Agency: Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Assistance Listing: 93.558 Federal Grant ID Numbers: 2201SCTANF and 2501SCTANF Pass-Through Entity: Not applicable Award Period: Various Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 45 CFR § 265.7(a) requires that each state's quarterly reports, including the TANF Data Report, be complete and accurate. 2 CFR § 200.303 requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. Condition: Discrepancies existed between the ACF-199 (TANF Data Report) and the Department’s records. The agency did not comply with their approved corrective action plan for formal documentation of report review. Cause: The incorrect source data was utilized when completing the referenced data element on the performance report. Effect: Some of the data fields reported on the ACF-199 report are inconsistent with the supporting case records. Questioned Costs: None. There were no federal expenditures associated when testing this area of compliance. Context: Key data elements for ten families were tested from one quarterly ACF-199 report. A discrepancy was noted for one data element related to recording the number of months countable towards the federal time limit for assistance. This is a repeat finding from the fiscal year 2024 Single Audit. The Department stated on its Summary Schedule of Prior Year Audit Findings that this issue was “Fully Corrected with Previously Reported Correction Action Implemented”. Due to this issue repeating for fiscal year 2025, this issue has not been fully corrected. Prior Year Single Audit Finding Number: 2024-024 Recommendation: We recommend that the Department strengthen its processes to ensure that federal reports are free from error prior to submission. We also recommend that the Department update and review processes to ensure proper documentation of supervisory review is maintained. Views of responsible officials and planned corrective actions: See management’s response on page 202.

2025 – 036. Activities Allowed or Unallowed and Allowable Costs/Cost Principles Federal Agency: Department of Housing and Urban Development Federal Program Title: Community Development Block Grants/State's program and Non-Entitlement Grants in Hawaii Assistance Listing: 14.228 Federal Grant ID Number: Various Pass-Through Entity: Not applicable Award Period: Various Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 2 CFR § 200.405(a) states that a cost is allocable to a Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received. 2 CFR § 200.303 requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. Condition: Costs charged to the program were not adequately allocated. Cause: The Office failed to ensure costs were properly allocated based upon the approved cost allocation plan for FY25. Effect: The potential for overcharging the grant exists when costs charged to the federal award are not properly allocated. Questioned Costs: $12,949. The Disaster Relief and Mitigation grants were overcharged by $4,316 and $8,633, respectively. Context: One of twenty-two expenditures tested had costs improperly charged to the federal award. The transaction involved allowable charges that benefited multiple grant programs and activities but were not properly allocated to match the Office’s cost allocation plan for FY25. Prior Year Single Audit Report Finding Number: Not applicable Recommendation: We recommend the Office review and update its procedures to ensure all costs charged to the grant are properly allocated to applicable grants and funding sources based upon their yearly cost allocation plan. Views of responsible officials and planned corrective actions: See management’s response on page 203.

2025 – 037. Reporting Federal Agency: Department of Housing and Urban Development Federal Program Title: Community Development Block Grants/State's program and Non-Entitlement Grants in Hawaii Assistance Listing: 14.228 Federal Grant ID Number: Various Pass-Through Entity: Not applicable Award Period: Various Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 2 CFR § 170 Appendix A requires that recipients of grants or cooperative agreements report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System. 2 CFR § 200.303 requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. Condition: The Department did not submit FFATA reports on time for FY25. Cause: The Department lacked sufficient internal controls and/or written procedures to ensure FFATA reports were submitted on time. Effect: The Department was not in compliance with FFATA reporting requirements. Questioned Costs: None, as it relates to timely reporting, rather than unallowable expenditures Context: Eight of the forty FFATA reports tested were submitted after the reporting deadline. Prior Year Single Audit Finding Number: Not applicable Recommendation: We recommend that the Department implement procedures to ensure reports are submitted in compliance with FFATA reporting requirements. Views of responsible officials and planned corrective actions: See management’s response on page 204.

2025 – 038. Activities Allowed or Unallowed and Allowable Costs/Cost Principles Federal Agency: Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing: 21.027 Federal Grant ID Number: None Provided Pass-Through Entity: Not applicable Award Period: March 3, 2021, through December 31, 2026 Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 45 CFR § 75.403 (a) costs must be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. 2 CFR § 200.302 (b)(3) states each recipient’s and subrecipient’s financial management system must provide maintaining records that sufficiently identify the amount, source, and expenditure of Federal funds for Federal awards. These records must contain information necessary to identify Federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. 2 CFR § 200.303 requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. Condition: Amounts charged to the program did not agree to the supporting invoices. Cause: The Department’s review process and internal controls did not detect discrepancies between the invoiced amounts and the amounts recorded and charged to the grant. Effect: Program expenditures were not accurately recorded in the Department’s financial records. Questioned Costs: None, as this finding relates to an underpayment. Context: One out of four transactions tested, the amount charged to the Federal program did not agree to the amount reflected on the supporting invoice. The Department recorded and reimbursed an amount that was less than the invoiced amount, resulting in an underpayment totaling $313. This is a repeat finding from the fiscal year 2024 Single Audit. The Office stated on its Summary Schedule of Prior Year Audit Findings that this issue was “Fully Corrected with Previously Reported Corrective Action Implemented”. Due to this issue repeating for fiscal year 2024, this issue has not been fully corrected. Prior Year Single Audit Report Finding Number: 2024-026 Recommendation: We recommend that the Department strengthen controls to ensure the review process includes verification that amounts charged to the grant agree to the supporting invoices prior to reimbursement. Views of responsible officials and planned corrective actions: See management’s response on page 206.

2025 – 039. Reporting and Matching Federal Agency: Department of Health and Human Services Federal Program Title: Maternal and Child Health Services Block Grant to the States Assistance Listing: 93.994 Federal Grant ID Number: B04MC47445 Pass-Through Entity: Not Applicable Award Period: October 1, 2022, through September 30, 2024 Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 2 CFR § 200.303(a) requires that the recipient and subrecipient establish and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: Discrepancies existed between the Federal Financial Report (FFR) and the accounting system. In addition, although the Department met their matching requirement, the Department’s calculation did not align with expenditures from the accounting system. Cause: For the recipient share of expenditures reported on the FFR, the Department reported the matching amount included on the grant award document instead of the calculated match prepared by the Budget Analyst. For indirect costs, the base expenditures were not reported with the correct applicable rate for each applicable period. Finally, the internal database the Department used to make the matching calculation contained incomplete expenditure data causing an incorrect calculation. The Department’s internal controls failed to detect that the expenditures in the internal database did not reconcile with the actual expenditures from the accounting system. Effect: The Department’s control procedures did not detect the calculation errors identified in our testing. Questioned Costs: None, as the finding relates to reporting requirements, and the Department met their matching requirement. Context: We tested the sole FFR report submitted during fiscal year 2025 and identified reporting discrepancies in financial data related to the recipient share of expenditures and indirect expenditures. In addition, we noted that the Department’s calculation of the state match differed from the recipient share of expenditures reported on the FFR and was based on inaccurate data. Prior Year Single Audit Finding Number: Not applicable Recommendation: We recommend the Department strengthen its internal controls and processes to ensure that federal reports are free from error prior to submission and that matching calculations are based on accurate accounting records. Views of responsible officials and planned corrective actions: See management’s response on page 207.

2025 – 040. Earmarking and Level of Effort Federal Agency: Department of Health and Human Services Federal Program Title: Maternal and Child Health Services Block Grant to the States Assistance Listing: 93.994 Federal Grant ID Number: Various Pass-Through Entity: Not Applicable Award Period: Various Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 42 USC 704(d) requires that a state may not use more than ten percent of allotted funds for administrative expenses. 42 USC 705(a)(4) requires that the state must maintain the level of funds provided solely by the state for maternal and child health programs at a level at least equal to the level provided in fiscal year 1989. 2 CFR § 200.303(a) requires that the recipient and subrecipient establish and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The Department was not in compliance with the ten percent administrative expenses requirement. In addition, although the Department exceeded the level of effort requirement threshold, the calculated amount was less than what was actually expended. Cause: The internal database the Department used to calculate the earmarking and level of effort requirements contained incomplete expenditure data causing incorrect calculations. The Department’s internal controls failed to detect that the expenditures in the internal database did not reconcile with the actual expenditures from the accounting system. Effect: The Department’s control procedures did not detect the calculation errors identified in our testing, which leads to an increased risk of not meeting earmarking or level of effort requirements. Questioned Costs: Questioned costs totaled $142,775 as this was the amount expended over the allotted ten percent earmarking threshold for administrative expenses. There were no questioned costs related to the level of effort requirement. Context: The Department reviews the earmarking and level of effort calculations and reports these amounts as part of the annual Maternal and Child Health Services Block Grant Application/Annual Report. We selected for testing the most recently submitted 2025 report which contain expenditure details related to fiscal year 2024 and noted discrepancies between Department support and the accounting system. Prior Year Single Audit Finding Number: Not applicable Recommendation: We recommend the Department strengthen its controls to ensure that earmarking and level of effort calculations are based on accurate data from the accounting system. Views of responsible officials and planned corrective actions: See management’s response on page 208.

2025 – 041. Period of Performance Federal Agency: Department of Health and Human Services Federal Program Title: Maternal and Child Health Services Block Grant to the States Assistance Listing: 93.994 Federal Grant ID Numbers: B04MC47445 and B04MC54575 Pass-Through Entity: Not Applicable Award Period: October 1, 2022, through September 30, 2026 Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 2 CFR § 200.403(h) requires costs to be incurred during the approved budget period. Criteria: 2 CFR § 200.303(a) requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: Expenditures were incurred and charged outside of the period of performance. Cause: The Department’s internal controls failed to identify and prevent charging costs incurred outside the applicable period of performance. Effect: Costs charged outside the period of performance may not be allowable. Questioned Costs: $1,338. The amount is based on the sum of the five transactions that had incurred program expenditures outside of the applicable period of performance date. Context: For a total of sixty expenditure transactions tested, one transaction had costs that were incurred before the start of the period of performance date and four transactions had incurred program expenditures that were not obligated and expended in accordance with program requirements. Recommendation: We recommend the Department review and update its internal controls to ensure that all expenditures charged to federal awards are incurred within the grant's period of performance. Prior Year Single Audit Finding Number: Not applicable Views of responsible officials and planned corrective actions: See management’s response on page 209.

