Findings Citing § 200.303

Finding 2025-002: Insufficient Documentation of Management Review of Section 3 Quarterly and Annual Reporting Audit Finding: Significant Deficiency Federal Program: Community Development Block Grant Mitigation Program Citywide Drainage Improvements (Assistance Listing 14.228) Compliance Requirement: Reporting and Special Tests and Provisions – Section 3 Requirements Criteria: In accordance with Title 2 of the Code of Federal Regulations (2 CFR) § 200.303, the City must establish and maintain effective internal controls over federal awards that provide reasonable assurance of compliance with federal statutes, regulations, and the terms and conditions of the award. Additionally, 2 CFR § 200.328 requires the City to ensure that reports submitted to the pass-through entity are accurate, complete, and supported by adequate review and oversight. The U.S. Department of Housing and Urban Development’s (HUD) Section 3 regulations at 24 CFR Part 75 require recipients to prepare and submit quarterly and cumulative annual Section 3 reports documenting efforts to provide employment, training, and contracting opportunities to low- and moderate-income persons and businesses within the project area. Condition: The City’s grant administrator is responsible for preparing and submitting the required quarterly and annual Section 3 reports to the Texas General Land Office on behalf of the City. However, there is no documentation demonstrating that City management reviews or approves these reports prior to and after submission. Cause: The City has not established procedures requiring City management to review and document approval of the Section 3 reports prepared and submitted to the Texas General Land Office. Effect: Without documentation of City management review and approval of the Section 3 reports prepared and submitted by the grant administrator, there is an increased risk that reports submitted to the passthrough entity may be inaccurate, incomplete, or not fully compliant with federal reporting requirements. Questioned Costs: None noted. Repeat Finding: This finding is related to the prior year finding 2024-002. Recommendation: The City should strengthen internal controls over federal reporting by establishing and documenting procedures to ensure City management reviews and approves all Section 3 reports prepared and submitted by the grant administrator. Evidence of this review, such as sign-offs or approval correspondence, should be retained in the grant files to demonstrate compliance with Uniform Guidance and HUD Section 3 reporting requirements. View of Responsible Officials: Management concurs with the recommendation. Please refer to the Corrective Action Plan for additional details.

Under the Uniform Guidance (2 CFR 200.512), a non-federal entity that expends $750,000 or more in federal awards during its fiscal year must submit its Single Audit reporting package to the Federal Audit Clearinghouse (FAC) within the earlier of 30 calendar days after receipt of the auditor's report or nine months after the end of the audit period. For the City’s fiscal year ended September 30, 2024, the statutory submission deadline was June 30, 2025. Furthermore, 2 CFR 200.303 requires the City to establish and maintain effective internal control over federal awards to provide reasonable assurance that federal awards are managed in compliance with applicable federal statutes, regulations, and award terms and conditions. The City’s Single Audit reporting package for the fiscal year ended September 30, 2024, was not submitted to the FAC by the June 30, 2025, statutory deadline. The audit could not be initiated in a timely manner due to severe deficiencies in internal control, accounting records, and organizational governance: 1. Unstable General Ledger: The City continued to post transactions to the 2024 fiscal year as late as May 2025, preventing the timely preparation of an auditable trial balance; Breakdown in Organizational Governance: Before audit fieldwork could begin, both the City Manager and City Secretary resigned, leaving the City without administrative management to oversee and coordinate preparation for the financial statement and Single Audit engagements. The City did not maintain an effective and enforceable period-end closing process, and the prior-year general ledger remained open well into the following fiscal cycle. Turnover in the City Manager and City Secretary positions further disrupted administrative continuity and delayed the coordination and record readiness necessary to begin and complete the audit and FAC submission process.