2025 – 042. Reporting Federal Agency: Department of Health and Human Services Federal Program Title: Maternal and Child Health Services Block Grant to the States Assistance Listing: 93.994 Federal Grant ID Number: Various Pass-Through Entity: Not Applicable Award Period: Various Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 2 CFR § 200.303(a) requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: Discrepancies existed between the Maternal and Child Health Services Block Grant Application/Annual Report and the accounting system. Cause: The internal database the Department used to compile the report contained incomplete expenditure data causing incorrect calculations. The Department’s internal controls failed to detect that the expenditures in the internal database did not reconcile with the actual expenditures from the accounting system. Effect: Although the Department still met matching and earmarking requirements, several reported amounts of 2023 expenditures were not accurately stated within the report. Questioned Costs: None, as this finding relates to reporting requirements, rather than unallowable expenditures. Context: For the sole Maternal and Child Health Services Block Grant Application/Annual Report submitted during fiscal year 2025, the Department reported inaccurate expended fiscal year 2023 data on Form 2 including amounts related to state matching and earmarking requirements. Prior Year Single Audit Finding Number: Not applicable Recommendation: We recommend the Department strengthen procedures to ensure accurate filing of the Maternal and Child Health Services Block Grant Application/Annual Report. Views of responsible officials and planned corrective actions: See management’s response on page 209.

2025 – 043. Cash Management Federal Agency: Department of Health and Human Services Federal Program Title: Immunization Cooperative Agreements and Centers for Disease Control and Prevention Collaboration with Academia to Strengthen Public Health Assistance Listing: 93.268 and 93.967 Federal Grant ID Numbers: Various Pass-Through Entity: Not applicable Award Period: Various Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 2 CFR § 200.303(a) requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. 2 CFR § 205.11(a) requires a State and a Federal Program Agency must minimize the time elapsing between the transfer of funds from the United States Treasury and the State's payout of funds for Federal assistance program purposes, whether the transfer occurs before or after the payout of funds. Condition: Supporting documentation was not adequate to determine if federal reimbursements were properly reviewed and approved by a programmatic supervisor prior to requesting a drawdown as required by the Department’s policies and procedures. In addition, some draws were made in excess of allowable incurred expenditures. Cause: The Department failed to retain documentation demonstrating performance of a programmatic supervisory review and approval. In addition, Department controls failed to detect potential overcharging of the grant. Effect: The Department may drawdown funds in excess of eligible reimbursable expenditures. Questioned Costs: Total questioned costs could not be determined due to the Department’s methodology of calculating grant draws. Context: The following discrepancies were encountered during testing of cash management: • Five of seven Immunization Cooperative Agreements drawdowns and six of eight Centers for Disease Control and Prevention Collaboration with Academia to Strengthen Public Health drawdowns selected for testing lacked sufficient documentation to confirm whether the federal reimbursement requests had a separate and appropriate preparer and reviewer prior to requesting a drawdown. • In addition, each respective program had one tested drawdown where the requested grant reimbursement amount was greater than the eligible costs recorded in the accounting system. Prior Year Single Audit Finding Number: Not applicable Recommendation: We recommend the Department strengthen its controls to ensure that drawdowns are reviewed appropriately and that drawdowns are reconciled to grant expenditures prior to the submission of the reimbursement request to prevent overdrawing the grant. Views of responsible officials and planned corrective actions: See management’s response on page 210.

2025 – 044. Special Tests and Provisions Federal Agency: Department of Health and Human Services Federal Program Title: Immunization Cooperative Agreements Assistance Listing: 93.268 Federal Grant ID Number: Various Pass-Through Entity: Not Applicable Award Period: Various Type of Finding: Significant deficiency in internal control over compliance Criteria: The Office of Management and Budget’s (OMB) 2025 Compliance Supplement states that effective control and accountability must be maintained for all vaccines under the Vaccines for Children (VFC) program. Vaccines must be adequately safeguarded and used solely for authorized purposes in accordance with guidance set forth in 42 USC 1396s. To comply with this requirement, the Department’s Vaccines for Children Operation Guide requires that all completed VFC compliance site visits be reviewed by the VFC coordinator, immunization program manager, or a designee. 2 CFR § 200.303(a) requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The Department did not perform a review and approval of a VFC compliance site visit in accordance with its policies. Cause: Due to staffing turnover, there were delays in reviewing compliance visits. Effect: In the absence of a compliance visit review, providers could have unresolved issues that could affect the quality and quantity of vaccines provided to VFC recipients. Questioned Costs: None, as this finding relates to an untimely approval of a compliance site visit, rather than unallowable expenditures. Context: For sixty providers selected for testing, one compliance site visit did not have approval completed by the VFC Coordinator, Immunization Program Manager, or a designee. Prior Year Single Audit Finding Number: Not applicable Recommendation: We recommend the Department ensure compliance visits are reviewed in accordance with Department policy. Views of responsible officials and planned corrective actions: See management’s response on page 211. Auditor’s Conclusion: The compliance site visit where we noted the untimely review was performed on June 6, 2025. Although the Department had been tracking and monitoring the site visit, it was not reviewed or approved by the VFC-Coordinator or their designee as of our audit fieldwork in early February of 2026. Based on our audit inquiries, the documentation relating to the provider’s compliance site visit was updated, which enabled the site visit to be approved a few days later. We understand there were difficulties with staffing turnover, but in instances of prolonged vacancies, there should be policies to help reduce the timing between when site visits are conducted and when they can be reviewed.

2025 – 045. Activities Allowed or Unallowed and Allowable Costs/Cost Principles Federal Agency: Department of Health and Human Services Federal Program Title: Centers for Disease Control and Prevention Collaboration with Academia to Strengthen Public Health Assistance Listing: 93.967 Federal Grant ID Number: NE11OE000041 Pass-Through Entity: Not Applicable Award Period: December 1, 2023, through November 30, 2025 Type of Finding: Significant deficiency in internal control over compliance Criteria: 2 CFR § 200.303(a) requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms of conditions of the federal award. Condition: The Department did not maintain appropriate documentation supporting the review and approval over one journal entry. Cause: The Department failed to retain documentation demonstrating performance of a supervisory review and approval. Effect: Without a proper supervisory review, there is an increased risk that the Department could allocate unallowable costs to the grant. Questioned Costs: None, as the issue is only related to the review of the entry and not unallowable expenditures. Context: For one of seventy transactions selected for testing, supporting documentation was not adequate to demonstrate that a proper review and approval by a programmatic supervisor occurred on the journal entry form. Prior Year Single Audit Finding Number: Not applicable Recommendation: We recommend the Department strengthen controls to ensure that documentation is maintained to support that costs charged to the grant were properly reviewed and approved for allowability. Views of responsible officials and planned corrective actions: See management’s response on page 212.

2025 – 046. Suspension and Debarment Federal Agency: Department of Health and Human Services Federal Program Titles: Centers for Disease Control and Prevention Collaboration with Academia to Strengthen Public Health and Epidemiology and Laboratory Capacity for Infectious Disease (ELC) Assistance Listings: 93.967 and 93.323 Federal Grant ID Number: Various Pass-Through Entity: Not Applicable Award Period: Various. Type of Finding: Significant deficiency in internal control over compliance, other matters. Criteria: 2 CFR § 180.300 requires that when a non-federal entity enters into a covered transaction (contracts for goods and services that are expected to equal or exceed $25,000, as well as all subawards to subrecipients, irrespective of award amount) with an entity at a lower tier, the non-Federal entity must verify that the entity is not suspended or debarred or otherwise excluded from participating in the transaction. The regulation lists several permitted methods for verification, including checking the System for Award Management (SAM.gov) Exclusions maintained by the United States General Services Administration. Criteria: 2 CFR § 200.303(a) requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms of conditions of the federal award. Condition: Compliance with suspension and debarment regulations could not be confirmed for one vendor contract. Cause: The Department was unable to locate the documentation demonstrating that they checked the SAM.gov Exclusions for that vendor. Effect: The Department’s compliance with federal suspension and debarment requirements was not supported by adequate documentation. Questioned Costs: None, as the finding is related to insufficient verification documentation rather than unallowable expenditures. Context: The Department verifies suspension and debarment through checking SAM.gov Exclusions. For one out of six vendors tested, the Department was unable to provide support that they checked the SAM.gov Exclusions. Suspension and debarment is performed on an agencywide basis for all grant programs. In the fiscal year 2024 Single Audit, there was a similar finding for the Epidemiology and Laboratory Capacity for Infectious Disease (Assistance Listing Number 93.323) program. The Department stated on its Summary Schedule of Prior Year Audit Findings that this issue was “Fully Corrected” with Previously Reported Corrective Action Implemented”. Due to this issue repeating for fiscal year 2025, the issue has not been fully corrected. Prior Year Single Audit Finding Number: 2024-032 for Epidemiology and Laboratory Capacity for Infectious Disease (ELC) (Assistance Listing Number 93.323). Recommendation: We recommend the Department consistently adhere to its procedures including maintaining the SAM.gov Exclusions check for all applicable vendors. Views of responsible officials and planned corrective actions: See management’s response on page 212.

2025 – 047. Equipment and Real Property Management Federal Agency: Department of Health and Human Services Federal Program Title: Public Health Emergency Preparedness and Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis Response Assistance Listing: 93.069 and 93.354 Federal Grant ID Number: Various Pass-Through Entity: Not applicable Award Period: Various Type of Finding: Significant deficiency in internal control over compliance, other matters Criteria: 2 CFR § 200.303 requires that the recipient and subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. 2 CFR § 200.313(d)(1) requires property records include a description of the property, a serial number or another identification number, the source of funding for the property (including the Federal Award Identification Number (FAIN)), the title holder, the acquisition date, the cost of the property, the percentage of the Federal agency contribution towards the original purchase, the location, use, and condition of the property, and any disposition data including the date of disposal and sale price of the property. Condition: The Department was not in compliance with several equipment and real property requirements. Cause: The Department’s processes did not ensure that assets transferred during the transition from the Department of Health and Environmental Control (DHEC) to the Department of Public Health (DPH) were properly associated with the applicable federal funding source or grant information within the asset management system. Effect: Incomplete property records increase the risk that equipment purchased with federal funds may not be properly tracked, monitored, or reported in accordance with federal regulations. Questioned Costs: None, as this finding relates to equipment record keeping, rather than unallowable expenditures. Context: During follow-up procedures related to equipment and real property management, the Department provided an asset history listing for review. However, the listing did not clearly identify assets purchased with federal funds. Additionally, assets transferred from DHEC to DPH in the South Carolina Enterprise Information System (SCEIS) were not associated with a federal funding source or specific grant. As a result, the Department was unable to demonstrate that equipment purchased with federal funds was being tracked in accordance with federal requirements. In addition, since assets were not listed under federal grants, we were unable to obtain a population to test whether assets bought with federal grants were accounted for in the Department’s annual physical inventory. This is a repeat finding from the fiscal year 2023 Single Audit. The Office stated on its Summary Schedule of Prior Year Audit Findings that this issue was “Fully Corrected with Previously Reported Corrective Action Implemented”. Due to this issue repeating for fiscal year 2023, this issue has not been fully corrected. Prior Year Single Audit Report Finding Number: 2023-026 Recommendation: We recommend the Department strengthen procedures to ensure equipment purchased with federal funds is properly tracked and associated with the applicable federal funding source within the asset management system and property records should include all elements required by federal regulations. Views of responsible officials and planned corrective actions: See management’s response on page 213.

WIC Special Supplemental Nutrition Program for Women, Infants, and Children—Service Organization Controls Background: The U.S. Department of Agriculture provides funding to DHS for the WIC program. This program provides funds to assist states in providing benefits to purchase specified supplemental foods to low-income pregnant, breastfeeding, and postpartum women, infants, and children up to age 5 who have been determined to be at nutritional risk. To administer the WIC program, DHS contracts with local agencies that are responsible for assessing nutritional risks, determining eligibility, and entering the participant information into the Real-time Online Statewide Information Environment (ROSIE) system, which is maintained by the State. ROSIE includes information on the participant and the benefits authorized. Each eligible participant receives an electronic benefits transfer (EBT) card to purchase supplemental foods at authorized WIC vendors. Each participant and WIC vendor can access account data using a portal application that retrieves information from ROSIE and the EBT system. In addition to the local WIC agencies, DHS contracts with three providers that support the information technology (IT) systems used for administering the WIC program, including ROSIE, the participant and vendor portals, and the EBT system. First, DHS contracts with a support provider that is responsible for supporting ROSIE and the participant and vendor portals. The support provider provides system access to approved users, makes approved updates to the system, and provides help-desk functions for these systems. Second, because ROSIE and the participant and vendor portals are stored on servers in a cloud data-hosting environment not managed by the support provider, DHS contracts with a cloud provider that is responsible for maintaining and securing the servers that host these systems. Third, DHS contracts with an EBT provider that is responsible for providing the EBT cards issued to participants and maintaining a separate EBT system that is used in settling food purchases with vendors, providing information to DHS related to purchases, and maintaining accurate EBT card balances. Criteria: Under 2 CFR 200.303, DHS is responsible for establishing and maintaining effective internal control to provide reasonable assurance that federal awards are managed in compliance with federal statutes, regulations, and the award terms and conditions. Effective internal controls should include monitoring and assessing the controls for contractors that are responsible for maintaining and securing an IT system that is used to comply with federal requirements. Because these contractors are relied on for the confidentiality, integrity and availability of data related to eligibility determinations and benefits, effective internal controls at these contractors are critical. Weaknesses in a contractor’s internal controls could increase the risk of noncompliance with federal requirements. Assurances related to the internal controls of a contractor could be gained through a service organization controls audit report, which includes a report on the effectiveness of the service organization’s internal controls by an independent auditor. These reports also include complementary user entity controls that can be used to determine the controls that should be in place by the agency using the contractor. Alternatively, if a contractor does not obtain a service organization controls audit report, the agency using a contractor should ensure it has assessed the relevant internal controls of the contractor and that the contractor has implemented procedures to ensure the confidentiality, integrity, and availability of data maintained by the contractor. Condition: DHS did not sufficiently consider the controls in place for all three contractors—the support provider, the cloud provider, and the EBT provider—that maintain the IT systems used in administering the WIC program. For instance, DHS had no documentation of a review being completed of the service organization controls audit report for the cloud provider, including a review of identified weaknesses or an assessment of the identified complementary user entity controls related to ROSIE or the participant and vendor portal systems maintained by this contractor. Although a review of the available service organization controls audit reports for the EBT provider was completed by a separate division within DHS, the results of this review were not considered by WIC program staff and the assessment of the complementary user entity controls did not consider the IT systems used in administering the WIC program. Context: We discussed with DHS the different contractors involved in managing ROSIE and the participant and vendor portal systems used in administering the WIC program, as well as the contractor used in providing the EBT cards and managing the EBT system. We discussed the procedures in place to monitor the activities of these contractors. We requested and obtained from DHS the available service organization controls audit reports related to the cloud provider for the period ended September 30, 2024. We also obtained from DHS the service organization controls audit reports related to the EBT provider for the period ended September 30, 2024, and September 30, 2025. We reviewed these reports and discussed with DHS the procedures for obtaining and reviewing these reports, including an assessment of complementary user entity controls. Questioned Costs: None. Effect: DHS and the federal government cannot be assured that controls are in place and effective related to the IT systems used in determining eligibility, determining appropriate benefits, and accurately maintaining EBT card information for WIC participants. Cause: Management of the IT systems used in providing benefits to eligible WIC participants, including ROSIE, the participant and vendor portal systems, and the EBT system, is complex and requires coordination between DHS, the support provider, the cloud provider, and the EBT provider. DHS does not have sufficient procedures in place to ensure it is adequately monitoring and documenting its oversight for these contractors, which provide support and security for the IT systems used in administering the WIC program. DHS indicated that turnover in the position that had been responsible for oversight of the support providers in FY 2024-25 may have affected its monitoring and oversight. In 2022, at the time DHS entered into the contract with the support provider, DHS obtained an assessment completed by the support provider that detailed security processes and the support provider’s responsibilities related to the cloud provider. DHS staff indicated that this security assessment had not been updated because there have been limited changes to the IT environment. Further, the cloud provider was procured through a statewide contract, and DHS staff indicated that the Department of Administration (DOA) would be responsible for reviewing the service organization controls audit report. However, DOA does not maintain the IT systems used in administering the WIC program, and DHS is responsible for reviewing the service organization controls audit report and the complementary user entity controls needed to ensure the confidentiality, integrity, and availability of data related to WIC eligibility determinations and WIC benefits. Although DHS centrally obtains the service organization controls audit reports for the EBT provider annually, the review did not address the IT systems used in administering the WIC program. It is expected that DHS would work with the support provider to complete its review. For instance, to provide assurance that controls continue to be in place, DHS may choose to request a security assessment similar to the one that had been performed in a prior year. Further, DHS may need to work with the support provider in assessing the service organization controls audit reports for the cloud provider and the EBT provider to consider the effect on the IT systems used in administering the WIC program, determine which complementary user entity controls are relevant, and determine whether adequate controls are in place. DHS should complete this assessment and document the results on an annual basis. Recommendation: We recommend the Wisconsin Department of Health Services: -develop and document procedures to complete an annual assessment of the controls in place by each contractor that provides support and security for an IT system used in administering the WIC Special Supplemental Nutrition Program for Women, Infants, and Children program, including the support provider, the cloud provider, and the EBT provider; -obtain annually available service organization controls audit reports and perform an annual review that includes an assessment of the identified internal control deficiencies and a determination of whether the relevant complementary user entity controls are implemented; and -prepare and maintain documentation of its annual review and assessment. Finding 2025-303: WIC Special Supplemental Nutrition Program for Women, Infants, and Children—Service Organization Controls WIC Special Supplemental Nutrition Program for Women, Infants, and Children (Assistance Listing number 10.557) Award Numbers Award Years 202424WI00642 2024 202525WI00642 2025 202524WI00642 2025 Questioned Costs: None Type of Finding: Significant Deficiency Response from the Wisconsin Department of Health Services: The Wisconsin Department of Health Services agrees with the audit finding and recommendations.

Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs—Financial Reporting Background: The U.S. Department of Transportation Federal Aviation Administration (FAA) provides funding to DOT for the Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs. This funding assists sponsors, owners, or operators of public-use airports in the development of a nationwide system of airports adequate to meet the needs of civil aeronautics. Criteria: Under 2 CFR s. 200.303, DOT is required to establish, document, and maintain effective internal control over federal awards to provide reasonable assurance that the federal awards are managed in compliance with federal statutes, regulations, and the award terms and conditions. In accordance with the FAA’s Office of Airports (ARP) - Grant Payment and Sponsor Financial Reporting Policy, for each open grant DOT is required to submit annually Standard Form 425 (SF-425) Federal Financial Report and either a Standard Form 271 (SF-271) or a Standard Form 270 (SF-270) to request reimbursement for grant expenditures. Under 2 CFR s. 200.344, DOT must submit a final version for each form during grant closeout. In addition to reporting financial information, DOT is required to report on project physical completion in the SF-271. Condition: We identified concerns with the accuracy and completeness of the information DOT reported in the SF-425 report, and on the SF-271 and SF-270 forms completed during FY 2024-25. We found that DOT did not report accurate information related to cash receipts and cash disbursements in the annual SF-425 report we reviewed. For example, while DOT reported cash disbursements of $229.4 million on the SF-425 attachment used to list cash disbursements for multiple grants, DOT reported $0 in cash disbursements in the SF-425 report. We also found that DOT reported inaccurate information on at least one line in 3 of the 11 annual SF-271 forms we reviewed. These errors ranged from $5,000 to $50,000 and also included an inaccurate reporting period. In addition, for all four of the final SF-271 forms we reviewed, DOT could not provide documentation to support that it had verified the project met physical completion requirements prior to reporting the project as 100.0 percent physically complete. Finally, for the two SF-270 forms we reviewed, DOT did not report the nonfederal share of total program expenditures, which was $69,658 for the annual SF-270 and $21,328 for the final SF-270 we reviewed. Context: During FY 2024-25, DOT expended $71.6 million under the Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs. We interviewed DOT staff to gain an understanding of the procedures for compiling and reviewing information for the SF-270 and SF-271 forms, and the SF-425 report. During FY 2024-25, DOT submitted 6 annual SF-425 reports, 102 annual SF-271 forms, and 17 annual SF-270 forms. DOT also submitted final reports, including both a SF-425 report and a SF-271 or SF-270 form, as applicable, for 22 grants. We reviewed one annual SF-425 report, 11 annual SF-271 forms, and one annual SF-270 form. We also reviewed the final SF-271 or SF-270 forms and the related final SF-425 reports for five grants. We tested the forms we reviewed by comparing the amounts reported to the accounting records and other supporting documentation. We reviewed the email documentation of the secondary reviews of the forms we tested. Questioned Costs: None. Effect: DOT reported inaccurate or unsupported information in some of its federal financial reports filed in FY 2024-25, which resulted in inaccurate or unsupported information being provided to the federal awarding agency. Cause: While a secondary review and approval process existed for the annual SF-271 and SF-270 forms, documentation of the review was maintained only through email communications. DOT did not have procedures in place to ensure that errors identified by the secondary reviewer were corrected before submission to the federal government. In two instances, we found an error had been identified by the reviewer, but the error was not corrected before submission to the federal government. In addition, DOT indicated that it understood that certain information was not required because it had never been completed and FAA has never requested that DOT correct its submissions. DOT did not have procedures in place to require a secondary review and approval for the final SF-271 and SF-270 forms or for the annual and final SF-425 reports. DOT indicated that a secondary review process was not implemented for the final SF-271 and SF-270 because DOT submits draft reports to the FAA Airports District Office that reviews them against information in the U.S. Department of Transportation’s grants payment system. Therefore, DOT did not consider the need for an internal secondary review to compare draft reports against the State’s accounting records. In addition, DOT staff preparing the final SF- 271 form did not have a process in place to document project completion information obtained from project managers. Recommendation: We recommend the Wisconsin Department of Transportation: -improve its documentation of its internal secondary review for the annual SF-271 form and SF-270 form and update its procedures for the internal secondary review to ensure that corrections made in response to the secondary review are reviewed for accuracy before submission to the federal government; -develop and implement written procedures for an internal secondary review of the final SF-271 form, the final SF-270 form, and the annual and final SF-425 reports, including procedures for maintaining sufficient documentation of the review; and -obtain and maintain documentation of the project completion information used to complete the SF-271 form. Finding 2025-501: Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs—Financial Reporting Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs (Assistance Listing number 20.106) Award Numbers Award Years Various Various Questioned Costs: None COVID-19—Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs (Assistance Listing number 20.106) Award Numbers Award Years Various Various Questioned Costs: None Type of Finding: Significant Deficiency, Noncompliance Response from the Wisconsin Department of Transportation: The Wisconsin Department of Transportation agrees with the audit finding and recommendations.