Assistance Listing Number, Federal Agency, and Program Name - 14.128, U.S. Department of Housing and Urban Development (HUD), Mortgage Insurance Hospitals Federal Award Identification Number and Year - N/A (2021) Pass through Entity - N/A Finding Type - Material weakness Repeat Finding - Yes 2024-005 Criteria - Per 2 CFR 200.303, the recipient must establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should align with the guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States, or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations (COSO). Condition - Controls were not designed or implemented effectively to ensure the following: a) mortgage and escrow payments were made in accordance with the due dates and amounts specified in the executed mortgage note agreement. b) earnings are retained in the replacement reserve account. c) the Organization completes the required financial reports in accordance with the applicable accounting basis, supported by underlying records representing the activity for the period reported. Questioned Costs - None If Questioned Costs Are Not Determinable, Description of Why Known Questioned Costs Were Undetermined or Otherwise Could Not Be Reported - N/A Identification of How Questioned Costs Were Computed - N/A Context - While gaining an understanding of management's processes and internal controls to ensure compliance with the areas noted above, we noted no effectively designed control in place to ensure compliance. Cause and Effect - Though noncompliance was not identified, a lack of internal controls could result in noncompliance with program requirements. Recommendation - We recommend that management design and implement internal controls to ensure compliance with mortgage escrow payments, reserve account funding, and quarterly financial reporting requirements. Views of Responsible Officials and Corrective Action Plan - Management will design and implement internal controls to ensure compliance with mortgage escrow payments, reserve account funding, and quarterly financial reporting requirements, including a process to ensure that documentation of reviews is retained.

2025-006 Suspension and debarment (Significant Deficiency) US Treasury Federal award Y5123, MN036 (Passed through Florida Department of Environmental Protection) ALN 21.027 Coronavirus State and Local Recovery Funds Funding Year 2021 Condition: Review of checking for suspension and debarment was not done prior to contracting with the vendor. Criteria: 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal controls. Documentation of the check for suspension or debarment needs to be retained. Cause: The City did not complete a review of their vendors to ensure that the vendors were not suspended and debarred before the City had contracted with the vendor as there was no process in place to check a vendor’s status. Potential Effect of Condition: Good or services could be contracted with a suspended or debarred vendor, creating questioned costs. Questioned Costs: None. The finding relates only to internal control. Perspective: The City does not have controls designed to routinely verify vendors for covered transactions are not suspended or debarred. Recommendation: The City should perform SAM checks for all vendors or contractors prior to entering into covered transactions and retain documentation of these processes. Management Response: Management concurs with the finding. As part of the federal grant award process, City Management will ensure SAM checks are performed prior to contracting with vendors.

2025-007 Controls over reporting (Significant Deficiency) US Treasury Federal award Y5123, MN036 (Passed through Florida Department of Environmental Protection) ALN 21.027 Coronavirus State and Local Recovery Funds Funding Year 2021 Condition: The City did not submit required reports, as defined by the grant agreements and the compliance supplement, by the established due dates. Criteria: 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal controls. 2 CFR Part 200 and the terms and conditions of the federal award require recipients to submit complete and accurate reports by the deadlines established by the federal awarding agency or pass-through entity. Cause: The City did not maintain adequate internal controls to ensure required reports were prepared, reviewed, and submitted in accordance with established deadlines. Potential Effect of Condition: Failure to submit reports timely may impede the awarding agency's ability to monitor program performance and compliance with federal requirements. Additionally, untimely reporting increases the risk of noncompliance with federal award requirements and could result in increased oversight or other actions by the awarding agency. Questioned Costs: None. The finding relates only to reporting, which does not result in questioned costs. Perspective: All reports tested were submitted late; however, the reports were accurate and complete. The sample was not statistically valid. Recommendation: The City should strengthen its internal controls over federal reporting by establishing formal procedures to monitor reporting deadlines, assigning responsibility for report preparation and review, maintaining a reporting calendar, and performing periodic supervisory reviews to ensure all required reports are submitted accurately and timely. Management Response: Management concurs with the recommendation. The Management Analyst will ensure accurate and timely grant reporting.