Grants to States for Medicaid and Children’s Health Insurance Program—Agency Directives Background: The U.S. Department of Health and Human Services provides funding to DHS for Grants to States for Medicaid (MA Program) and CHIP. DHS contracts with a third-party contractor to serve as the fiscal agent responsible for operating and maintaining the Medicaid Management Information System (MMIS). The fiscal agent provides administrative services that support the MA Program and CHIP, including processing benefit claims through MMIS for eligible participants, certifying healthcare providers, reviewing prior authorization requests, and providing customer service for members and healthcare providers. The fiscal agent also provides several MMIS reports detailing the benefit payments. These reports are used to record expenditures in the State’s accounting system, to submit claims for federal reimbursement, and to meet federal reporting requirements. Criteria: Under 2 CFR 200.303, DHS is responsible for establishing, documenting, and maintaining effective internal control over federal awards to provide reasonable assurance that federal awards are managed in compliance with federal statutes, regulations, and the award terms and conditions. Effective controls should be in place for MMIS and should include procedures to ensure that all changes to MMIS or to other information maintained by the fiscal agent are appropriate and authorized. Such controls may include ensuring only authorized employees provide directives to the fiscal agent and that the employee who approves the directive is distinct from the employee authorized to create a directive. The State owns MMIS and the fiscal agent maintains and operates MMIS. DHS is responsible for oversight of the fiscal agent, for ensuring that transactions are processed in compliance with state and federal regulations, and for ensuring that any changes to MMIS are appropriate. When changes are needed, DHS communicates the specific MMIS changes to the fiscal agent through the use of written directives. There are four primary types of directives, which include: -modifications that are more significant or relate to nonroutine projects; -resource estimates that request an estimate for staff, cost, and timeline that are required for potential MMIS or other enhancements; -financial maintenance that results in manual financial transactions or payment deductions; and -operational maintenance that results in changes to information maintained by the fiscal agent, routine configuration updates, website updates, or updates to existing claims processing rules. DHS submits directives to the fiscal agent using the Project Information and Systems Management (PRISM) system. DHS provides PRISM system access to those DHS employees who submit directives to the fiscal agent. DHS communicates to the fiscal agent separate listings of employees authorized to approve each type of directive or a specific subset of directives under each type. DHS requires the fiscal agent to ensure each directive is properly authorized prior to implementing the requested change. If a directive is approved by someone that is not included on the authorization listings provided, DHS has instructed the fiscal agent to seek confirmation. Condition: We identified two concerns with DHS’s use of directives in communicating changes to the fiscal agent for MMIS changes during FY 2024 25. First, we found that the fiscal agent implemented a requested change for 9 of 21 operational maintenance directives we reviewed for which the directive approver was not included in the authorization listing provided. These directives instructed the fiscal agent to perform certain maintenance or updates, such as one directive to begin suspending claims for prepayment review, and one directive that updated a provider’s certification. In these nine instances, we also found that there was no documentation to evidence that the fiscal agent confirmed the requested change with DHS. In a separate review of financial maintenance directives, we also identified one directive approved by a DHS employee who was not on the authorization list that authorized the fiscal agent to process an $87,854 payment to a provider. Second, we identified that 500 of 822 operational maintenance directives approved during FY 2024-25 were both created and approved by the same DHS employee. Further, we found three of the nine operational maintenance directives we reviewed and the one financial maintenance directive we reviewed that were not approved by an authorized approver were also created and approved by the same employee. Context: During FY 2024-25, DHS expended $8.3 billion in federal funds under the MA Program and $317.4 million in federal funds under CHIP, which included $7.9 billion and $296.2 million, respectively, in benefit payments processed through MMIS. We discussed with DHS staff those DHS policies related to directives, the approval of directives, and the process for submitting directives to the fiscal agent. Based upon a DHS listing as of July 2025, there were 214 DHS employees who could submit a directive through PRISM. We obtained a listing from the fiscal agent of all directives received during FY 2024-25, which included 117 modification directives, 13 resource estimate directives, 642 financial maintenance directives, and 797 operational maintenance directives. From DHS we obtained the list of authorized approvers in effect during the audit period for each type of directive or specific subset of directives under each type. We randomly sampled 40 directives, including 21 operational maintenance directives, 15 financial maintenance directives, and 4 modification directives. We reviewed the sampled directives for appropriate approvals. We also obtained a listing from DHS of all directives approved in PRISM during FY 2024-25, including 651 financial maintenance directives and 822 operational maintenance directives. We performed an analysis to identify directives that were both created and approved by the same DHS employee. We further discussed with DHS the items identified during the audit. Questioned Costs: None. Effect: DHS did not establish, document, and maintain effective internal control over changes to MMIS. Unauthorized or improper changes to MMIS or other information maintained by the fiscal agent operations may have occurred, which could result in improper processing of claims, inaccurate reporting of information, potential for fraud, or noncompliance with state and federal regulations. Cause: DHS has a large number of employees who submit changes to MMIS or other information maintained by the fiscal agent using the directive process. DHS procedures were not sufficient to ensure that the directives submitted to the fiscal agent were approved by the appropriate DHS employee. For instance, DHS manually maintains its directive authorized approvers listings based on periodic communications with DHS supervisors, and there is no automated process to update these manual approval authority lists when staff leave or change positions, which may result in the lists being outdated. As DHS could not provide documentation that the fiscal agent sought to confirm the requested change in instances where the directive was approved by a DHS employee not on the authorized approver list provided by DHS, it is unknown whether the DHS instructions to the fiscal agent were followed. Directives to the fiscal agent are varied and range from significant changes that require additional resources and communication with DHS to others that have a limited effect on the programs. DHS’s policies did not identify directives that are of a higher risk and should be reviewed by other DHS staff prior to communicating them to the fiscal agent. In addition, the PRISM system was configured to allow any user to approve a directive, including directives that the user themselves created. For example, there is no differentiation within the PRISM system to provide a user the ability to either create or approve a certain type of directive. DHS indicated that enhancements would be needed to the PRISM system to provide this functionality. Recommendation: We recommend the Wisconsin Department of Health Services: -enforce with the fiscal agent that directives require appropriate approval and that the fiscal agent should confirm any directive where the approver may not be authorized; -ensure that the listings of authorized directive approvers provided to the fiscal agent are updated at least quarterly; -review policies related to directives, update these polices to identify those directives that require an approver other than the creator, and document justifications for any directives for which the creator and approver may be the same employee; and -assess the feasibility of changes to the PRISM system that would enforce an approval from a user other than the creator of a directive. Finding 2025-302: Grants to States for Medicaid and Children’s Health Insurance Program—Agency Directives Grants to States for Medicaid (Assistance Listing number 93.778) Award Numbers Award Years 2405WI5MAP 2024 2505WI5MAP 2025 Questioned Costs: None Children’s Health Insurance Program (Assistance Listing number 93.767) Award Numbers Award Years 2405WI15CHIP 2024 2505WI15CHIP 2025 Questioned Costs: None Type of Finding: Significant Deficiency Response from the Wisconsin Department of Health Services: The Wisconsin Department of Health Services agrees with the audit finding and recommendations.

2025 – 002: Internal Controls – Common Origination and Disbursement Reporting Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster – Various Assistance Listing Numbers: Various Federal Award Identification Number and Year: Various Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: July 1, 2024, through June 30, 2025 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or specific requirement: The 2 CFR Section 200.303 require that nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal Statues, regulations, and the term and conditions of the federal awards. Condition: During our testing of Common Origination and Disbursement (COD), we noted there was a review process implemented; however, there was no process in place to retain the review being performed as to provide evidence to ensure the controls are being performed effectively. Questioned costs: None Context: During our testing, it was noted the Academy does not have a process in place to ensure controls are being performed effectively. Cause: The Academy did not have a process in place to ensure controls implemented are being performed effectively. Effect: There is no way to determine who was involved in the process should an error be present. Repeat finding: Yes, see 2024-003 Recommendation: We recommend the Academy reevaluate its procedures and review policies surrounding controls implemented for Title IV Aid. Views of responsible officials: There is no disagreement with the audit finding.

2025-001 Finding – Federal Award Type: Special Reporting - Federal Funding Accountability and Transparency Act (FFATA) – Material Non- Compliance and Material Weakness in Internal Controls over Compliance. (Repeat of finding 2024-002) Identification of Federal Program: AL Number: 64.033 Supportive Services for Veteran Families Criteria / Requirement: 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The subawards meeting the above definition are to be reported no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition / Context: During the year June 30, 2025, CAT entered into three first-tier subawards greater than $30,000 under AL number 64.033. The auditor tested one of these subawards, noting that the award was reported four days late under the Federal Funding Accountability and Transparency Act to the Federal Subaward Reporting System(FSRS). Per further inquiry, all of the first-tier subawards were reported late, by four days, to FSRS. Cause: CAT was aware of the FFATA reporting requirements, but corrective action was not taken quickly enough to correct the FFATA filing requirement for the year ended June 30, 2025. Procedures were not in place at the beginning of the year, when subawards are entered into, to track and report first-tier subawards within the time frame required by federal requirements. Effect: Failure to maintain sufficient internal controls and proper procedures, related to tracking over reporting firsttier subawards may result in wrongful use of federal funds and non-compliance with federal awards. Questioned Costs: None. Recommendation: The Organization should establish written policies and procedures for first-tier subawards including tracking and proper internal control procedures. Management’s Response: Management concurs with the finding and has defined corrective action to address it. We have identified gaps in our reporting processes and worked to implement changes to ensure compliance with special reporting requirements. Policies and procedures will be updated regarding special reporting requirements. The Fiscal department will also be responsible for reviewing all contracts to identify all compliance requirements. Tracking procedures will be implemented to ensure reports are filed timely. The above identified corrective action has been fully implemented for the year ended June 30, 2026. Stacey Wilson, Fiscal Director, has implemented a tracking system for the FFATA.

Finding 2025-001 Monitoring of Subrecipients Research and Development Cluster National Aeronautics and Space Administration (ALN 43.001) Grant Number: 80NSSC23K1013 Statistically Valid Sample: No, and it was not intended to be Prior Year Finding: Not a repeat finding. Finding Type: Significant Deficiency and Noncompliance Criteria: According to 2 CFR 200.332(d), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations and the terms and conditions of the subawards, and that the subaward performance goals are achieved, Accordingly, 2 CFR 200.332(d)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on federal awards audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure single audit reports are reviewed and completed in a timely manner, and management decisions are issued within required timeframes. Condition and Context: The Garden performs a comprehensive risk assessment for all subrecipients and has established monitoring procedures which are applied to each of their four subrecipients throughout the life of the grant. These procedures include a detailed review of invoices submitted for reimbursement by the subrecipient and communication with the subrecipient as needed throughout the year. While the Garden obtained a copy of the subrecipients’ single audit report during the initial risk assessment process, the Garden did not obtain or review the most recently issued single audit report for each subrecipient during 2025 to determine if there were any findings related to their federal awards which would require the Garden to issue a management decision on audit findings. Cause: Management had a control in place to obtain the subrecipient single audit reports upon entering into the subaward agreements. However, the control was not properly designed to obtain subrecipient single audit reports annually in the subsequent years the agreement was still in place.. Effect: Failure to obtain and review the subrecipient single audit reports in a timely manner may result in the Garden not being aware of a material noncompliance by a subrecipients and the Garden not documenting management’s decision timely in accordance with the guidance. Questioned Costs: No questioned costs were noted as a result of the audit procedures performed. Recommendation: We recommend the Garden establish procedures to ensure subrecipient single audit report are obtained and reviewed on an annual basis. In addition, the Garden should document whether a management decision was prepared or whether it is not required based on review of the findings, if any. Views of Responsible Officials: Management agrees with the finding. Subsequent to year end, Management has obtained and reviewed Single Audit filings for all its Subrecipients from the Federal Audit Clearinghouse. In their review of the Subrecipient Single Audit Reports, they did not note any findings related to its Federal programs. Management has implemented a control to continue to obtain and review the Single Audit filings for its Subrecipients on an annual basis.

(1) Summary of Auditors’ Results Financial Statements a. Type of report issued on whether the financial statements were prepared in accordance with generally accepted accounting principles: Unmodified b. Internal control deficiencies over financial reporting disclosed by the audit of the financial statements: • Material weaknesses: No • Significant deficiencies: No c. Noncompliance material to the financial statements: No Federal Awards d. Internal control deficiencies over major programs disclosed by the audit: • Material weaknesses: Yes • Significant deficiencies: No e. Type of report issued on compliance for major programs: Qualified f. Audit findings that are required to be reported in accordance with 2 CFR 200.516(a): Yes g. Major programs: • Student Financial Assistance Cluster – Various ALNs h. Dollar threshold used to distinguish between Type A and Type B programs: $750,000 i. Auditee qualified as a low-risk auditee: No (2) Findings Relating to the Financial Statements Reported in Accordance with Government Auditing Standards None (3) Findings and Questioned Costs Relating to Federal Awards Finding Number: 2025-01 Program: Student Financial Assistance Cluster ALN #: 84.063 and 84.268 Federal Award #’s: P063P235372, P268K225372 Federal Award Years: July 1, 2024 to June 30, 2025 Federal Agencies: U.S. Department of Education Pass-Through Entity: N/A – Direct Award Compliance Requirement: Enrollment Reporting Finding Type: Material Weakness and Material Noncompliance Criteria: Under the Pell grant and the Direct and Federal Family Education Loan programs, institutions are required to report enrollment information via the National Student Loan Data System (NSLDS) (OMB No. 845-0035). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update and verify student enrollment statuses, program information and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Financial Aid Professionals (NSLDSFAP) website. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Institutions are responsible for timely reporting, whether they report directly or via a third-party servicer. Institutions must complete and return the Enrollment Reporting roster file placed in their Student Aid Internet Gateway (SAIG) (OMB No. 1845-0002) mailboxes sent by ED via NSLDS within 15 days. An institution determines how often it receives the Enrollment Reporting roster file with the default set at a minimum of every 60 days. Once received, the institution must update for changes in the data elements for the Campus Record and the Program Record identified above, and submit the changes electronically through the batch method, spreadsheet submittal or the NSLDS website. Additionally, per 2 CFR section 200.303, non-federal entities must establish and maintain effective internal control over federal awards that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition found: During our testwork over student enrollment reporting, we noted Regent did not report all students' status changes accurately or within the required 60 days. For a sample of 60 students who were recipients of Direct Loans or Pell Grants between July 1, 2024 and June 30, 2025 and that had been identified as having withdrawn, graduated, or modified their enrollment status as defined by Regent’s Satisfactory Academic Progress Policy through a change in course load, the following was noted: For 24 students out of the 60 selected for compliance testing, Regent did not transmit the students’ status change to NSLDS within 60 days. For 9 students out of the 60 selected for compliance testing, Regent did not transmit the students’ status change to NSLDS within 60 days and failed to report the correct effective date of the status change. For 2 students out of the 60 selected for compliance testing, Regent failed to report the correct effective date of the status change. For 2 students out of the 60 selected for compliance testing, Regent failed to report the proper status to NSLDS. Additionally, while Regent has controls in place to ensure that enrollment changes are reported timely to the National Student Clearinghouse (NSC), the control does not ensure that any required correspondence with NSC to resolve data matters is happening accurately and timely. Cause: For the students noted above, management communicated that there were delays in the data transmission from the NSC and the NSLDS. While the data was provided to the NSC in a timely manner, there were issues with the data that needed to be resolved between Regent and the NSC in order to proceed with the submission to NSLDS. For the reasons noted above, we determined the related control in place at Regent, which is designed to address the accuracy and timeliness of the transmission reports, is not designed at a sufficient level to verify the accuracy and timeliness of the data transmission to the NSC. Nor does Regent have a control to ensure that any subsequent issues are resolved timely and that the data is ultimately submitted to the NSLDS timely. Proper perspective: Regent’s policy is to submit enrollment data to the NSC on a predetermined schedule that allows Regent to comply with the enrollment reporting requirements. For our sample of 60 students with status changes, we identified 37 students where either the status change was not reported within 60 days, improper status was reported, or the effective date was not accurately reported which indicates a systemic issue. Possible asserted effect: Untimely submission of student enrollment information affects the determinations that lenders and servicers of students’ loans make related to in-school status, deferments, graces periods, and repayment schedules, as well as the federal government’s payment and interest schedules. Questioned costs: None noted. Statistical sampling: The sample was not intended to be, and was not, a statistically valid sample. Repeat finding: A similar finding was reported in the prior year. The prior year finding number was 2024-001 Recommendation: We recommend Regent evaluate its processes and procedures when submitting data to the NSC to mitigate the number of errors in data transmissions in order to expedite the accuracy and timeliness of the NSLDS enrollment reporting. Views of responsible officials: Regent agrees with this finding. Regent intends to strengthen its controls and quality assurance measures over the timeliness of enrollment information to NSLDS.

Finding 2025-011 – Lack of Internal Controls Over Major Federal Program – Coronavirus State and Local Fiscal Recovery Funds PASS THROUGH GRANTOR: Direct Grant FEDERAL AGENCY: U.S. Department of Treasury ASSISTANCE LISTING: 21.027 FEDERAL PROGRAM NAME: Coronavirus State and Local Fiscal Recovery Funds FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Period of Performance; Procurement and Suspension and Debarment; Reporting QUESTIONED COSTS: $-0- Condition: During the process of documenting the County’s internal controls regarding federal disbursements, we noted the County has not established procedures to ensure compliance with the following compliance requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Period of Performance; Procurement and Suspension and Debarment; Reporting. Cause of Condition: Policies and procedures have not been designed and implemented to ensure federal expenditures are made in accordance with federal compliance requirements. Effect of Condition: This condition could result in noncompliance with grant requirements and could lead to a loss of federal funds to the County. Recommendation: OSAI recommends the County gain an understanding of requirements for this program and implement internal control procedures to ensure compliance with requirements. Management Response: Chairman of the Board of County Commissioners: The Board of County Commissioners will work with all County Officials to go over all grants and federal monies that Comanche County receives to ensure that proper internal controls are implemented. Criteria: 2 CFR § 200.303 Internal Controls (a) reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Further, accountability and stewardship should be overall goals in management's accounting of federal funds. Internal controls should be designed to monitor compliance with laws and regulations pertaining to grant contracts.

Finding 2025-002: Reporting Federal Program: Building an Inclusive Workforce: Lifting Underrepresented Communities Assistance Listing Number: 17.289 Federal Agency: U.S. Department of Labor Federal Award Number(s): 24A60CP000157-01-04 Type of Finding: Significant Deficiency in Internal Control over Compliance and Non-compliance Criteria: In accordance with 2 CFR §200.303, non-Federal entities are required to establish and maintain effective internal control over Federal awards to provide reasonable assurance that the entity is managing Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Such internal controls should be consistent with the Standards for Internal Control in the Federal Government or the COSO Internal Control—Integrated Framework, including controls designed to ensure timely submission of required reports. Additionally, 2 CFR §200.328(c) states that "the recipient or subrecipient must submit financial reports as required by the Federal award." Condition: During the audit, we noted that one required report selected for testing was not submitted in accordance with the reporting deadline established in the terms and conditions of the Federal award. Cause: This condition resulted from management oversight related to monitoring and tracking report due dates. Effect or Potential Effect: The failure to submit required reports timely increases the risk of noncompliance with Federal reporting requirements and may result in delayed oversight by the Federal awarding agency, potential sanctions, or increased scrutiny in future monitoring or audits. Questioned Costs: None. Context: 1 of 2 financial reports were not submitted timely. The sample is representative of the population. Identification as a Repeat Finding, if Applicable: 2024-001 Recommendation: We recommend that the Coalition implement formal procedures to ensure timely submission of all required Federal reports. Such procedures may include the use of an automated tracking or calendar system to notify responsible personnel of upcoming reporting deadlines, as well as documented review and approval of reports prior to submission.