Federal Agency: Federal Program Title: ALN: Pass-Through Agency: Pass-Through Number: Award Period: U.S. Department of Treasury COVID-19 Coronavirus State and Local Fiscal Recovery Funds 21.027 Texas Department of Emergency Management #1505-0271 March 3, 2021 – December 31, 2026 Type of Finding: Material Weakness in Internal Control Over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), the City of Manor, Texas must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.214, recipients and subrecipients are subject to the nonprocurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, as well as 2 CFR part 180. The regulations in 2 CFR part 180 restrict making Federal awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from receiving or participating in Federal awards. Per 2 CFR 180.505 – Who uses SAM.gov Exclusions? (a) Federal agency officials use SAM.gov Exclusions to determine whether to enter into a transaction with a person, as required under § 180.430 (b) Participants also may, but are not required to, use SAM.gov Exclusions to determine if: (1) Principals of their transactions are excluded or disqualified, as required under § 180.320; or (2) Persons with whom they are entering into covered transactions at the next lower tier are excluded or disqualified. (c) TheSAM.gov Exclusions are available to the general public. Condition: For one procurement, qualification reference checks were performed for a contractor, however, a suspension and debarment check was not checked with SAM.gov. Questioned costs: None Context: See “Condition.” Cause: Individuals performing the vendor compliance checks were not adequately trained on the requirements that must be adhered to per federal guidelines. Effect: Failure to complete proper vendor compliance checks prior to entering into a covered transaction may lead to entering into contracts with suspended or disbarred vendors that could result in noncompliance and questioned costs. Repeat Finding: No Recommendation: We recommend that the City provide additional training to individuals performing vendor compliance checks. We also recommend the City establish internal controls to monitor that vendor compliance checks are being completed accurately and timely. Views of responsible officials: See management response on corrective action plan.

Federal Assistance Listing Number: 97.036 Program: COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Federal Agency Name: US Department of Health and Human Services Federal Award Number:4499DRORP 00008961 Federal Award Year: 2025 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Special Tests and Provisions Criteria: Per Title 2, U.S. Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart E, Section 200.403(a) states that costs must be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. Per Title 2, U.S. Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart F, Section 200.514(d), auditors must test compliance with Special Tests and Provisions. Under the COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) 44 CFR 206.205, the recipient shall make an accounting to the Regional Administrator of eligible costs for each approved large project. In submitting the accounting the recipient shall certify that reported costs were incurred in the performance of eligible work, that the approved work was completed, that the project is in compliance with the provisions of the FEMA-State Agreement, and that payments for that project have been made in accordance with 2 CFR 200.305. Per Title 2, U.S. Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, (Subpart D, Section 200.303), the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Conditions Found: In six of 40 sample items selected for testwork over activities allowed or unallowed and allowable costs/cost principles related to the program, $469,054 in expenditures out of a total of $1,368,522 expenditures (or 34%) were submitted for reimbursement to the Federal Emergency Management Agency (FEMA) but were related to the same invoices and therefore were duplicate expenditures. Upon further investigation, management identified that a total of $2,636,044 expenditures out of a total of $14,470,349 expenditures related to the program were duplicate expenditures. Further, management’s review that was performed over the underlying program details was not designed at a sufficient level of precision that enabled the identification of the duplication errors. Further, in management’s review for the completed project certification for one of two projects for the program these duplication errors were not identified. Cause: In discussing these conditions with management, they stated the Entity did not have adequate controls in place that were designed appropriately to ensure that all the expenditures submitted for reimbursement and certified to FEMA under the COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) program represented allowable costs. Effect: Expenditures could be reimbursed by the program that were not allowable or certified incorrectly, resulting in material non-compliance with program requirements. Questioned Costs: Known questioned costs of $2,636,044. Statistical Sample: The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding:This finding is not a repeat finding. Recommendation:We recommend that management strengthen processes and controls in place to ensure expenditures submitted for reimbursement and certified under the program are appropriately reviewed prior to submission to ensure they represent allowable costs. Views of Responsible Officials: Management agrees with the finding and acknowledges that duplicate expenditures were submitted for reimbursement under the FEMA program. The error resulted from insufficient controls over the tracking, reconciliation, and review of specific expenditures included in reimbursement requests, which allowed certain invoices to be claimed more than once. Upon identification of the issue, management conducted a comprehensive review of all reimbursement requests submitted under the program and identified the full population of duplicate expenditures. Management is committed to maintaining full compliance with federal award requirements and has implemented corrective actions to strengthen reimbursement controls, including enhanced expenditure tracking, independent secondary review procedures, reconciliation of submitted costs to prior claims, and updated policies and staff training. Management does not believe the finding resulted from an intentional misuse of federal funds, but rather from a limited lapse in internal controls over the reimbursement process. Management is working with FEMA, as appropriate, to resolve the duplicate claims.

Finding No.: 2025-006 – Period of Performance Identification of the federal program: Federal Agency: U.S. Department of Education AL No. and Title: 84.027 Special Education Cluster (IDEA) 84.181 Special Education - Grants for Infants and Families 84.403 Consolidated Grants Federal Award No. H027A230013 H181A220008, H181A230008 S403A220002, S403A230002 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 states: The recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: GDOE does not have internal controls to ensure that liquidation of the obligation occurs within the allowable time period. Cause: GDOE’s internal control policies and procedures in place are not suitably designed to ensure that liquidation of the obligation occurs within the allowable time period. Effect or potential effect: GDOE did not comply with the requirements of 2 CFR 200.303. Questioned Costs: Not applicable. The finding relates solely to an internal control deficiency. Context: We performed inquiries and walkthrough of GDOE’s process for complying with the period of performance requirements. Based on procedures performed, we have not identified internal controls addressing the timely liquidation of obligations required by the compliance requirement. Identification as a repeat finding, if applicable: This is not a repeat finding. Recommendation: GDOE should establish and implement internal control policies and procedures over compliance with applicable period of performance requirements, specifically, ensuring liquidation of obligations occur within the allowable time period. View of Responsible Officials: GDOE disagrees with the condition of the finding, however, acknowledges the need to update its SOP and has provided details in its Corrective Action Plan. Conclusion: GDOE’s existing procedures are not suitably designed to ensure that liquidation of the obligation occurs within the allowable time period. The finding remains.

Finding No.: 2025-008 – Cash Management Identification of the federal program: Federal Agency: U.S. Department of Education AL No. and Title: 84.181 Special Education - Grants for Infants and Families 84.403 Consolidated Grants Federal Award No. H181A220008, H181A230008, H181A240008 S403A220002, S403A230002, S403A240002 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 states: The recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: GDOE does not have internal controls to ensure that vendors for federal expenditure are paid either on the same day or within 24 hours after funds had been received. Cause: The current Standard Operating Procedures (SOPs) do not clearly incorporate transitioned roles and responsibilities of the Third Party Fiduciary Agent (TPFA) for accountability to the specific conditions set by the US Department of Education. Effect or potential effect: GDOE did not comply with the requirements of 2 CFR 200.303. Questioned Costs: Not applicable. The finding relates solely to an internal control deficiency. Context: We performed inquiries and walkthrough of GDOE’s process and we have not identified internal controls to ensure compliance with applicable cash management requirements. Identification as a repeat finding, if applicable: This is not a repeat finding. Recommendation: GDOE should establish and implement internal control policies and procedures over compliance with applicable cash management requirements. View of Responsible Officials: GDOE does not agree with the finding and provides details in its Corrective Action Plan. Conclusion: The FY25 U.S. Department of Education carried forward the FY24 Specific Conditions dated June 24, 2024 which states that “Now that GDOE is managing its Department funds independently without TPFA oversight, GDOE must continue to fulfill the responsibilities that were previously performed by the TPFA.” The finding remains.

2025-001 Compliance and Internal Controls over Reporting (Significant Deficiency) Assistance Listing Number 17.259 – Workplace Innovation and Opportunity Act Cluster / WIOA Youth Activities 2024-2025 Funding U.S. Department of Labor Passed through Texas Workforce Commission / Houston Galveston Area Council Contract No. 206-25 Criteria: Under 2 CFR Section 200.303(a), the recipient and subrecipient must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, per the Subrecipient Contract Scope of Work 13.1, a monthly report to the Board and H-GAC contract liaison is due by the 10th of each month. Monthly reports are required to be submitted to the grantor to properly track grant progress, which allows the grantor to determine if further action is needed to fulfill the purpose of the grant. Condition: Monthly reports for October 2024, December 2024 and May 2025 were not submitted timely. SER-Jobs’ established controls over the reporting process did not work effectively to detect and/or correct non-compliance over the reporting process. Cause: Monthly reports were submitted late due to delays in accounting period close, which delayed the submission process to include the financial information in the required reports. Effect: Failure to submit the required reports as stipulated in the scope of work by the grantor may constitute a breach of contract and potential loss of funding. Questioned Costs: None. Perspective: 3 out of the 4 reports selected for our testing were not submitted timely. Repeat Finding: No Recommendation: Ser-Jobs should establish procedures to ensure that controls related to reporting are consistently implemented which should include prompt completion of the accounting period close to allow for timely submissions. Views of Responsible Officials: We concur with the recommendation, please see Corrective Action Plan.