FEDERAL AWARD FINDING: 2025-101 The District did not timely return Title IV funds to the U.S. Department of Education, increasing the risk of reduced or terminated future awards Cluster name: Student Financial Assistance Cluster Assistance Listings number(s) and name(s): 84.007 Federal Supplemental Educational Opportunity Grants 84.033 Federal Work-Study Program 84.038 Federal Perkins Loan Program—Federal Capital Contributions 84.063 Federal Pell Grant Program 84.268 Federal Direct Student Loans Award number(s) and year(s): P063P241066 July 1, 2024 to June 30, 2025 P007A240115 July 1, 2024 to June 30, 2025 P033A240115 July 1, 2024 to June 30, 2025 P268K241066 July 1, 2024 to June 30, 2025 Federal agency: U.S. Department of Education Compliance requirement: Special tests and provisions - return of Title IV funds Questioned costs: None Condition Contrary to federal regulation and the District’s policies and procedures, the District’s Student Financial Services Office (SF Office) did not initiate a return of Title IV funds to the U.S. Department of Education (ED) within the required 45 days of becoming aware that a student withdrew from the District. Specifically, for 3 of 25 students tested, the District did not initiate returns until between 71 and 83 days after becoming aware the students withdrew. Effect The District’s failure to timely return Title IV funding and the lack of monitoring over the SF Office’s compliance with federal regulation and District policies and procedures increases the risk that additional Title IV funds could be returned past the 45-day requirement and increases the risk that ED could reduce or terminate future awards of Title IV funds for noncompliance. Cause The District did not monitor its SF Office’s adherence to District-wide policies and procedures to ensure compliance with Title IV program requirements. Specifically, although the District had communicated District-wide policies to the SF Office that is responsible for administering the federal programs, adhering to federal regulations, and following District-wide policies and procedures, the District did not have procedures in place to monitor and address employee turnover of personnel responsible for adherence to District-wide policies regarding timely return of Title IV funds. Criteria Federal regulation and District policies and procedures require the return of Title IV funds when a recipient of Title IV grant or loan assistance withdraws from the District during a payment period or period of enrollment in which the recipient began attendance. Specifically, the District must determine the amount of Title IV aid earned by the student as of the student’s withdrawal date. If the total amount of Title IV assistances earned by the student is less than the amount that was disbursed to the student or on his or her behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs no later than 45 days after the date of the District’s determination that the student withdrew (34 Code of Federal Regulations [CFR] §668.22[a –j]). Further, federal guidelines require establishing and maintaining effective internal control over federal awards that provides reasonable assurance that federal programs are being managed in compliance with all applicable laws, regulations, and award terms (2 CFR §200.303). Recommendations to the District 1. Monitor its SF Office to ensure its compliance with District policies and procedures for the return of Title IV funds. 2. Design and document control procedures to monitor and address employee turnover of personnel responsible for performing procedures related to the return of Title IV funds. 3. Initiate returns of Title IV funds to ED no later than 45 days after the date of the District’s determination that the student withdrew. Views of responsible officials District management concurs with this finding. The District’s corrective action plan at the end of this report includes the views and planned corrective action of its responsible officials regarding these recommendations. We are not required to audit and have not audited these responses and planned corrective actions and therefore provide no assurances as to their accuracy.

Cluster name(s): CDBG – Entitlement/Special Purpose Grants Cluster Assistance Listings number(s) and name(s): 14.218 Community Development Block Grants/Entitlement Grants Award number(s) and year(s): B-20-UW-04-0501 July 1, 2023 through September 1, 2027 B-23-UC-04-0501 July 1, 2023 through September 1, 2030 B-24-UC-04-0501 July 1, 2024 through September 1, 2031 Federal agency: U.S. Department of Housing and Urban Development Compliance requirement(s): Reporting Questioned costs: Not applicable Condition Contrary to federal laws and regulations and County policies, the County’s Human Services Department (Department) failed to report complete and accurate information on the federal government’s reporting system for nearly $3 million in subawards it made to subrecipients during fiscal year 2025 for the Community Development Block Grants/Entitlement Grants (CDBG) program. As shown in the bullets below and Table 1 on page 9, we tested a total sample of 5 subawards for the program at the Department and found that, for the 5 subawards, the Department failed to report the following: X Any required information about the subaward amendments, including the amended amounts and terms, for 2 subawards tested, totaling nearly $1.1 million of the total nearly $3 million of subawards we tested in our sample. X Required information within the time frame for all 5 subawards tested, totaling nearly $2.5 million, resulting in the reports being submitted between 2 and 13 months late. X Accurate key elements for 4 subawards tested, totaling $1.7 million, that included incorrect subaward obligation/action dates, changes in funding sources, and subaward project descriptions. Furthermore, for 1 of these 4 subawards, the same information for 1 amendment totaling $766,648 was entered into the federal government’s reporting system 3 separate times. FEDERAL AWARD FINDING AND QUESTIONED COSTS: 2025-101 Arizona Auditor General Maricopa County | Year Ended June 30, 2025 10 Effect The County’s stakeholders and the public did not have access to transparent and timely information about the Department’s federal award spending decisions on USAspending.gov as required by federal laws and regulations. Additionally, the Department is at risk that this finding applies to other federal programs it administers. During fiscal year 2025, the Department is at risk of not transparently reporting its subaward information related to nearly $2.2 million of federal monies it spent related to the subrecipient expenditures, or 54% of the Department’s total of nearly $4.1 million reported on the schedule of expenditures of federal awards for the CDBG Cluster. Cause The Department experienced turnover in the contract manager position, and neither contract manager employed during fiscal year 2025 updated the tracking list used in prior fiscal years to monitor grants and report information on the federal government’s reporting system, including grants contracted through other departments and amendments. In addition, the Department did not require independent reviews of the reports for accuracy and completeness prior to uploading subaward data to the federal government’s reporting system. Table 1 The Department failed to report complete and accurate information on the federal government’s reporting system for nearly $3 million in subawards related to the CDBG program June 30, 2025 Subaward issue Number of subawards Associated error amount Not reported timely1 5 $2,475,127 Incorrect key elements 4 1,734,748 Amendments not reported1 2 1,051,900 Total distinct subawards tested and total error amount2 5 $2,975,127 1 These rows include overlapping information for 2 subawards as these subawards, original amounts were reported; however, they had multiple amendments during the fiscal year that were either not reported or not reported timely. As a result, $551,900 was included as an associated error amount in both rows because of multiple amendments for the same subaward and amount. 2 Number of subawards with issues and associated error amounts might overlap, but the totals show the distinct number of subawards tested and their total associated error amount. Source: Auditor General staff review of subaward contracts provided by the Department on September 5, 2025. Arizona Auditor General Maricopa County | Year Ended June 30, 2025 11 Criteria The Federal Funding Accountability and Transparency Act (FFATA) and federal Uniform Guidance regulations require the Department, as a direct recipient of federal awards, to report certain information about each subaward action equaling or exceeding $30,000 in federal monies on the federal government’s reporting system no later than month-end of the month following the subaward action so that the information can be displayed to the public on USAspending.gov.1 Specifically, the federal Uniform Guidance requires the Department to report the subrecipient organization’s name, award amount, award term, and other information about the subaward, if applicable, for each subaward action equaling or exceeding the $30,000 threshold (2 Code of Federal Regulations [CFR] §170.320 and Appendix A to part 170). Additionally, the County’s grant policies and procedures and the Department’s FFATA Reporting Policy require the Department to perform this reporting for federal awards.2,3 Also, an update to the Department’s FFATA Reporting Policy in March 2025 requires Department personnel to review and update, on a monthly basis, the tracking list used to monitor grants and report information to the federal government’s reporting system, ensuring all grants contracted through other departments and amendments are included and accurately reported.2 Further, federal regulation requires establishing and maintaining effective internal control over federal awards that provides reasonable assurance that the federal program is being managed in compliance with all applicable laws, regulations, and award terms (2 CFR §200.303). Recommendations to the Department 1. Immediately report on the federal government’s reporting system the required information for its subawards, including reviewing, correcting, and/or resubmitting any inaccurate reported information. 2. Follow the County’s grant policies and procedures and the Department’s FFATA Reporting policy for reporting subaward actions equaling or exceeding $30,000 no later than monthend of the month following the subaward action, as required by the FFATA and federal Uniform Guidance, which may include providing training to Department staff responsible for reporting the Department’s subaward actions to the federal government’s reporting system. 3. Implement the Department’s FFATA Reporting policy requirements to review and update the tracking list used to monitor grants and report information to the federal government’s reporting system, ensuring all grants contracted through other departments and amendments are included and accurately reported. 4. Develop and implement procedures requiring independent reviews to ensure the subaward data is complete and accurate prior to uploading it to the federal government’s reporting system. 1 The FFATA of 2006 (Public Law 109-282), as amended by section 6202 of Public Law 110-252, was enacted to provide the public with transparency on federal award spending to hold the recipient government accountable for each spending decision and to help reduce wasteful spending of federal monies. As such, federal Uniform Guidance requires reporting on the FFATA Subaward Reporting System at https://sam.gov/. 2 Maricopa County. (2025). Maricopa County Human Services Federal Funding Accountability and Transparency Act (FFATA Reporting APP0220). 3 Maricopa