2025-001: Accounting Records and Documentation (Significant Deficiency) Federal Program: Child Nutrition Cluster – School Breakfast Program (AL No. 10.553) and National School Lunch Program (AL No. 10.555) Condition: During our audit of compliance with federal program requirements, we noted that the District did not consistently maintain accounting records and supporting documentation for Child Nutrition Program reimbursement transactions in a manner that ensured timely accessibility for audit testing. Certain reimbursement requests and related supporting documentation were not readily available during audit fieldwork. As a result, we were required to perform expanded audit procedures, including additional reconciliations and alternative testing, to obtain sufficient appropriate audit evidence supporting the reported reimbursement amounts. Criteria: Uniform Guidance (2 CFR §200.302 and §200.303) requires nonfederal entities to maintain accurate, complete, and adequately supported financial records and to establish effective internal controls to ensure compliance with federal program requirements. Cause: The deficiency appears to be attributable to weaknesses in the District’s documentation retention, organization, and supervisory review procedures related to Child Nutrition reimbursement reporting. Effect: Although documentation was not fully sufficient at the outset of audit testing, expanded audit procedures allowed us to obtain reliable support for the reimbursement amounts tested. No questioned costs or audit differences were identified as a result of this condition. Testing of reimbursement activity disclosed no variances between amounts reported and amounts received, based on a tested population totaling $793,987.13. Recommendation: We recommend that the District strengthen its internal controls over the preparation, review, organization, and retention of Child Nutrition Program reimbursement documentation to ensure that complete and accurate supporting records are maintained and readily available for audit and monitoring purposes. Views of Responsible Officials: The District’s management concurs with the finding and plans to implement procedures to improve the completeness and accessibility of accounting records and supporting documentation related to federal program reimbursements.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Suspension and Debarment, Reporting, Special Tests and Provisions – Information Technology – User Access Federal Agency: U.S. Department of Agriculture (USDA) Federal Program Title: Food Distribution Cluster Texas 1944 Water Treaty Grant ALN: 10.565, 10.568, 10.560 10.126 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Food Distribution Cluster 246TX816Y8105, 256TX816Y7105, 246TX818Y8613, 238TX000I1003, 246TX816Q2204 October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025, November 3, 2023 - November 2, 2024, May 23, 2023 - June 30, 2025, October 1, 2023 - September 30, 2024 Texas 1944 Water Treaty Grant FSA25GRA0012028 March 19, 2025 - March 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Department of Agriculture (TDA) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of user termination controls, we identified two instances, out of a sample of 14 terminated users, in which access was not removed within the timeframe required by TDA’s System Administrator separation process (i.e., application access removed on the date of the ticket/same day of termination and network access within one business day): Application (TX‑UNPS): User A was terminated on 06/13/2025. Network access was removed on 06/16/2025 (within one business day), but TX‑UNPS application access remained active until 06/19/2025 (removed after four business days), which does not meet the same‑day requirement for application access. Network: User B was terminated on 09/13/2024. Network access was removed on 09/17/2024 (removed after one business day due to weekend/holiday schedule), which does not meet the requirement for removal within one business day. Questioned costs: None. Context: See “Condition.” Cause: The delays appear to be the result of breakdowns in the coordination between HR separation processes and IT access revocation procedures, including delays in communication or gaps in the automated termination workflow. Effect: Failure to remove user access promptly increases the risk of: • Unauthorized access to confidential or sensitive information; • Potential manipulation, loss, or misuse of program data; • Increased exposure to operational and security risks. Although no misuse of access was identified, the presence of active credentials after termination represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend that TDA: • Strengthen coordination between HR and IT functions to ensure immediate notification upon employee separation. • Implement automated workflows that disable all user access promptly upon termination. • Conduct periodic reconciliations of HR separation lists against active user accounts to detect and remove any lingering access. • Enhance monitoring controls, including reporting dashboards or alerts triggered when access is not removed within a defined timeframe. Views of responsible officials: TDA agrees with the finding. TDA acknowledges that improvements can be made to the separation process.