Finding 2025-001 Inaccurate NSLDS Reporting Federal Agency: U.S. Department of Education (USDE) Program Name: Student Financial Assistance Cluster ALN and Program Expenditures: 84.063 ($32,562,241) 84.268 ($174,471,585) Federal Award Numbers: P063P240105 P268K250105 P063P230105 Federal Award Year: July 1, 2024 to June 30, 2025 Questioned Costs: None Compliance Requirement: NSLDS Reporting Condition Found: The University did not accurately report student enrollment status changes to the National Student Loan Data System (NSLDS). The U.S. Department of Education (USDE) uses enrollment data reported by the University to determine: (1) eligibility for interest subsidies, (2) loan repayment start dates, and (3) in-school loan deferments. The enrollment information is also used by USDE to measure program completion data to evaluate the effectiveness of financial aid programs. During our testing of 40 students (31 students with Federal Direct Loan Program disbursements of $1,002,311 and 9 students with Federal Direct Loan Program disbursements of $114,486 and Federal Pell Grant disbursements of $64,090) that had a reduction or increase in attendance levels, graduated, withdrew, dropped out, or enrolled but never attended during the fiscal year, we noted the following: • The status change for one graduated student (with Federal Direct Loan Program disbursements of $15,434) was reported incorrectly to the NSLDS as a Withdrawn (W) status rather than a Graduated (G) status. Specifically, in the 2024-2025 academic year, the student was previously reported to the NSLDS as withdrawn due to no enrollment but then subsequently graduated, and as a result the University did not update the enrollment status change to graduated. Upon further review, management identified an additional 43 students (21 students with Federal Direct Loan Program disbursements of $192,242 and 22 students with Federal Direct Loan Program disbursements of $65,398 and Federal Pell Grant disbursements of $64,907) during the fiscal year who were reported incorrectly to the NSLDS as a W status rather than a G status. We further noted management review controls implemented by the University were not designed at a level of precision to ensure University enrollment data submitted to NSLDS was accurate. The University disbursed Federal Direct loans and Pell grants to 9,674 and 5,822 students, respectively, during the year ended June 30, 2025. Criteria or Requirement: According to 34 CFR Sections 690.83(b)(2) and 685.309, under the Pell grant and Federal Direct Loan programs, institutions must complete and return the Enrollment Reporting Roster File via NSLDS within 15 days of receipt. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster File. Unless an institution expects to submit its next updated enrollment report to the USDE within the next 60 days, an institution must notify NSLDS within 30 days after the date that the institution discovers that (1) a Direct loan was made to or on behalf of a student who was enrolled or accepted for enrollment at the institution, and the student has ceased to be enrolled on at least a half-time basis or failed to enroll on at least a half-time basis for the period for which the loan was intended; or (2) a student who is enrolled at the institution and who received a loan under Title IV has changed his or her permanent address. The November 2022 NSLDS Enrollment Reporting Guide states “for a student who has graduated, schools who initially report a withdrawn status must subsequently report the student as having graduated by certifying a ‘G’ status at the Campus-Level and/or Program-Level as appropriate.” In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include establishing procedures to ensure student enrollment status changes are accurately reported to the NSLDS. Cause: Cause: In discussing these conditions with the University, they stated that the specific issue was due to a gap in staffing and failure to understand that a secondary manual update to the record was necessary. The individual who took the previous control operator’s place did not have an effective understanding of the reporting process and did not report the student’s status appropriately. Possible Asserted Effect: Inaccurate submission of student enrollment status affects the determinations that lenders and servicers of student loans make related to in-school deferments, grace periods, and repayment schedules, as well as the Federal government’s payment of interest subsidies. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding code 2025-xxx) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend the University review and revise its procedures to ensure accurate reporting of enrollment status information to the NSLDS. Views of University Officials: DePaul is committed to fulfilling the federal requirement to report withdraw and graduation status to the NSLDS. The University Registrar’s Office is responsible for that task and accomplishes it by reporting enrollment through the National Student Clearinghouse (NSC), a third-party servicer. Generally, there are not typically issues with reporting students who withdraw or who graduate. However, we concur with the finding and acknowledge the specific set of circumstances that led to this issue. The number of these cases is limited. We understand the importance of accurate reporting and our internal procedures have been adjusted. We are committed to maintaining compliance with all regulatory requirements.

FINDING 2025-002 Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Summer Food Service Program for Children, Fresh Fruit and Vegetable Program Assistance Listings Numbers: 10.553, 10.555, 10.559, 10.582 Federal Award Number and Year (or Other Identifying Number): FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2023-004. Condition and Context The School Corporation did not have effective internal controls in place to ensure compliance with the Procurement and Suspension and Debarment compliance requirement. The School Corporation did not have adequate procedures in place to ensure that the requirements for small purchases were met for each applicable procured good or service or to ensure that vendors were not suspended or debarred prior to entering into a covered transaction. INDIANA STATE BOARD OF ACCOUNTS 17 WABASH CITY SCHOOLS SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Procurement Federal regulations allow for informal procurement methods when the value of the procurement for property or services does not exceed the simplified acquisition threshold, which is set at $250,000 unless a lower, more restrictive threshold is set by a nonfederal entity. As Indiana Code has set a more restrictive threshold of $150,000, informal procurement methods are permitted when the value of the procurement does not exceed $150,000. This informal process allows for methods other than the formal bid process. The informal process is divided between two methods based on thresholds: micro-purchases, typically for those purchases $10,000 or under, and small purchase procedures for those purchases above the micro-purchase threshold, but below the simplified acquisition threshold. Micro-purchases may be awarded without soliciting competitive price rate quotations. If small purchase procedures are used, then price or rate quotations must be obtained from an adequate number of qualified sources. For the audit period, the School Corporation self-certified a micro-purchase threshold of $50,000. Any purchase above this threshold but below the $150,000 simplified acquisition threshold would be considered a small purchase. During fiscal year 2023-2024 , the School Corporation had one vendor with disbursements totaling $60,757, which exceeded the School Corporation established small purchase threshold of $50,000. The School Corporation did not provide supporting documentation that an adequate number of price or rate quotes were obtained from qualified sources for the purchases. The lack of effective internal controls and noncompliance were isolated to the one vendor noted above. Suspension and Debarment Prior to entering into subawards and covered transactions with federal award funds, recipients are required to verify that such contractors and subrecipients are not suspended, debarred, or otherwise excluded. "Covered transactions" include, but are not limited to, contracts for goods and services awarded under a nonprocurement transaction (i.e., grant agreement) that are expected to equal or exceed $25,000. The verification is to be done by checking the SAMs exclusions, collecting a certification from that vendor, or adding a clause or condition to the covered transaction with that vendor. Upon inquiry of the School Corporation and inspection of supporting documentation in order to review the procedures in place for verifying that a vendor with which it plans to enter into a covered transaction is not suspended, debarred, or otherwise excluded, it was identified that the School Corporation did not have policies or procedures in place to verify if vendors were suspended or debarred or otherwise excluded from participation in federal awards. In 2023-2024, for one covered transaction totaling $60,757, there was no evidence provided that the School Corporation verified the vendor's suspension and debarment status prior to payment. The lack of effective internal controls and noncompliance were isolated to the one vendor noted above. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 18 WABASH CITY SCHOOLS SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.318 states in part: "(a) The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or services required under a Federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standards identified in §§ 200.317 through 200.327. . . . (i) The non-Federal entity must maintain records sufficient to detail the history of procurement. These records will include, but are not necessarily limited to, the following: Rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. . . ." 2 CFR 200.320 states in part: "The non-Federal entity must have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award. (a) Informal procurement methods. When the value of the procurement for property or services under a Federal award does not exceed the simplified acquisition threshold (SAT), as defined in § 200.1, or a lower threshold established by a non-Federal entity, formal procurement methods are not required. The non-Federal entity may use informal procurement methods to expedite the completion of its transactions and minimize the associated administrative burden and cost. The informal methods used for procurement of property or services at or below the SAT include: . . . (2) Small purchases — (i) Small purchase procedures. The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. . . ." 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the SAM Exclusions; or (b) Collecting a certification from that person; or INDIANA STATE BOARD OF ACCOUNTS 19 WABASH CITY SCHOOLS SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (c) Adding a clause or condition to the covered transaction with that person." Cause An effective system of internal controls was not designed and implemented by management of the School Corporation. The School Corporation had outlined a process for handling small purchase vendor related transactions, but that process was not followed, nor was supporting evidence maintained for the items described in the Condition and Context. Also, the School Corporation had designed a process for determining whether a vendor is suspended or debarred, but that process was not completed. Effect As a result of not designing and implementing an effective system of internal controls and following the School Corporation's policies and procedures, goods that fell within the small purchase threshold were not properly procured, and vendors to whom payments equal to or in excess of $25,000 were made were not verified to be not suspended, debarred, or otherwise excluded. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the School Corporation design and implement an effective internal control system and follow through with the policies and procedures related to small purchase vendor procurement and suspension and debarment compliance requirements that they designed through an action plan to correct the prior audit period finding. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2025-003 Subject: Special Education Cluster (IDEA) - Earmarking Federal Agency: Department of Education Federal Programs: Special Education Grants to States, COVID-19 - Special Education Grants to States, Special Education Preschool Grants, COVID-19 - Special Education Preschool Grants Assistance Listings Numbers: 84.027, 84.027X, 84.173, 84.173X Federal Award Numbers and Years (or Other Identifying Numbers): 22611-054-PN01, 22619-054-PN01, 22611-054-ARP, 22619-054-ARP, 23611-054-PN01 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Matching, Level of Effort, Earmarking Audit Findings: Material Weakness, Modified Opinion Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2023-009. INDIANA STATE BOARD OF ACCOUNTS 20 WABASH CITY SCHOOLS SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Condition and Context The School Corporation is a member of the Wabash-Miami Area Program (Cooperative). During fiscal years 2023-2024 and 2024-2025, the Cooperative operated the special education program and spent the federal money on behalf of all its members. As the grant agreement was between the Indiana Department of Education (IDOE) and each member school, the School Corporation was responsible for ensuring and providing oversight of the Cooperative. The School Corporation did not have internal controls in place to ensure that the Cooperative complied with the earmarking requirements. The Cooperative did not have adequate procedures in place to ensure that the required level of expenditures for nonpublic school students with disabilities was met for each member school. The Cooperative did not have effective internal controls to ensure nonpublic school expenditures were appropriately identified and reported. The nonpublic expenditures spent did not meet the earmarking requirements for grant award number 22611-054-PN01, 22619-054-PN01, 22611-054-ARP, 22619-054-ARP, and 23611-054-PN01. Total grant expenditures were posted as expended. The nonpublic proportionate share expenditures for each member school were determined by applying a percentage based on the total grant award to the nonpublic school total expenditures. The lack of internal controls and noncompliance was isolated to 22611-054-PN01, 22619-054-PN01, 22611-054-ARP, 22619-054-ARP, and 23611-054-PN01 grant awards. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: . . . (g) Be adequately documented. . . ." 2 CFR 200.208(b) states in part: "The Federal awarding agency or pass-through entity may adjust specific Federal award conditions as needed . . ." 511 IAC 7-34-7(b) states: "The public agency, in providing special education and related services to students in nonpublic schools must expend at least an amount that is the same proportion of the public agency total subgrant under 20 U.S.C. 1411(f) as the number of nonpublic school students with disabilities, who are enrolled by their parents in nonpublic schools within its boundaries, is to the total number of students with disabilities of the same age range." INDIANA STATE BOARD OF ACCOUNTS 21 WABASH CITY SCHOOLS SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Cause Through inquiry of management, they were unaware of the requirements to track the nonpublic proportionate share expenditures directly for each member school. The Cooperative did implement new processes and procedures to ensure expenditures were tracked by member school starting with the 2023-2024 grants, and these grants were still ongoing during the audit period. Effect Without the proper implementation of an effectively designed system of internal controls, the Cooperative was unable to track expenditures for nonpublic services for each member school. Consequently, the amounts requested for reimbursement were not supported by actual expenditures but rather a percentage based on the budget per member school. Because of this, expenditures were not accurately reported to the oversight agency. Questioned Costs There were no questioned costs identified. Recommendation Management of the Cooperative should develop written policies and procedures which would require tracking of actual nonpublic proportionate share expenditures by member school. Documentation should be maintained to show how these expenditures are being tracked to ensure compliance with the earmarking requirements. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

2025-002 Finding – Federal Awards – AL #14.267 – Continuum of Care Program Type: Significant Deficiency in Internal Control over Compliance – Special Tests: Rent Reasonableness Criteria / Requirement: 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition / Context: In testing Special Tests - Rental Reasonableness one out of four sample selected did not have a documented file review. The file appeared complete and there was no noncompliance noted, however there was no documented internal control over the rent reasonableness calculation. Cause: The process for file review was updated during the year to include a HUD file checklist not previously used. Three of the four files included the checklist which documents the review by the Housing Program Manager; however, one file was created before the checklist was in use. No other documentation of the review of the file was maintained, other than the associated check issued to the rental property company. Effect: Rental payments made on behalf of the Organization’s clients could be made for amounts above the HUD guideline’s maximum amount for the area, and therefore out of compliance with the federal award. Questioned Costs: None Recommendation: We recommend that the Organization continue with the internal controls established later in the year and ensure that Rent Reasonableness testing is documented including the file review. Additionally, as there have been recent revisions to the Uniform Grant Guidance (2 CFR 200) that now require documented internal controls over compliance, we also recommend that a specific policy be established for Rent Reasonableness to give clear directives of how the Organization determines rent reasonableness, how it is documented, and retained, ensuring there is current documentation of the internal controls over compliance. Management’s Response: Management concurs with the finding and has implement effective internal controls over Special Tests – Rent Reasonableness.

2025-001 Finding – Federal Awards – AL #93.592 – Family Violence Prevention and Services/ Discretionary Type: Significant Deficiency in Internal Control over Compliance – Financial Reporting Criteria / Requirement: 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition / Context: The Organization filed the required Federal Financial Report timely, the information reported was supported by detail within their general ledger, and there was no noncompliance noted. However, the Federal Financial Report was compiled and submitted by one employee. There was no internal control within the Federal Financial Reporting procedure that would have prevented or detected inaccurate information from being reported. Cause: Procedures were not in place to properly review Federal Financial Reporting prior to submission. Effect: Federal Financial Reporting could potentially include inaccurate information. Questioned Costs: None Recommendation: We recommend that the Organization implement the necessary internal controls to ensure that Federal Financial Reporting is performed, and review of reports submitted is documented. Additionally, as there have been recent revisions to the Uniform Grant Guidance (2 CFR 200) that now require documented internal controls over compliance, we also recommend that a specific policy be established for Federal Financial Reporting to give clear directives of how Federal Financial Reporting will be performed, documented, and retained ensuring there is current documentation of the internal controls over compliance. Management’s Response: Management concurs with the finding and will implement effective internal controls over Financial Reporting.

FINDING 2025-001 Subject: TRIO Cluster - Eligibility Federal Agency: US Department of Education Federal Program: TRIO Talent Search Assistance Listings Number: 84.044 Federal Award Number and Year (or Other Identifying Number): P044A220683 Compliance Requirement: Eligibility Audit Findings: Significant Deficiency, Other Matters This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2024-002. Condition and Context An effective internal control system was not in place at the College to ensure compliance with the Eligibility compliance requirements. The following deficiencies over determination and noncompliance were noted:  For TRIO Talent Search, 2 of the 16 students from the Northwest (Lake) Campus did not have evidence of internal controls over admission to the program.  For TRIO Talent Search, 1 of the 16 students from the Northwest (Lake) Campus of the College could not provide evidence that the participant was a citizen, national, or permanent resident of the United States or in the United States for other than a temporary purpose. The lack of internal controls was isolated to the Northwest (Lake) Campus TRIO Talent Search program. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 34 CFR 646.3 states: "A student is eligible to participate in a Student Support Services project if the student meets all of the following requirements: INDIANA STATE BOARD OF ACCOUNTS 18 IVY TECH COMMUNITY COLLEGE OF INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Is a citizen or national of the United States or meets the residency requirements for Federal student financial assistance. (b) Is enrolled at the grantee institution or accepted for enrollment in the next academic term at that institution. (c) Has a need for academic support as determined by the grantee, in order to pursue successfully a postsecondary educational program. (d) Is– (1) A low-income individual; (2) A first generation college student; or (3) An individual with disabilities." Cause The College's management had not developed an effective system of internal controls that would have ensured compliance with the Eligibility compliance requirement. This was due to policies and procedures not being adequate to retain the documentation for TRIO Eligibility. Effect The failure to establish an effective internal control system could enable material noncompliance to go undetected. Noncompliance with the Eligibility compliance requirement could have resulted in the loss of federal funds to the College. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the College's management strengthen the internal controls related to the compliance requirement listed above. We also recommended strengthening its policies and procedures to ensure appropriate supporting documentation for evidence of review and other internal controls procedures for federal programs are retained to be presented for audit. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report. INDIANA STATE BOARD OF ACCOUNTS 19

FINDING 2025-002 Subject: TRIO Cluster - Reporting Federal Agency: US Department of Education Federal Programs: TRIO Student Support Services, TRIO Talent Search, TRIO Upward Bound Assistance Listings Numbers: 84.042A, 84.044, 84.047 Federal Award Numbers and Years (or Other Identifying Numbers): P042A200749, P042A200690, P042A201220, P042A201222, P044A220683, P047A221086, P047A221077 Compliance Requirement: Reporting Audit Findings: Material Weakness, Other Matters This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2024-003. Condition and Context An effective internal control system was not in place at the College to ensure compliance with requirements related to the Reporting compliance requirement. The following errors on the fiscal year 2024 Annual Performance Report (APR) were noted:  For TRIO Student Support Services at the Indianapolis Campus, key line items were tested for 24 students. For 1 student, field 31 "Undergraduate Degree/Certificate Completed at Grantee Institution" was inaccurately reported.  For TRIO Student Support Services at the Northwest (Lake) Campus, key line items were tested for 22 students. o For 1 student, field 15 "Eligibility" was inaccurately reported. o For 2 students, field 18 "Date of First Project Service" was inaccurately reported. o For 1 student, field 19 "College Grade Level (entry into project)" was inaccurately reported. o For 7 students, field 23 "Enrollment Status (at end of academic year)" was inaccurately reported. o For 1 student, field 24 "Academic Standing" was inaccurately reported. o For 3 students, field 31 "Undergraduate Degree/Certificate Completed at Grantee Institution" was inaccurately reported.  For TRIO Student Support Services at the Richmond Campus, key line items were tested for 25 students. o For 2 students, field 17 "First Enrollment Date (at grantee institution)" was inaccurately reported. INDIANA STATE BOARD OF ACCOUNTS 20 IVY TECH COMMUNITY COLLEGE OF INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) o For 1 student, field 22 "Participant Status (during academic year)" was inaccurately reported. o For 8 students, field 23 "Enrollment Status (at end of academic year)" was inaccurately reported. o For 1 student, field 27 "College Grade Level (at end of academic year)" was inaccurately reported.  For TRIO Talent Search at the Northwest (Lake) Campus, key line items were tested for 40 students. o For 10 students, the College could not provide supporting documentation for item A1 "Persisted in school for the next academic year at the next grade level or graduated high school." o For 2 students, the College inaccurately reported that the students persisted in the next academic year at the next grade level; however, the students did not advance to the next grade level.  For TRIO Upward Bound at the Indianapolis Campus, key line items were tested for 10 students. For 1 student, field 17 "Reading Language Arts or Math Proficiency Not Achieved" was inaccurately reported.  For TRIO Upward Bound at the Muncie Campus, key line items were tested for 9 students. o For 3 students, field 16 "Eligibility" was inaccurately reported. o For 1 student, field 17 "Reading Language Arts or Math Proficiency Not Achieved" was inaccurately reported. o For 1 student, field 19 "Pre-Algebra or Algebra Course Not Successfully Completed by Beginning of 10th Grade" was inaccurately reported. The lack of effective internal controls and noncompliance was a systemic issue at four of the five campuses that were reported on the TRIO Cluster program during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 21 IVY TECH COMMUNITY COLLEGE OF INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 200.329(c)(1) states in part: "The recipient or subrecipient must submit performance reports as required by the Federal award. . . ." 34 CFR 646.32(c) states in part: "Recordkeeping. A grantee must maintain participant records that show– (1) The basis for the grantee's determination that each participant is eligible to participate in the project under § 646.3; (2) The grantee's basis for determining the academic need for each participant; (3) The services that are provided to each participant; (4) The performance and progress of each participant by cohort for the duration of the participant's attendance at the grantee's institution . . ." Cause The College's management had not developed an effective system of internal controls that would have ensured compliance with the Reporting compliance requirement. The College had not developed policies and procedures to verify that the TRIO Cluster reporting agreed with supporting records. Effect Without the proper implementation of an effectively designed system of internal controls, the College cannot ensure reporting for the TRIO Cluster is accurate and in agreement with supporting records. Noncompliance with the reporting requirement could have resulted in the loss of federal funds to the College. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the College's management strengthen the internal controls related to the compliance requirement listed above. We also recommended strengthening its policies and procedures to ensure reporting for the TRIO Cluster programs agree with supporting records of the College. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Prior Year Finding: 2024-003 Federal Agency: U.S. Department of Treasury Federal Program: COVID 19 – Coronavirus State and Local Fiscal Relief Fund Assistance Listing: 21.027 Pass-Through Entity: Maryland Department of Housing and Community Development Pass-Through Award Number and Period: Not Available, (7/1/2024 – 6/30/2025) Compliance Requirement: Suspension and Debarment Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or Specific Requirement: Internal Control: Per 2 CFR 200.303(a), a non‑Federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. These internal controls should comply with the guidance in Standards for Internal Control in the Federal Government or the COSO Internal Control – Integrated Framework. Compliance: Per 2 CFR 200.213, suspension and debarment restrict awards, subawards, and contracts with parties that are debarred, suspended, or otherwise excluded from participation in Federal assistance programs. Per 2 CFR 180.300, an entity may determine suspension and debarment status by: (a) Checking the SAM Exclusions database; (b) Collecting a certification from the vendor; or (c) Including a clause or condition in the covered transaction. Condition/Context: The vendor was not suspended or debarred, and a suspension and debarment check was performed and maintained in the vendor file. However, there was no evidence to confirm that the check was completed prior to contract execution or the initiation of transactions, as documentation did not include a dated “Received” stamp as required by the Town’s internal control process. Questioned Costs: There are no questioned costs related to this finding as the vendors were not federally suspended or debarred. Cause: The Town did not consistently perform its stated control requiring the SAM.gov check to be reviewed, approved, and dated by the Assistant Town Administrator prior to contract execution or the processing of expenditures. Effect: The Town’s internal controls related to federal suspension and debarment were not consistently performed for purchases made under the program. Failure to verify suspension and debarment requirements may result in the Town entering into a contract or purchase with a vendor that is suspended or debarred and not authorized to provide goods or services under the program. Recommendation: We recommend that the Town reinforce the consistent execution of its existing procedures and internal controls to ensure vendors are verified as not suspended or debarred prior to charging goods and services to the program. In addition, the Town should consistently retain documentation evidencing the timely performance and review of suspension and debarment checks for audit purposes. Views of Responsible Officials: Management agrees with the finding.