Cash Management, Eligibility, Matching and Earmarking, Period of Performance, Suspension and Debarment, Reporting, Subrecipient Monitoring, Special Tests and Provisions – Information Technology – Change Management Federal Agency: U.S. Department of Justice Federal Program Title: Crime Victim Assistance ALN: 16.575 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 15POVC-25-GG-00366-ASSI, 15POVC-24-GG-00728-ASSI, 15POVC-23-GG- 00468-ASSI, 15POVC-22-GG-00468-ASSI, 2020-V2-GX-0040 October 1, 2024 – September 30, 2028, October 1, 2023 – September 30, 2027, October 1, 2022 – September 30, 2026, October 1, 2021 – September 30, 2025, October 1, 2020 – September 30, 2025, October 1, 2019 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Office of the Governor must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During our review of information technology general controls related to network change management, we noted that the organization does not have a formal, documented change control process governing changes and approvals to the network hardware components and systems. As a result, network changes may not be consistently documented, reviewed, or formally approved. For purposes of this control, network changes include any additions, modifications, or removals affecting the network infrastructure, including but not limited to: • Network hardware (e.g., routers, switches, firewalls, wireless devices) • Network device configurations • Network related software, firmware, or operating system components Questioned costs: None. Context: See “Condition.” Cause: Management is aware of this matter and a draft policy initiative is already underway and targeted for completion during fiscal year 2026. Effect: In the absence of a formal documented change management process, there is an increased risk that unauthorized or untested network changes could adversely impact the confidentiality, integrity, or availability of systems and data. Repeat Finding: No Recommendation: We recommend that management finalize and implement the formal, documented network change management process to ensure all changes to network hardware, configurations, and related software are properly requested, reviewed, approved, tested, and documented. Views of responsible officials: A formal but not documented process has been utilized which requires CIO approval of all changes. A Project was instigated in 2024 to formalize and embed the verbal process into a written process with auditable execution logs. The project is in its final stages

Reporting – Financial, Performance and Special Reporting Federal Agency: U.S. Department of Labor (DOL) Federal Program Title: Unemployment Insurance (UI) ALN: 17.225 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: UI372522255A48, UI380082260A48, UI382492255A48, 23A03UI0389351, 23A60UR000007, 23A60UB000060, 24A55UI000051, 24A55UT000017, 24A60UR000091, 24A60UD000038, 25A55UE000005, 25A60UB000137, 25A60UB000149, 25A60UB000176, 25A60UB000187, 25A60UD000047, 25A55UI000094, 25A55UT000066, 25A60UR000102 October 1, 2021 – December 31, 2024, January 1, 2022 – September 30, 2024, January 1, 2022 – March 31, 2025, October 1, 2022 – December 31, 2025, January 1, 2023 – September 30, 2025, April 1, 2023 – May 22, 2025, October 1, 2023 – December 31, 2026, October 1, 2023 – September 30, 2024, January 1, 2024 – September 30, 2026, May 17, 2024 – May 17, 2027, July 1, 2024 – December 31, 2025, July 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2025, July 9, 2024 – July 9, 2027, October 1, 2024 – December 31, 2027, October 1, 2024 – September 30, 2025, January 1, 2025 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: "Per 2 CFR §200.303(a), Texas Workforce Commission (TWC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of financial, performance, and special reporting, we identified gaps in TWC’s documentation and oversight of its reporting processes. Specifically, for the ETA 2112 – UI Financial Transaction Summary, we tested three monthly reports, and none contained evidence of review or approval prior to submission. Similarly, for the ETA 9050 – Time Lapse of All First Payments Except Workshare and the ETA 9052 – Nonmonetary Determination Time Lapse Detection performance reports, we tested three monthly submissions for each report type, and all lacked documentation demonstrating that a formal accuracy and completeness review was performed. In addition, our testing of two quarterly ETA 2208A – Quarterly UI Above-Base Reports identified a lack of segregation of duties. For both reports tested, the individual responsible for preparing the report also performed the review function. Questioned costs: None. Context: See “Condition.” Cause: The absence of documented reviews and approvals appears to result from insufficient internal controls over the reporting process, including unclear staff responsibilities. These control gaps contributed to inconsistent application of review procedures and allowed instances where documentation of required oversight did not occur or was performed by the same individual responsible for report preparation. Repeat Finding: No Recommendation: TWC should strengthen internal controls over the reporting process by establishing clear roles and responsibilities for the preparation, review, and approval of all required ETA reports. Management should ensure that each report undergoes a documented, independent review to verify accuracy and completeness before submission. Additionally, TWC should provide targeted training to staff on reporting requirements and internal control expectations to reinforce consistent application of review procedures and prevent situations where the preparer and reviewer are the same individual. Views of responsible officials: Management agrees on the importance of the ETA reports and the accuracy of the information in the reports.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Reporting – Information Technology – User Access Federal Agency: U.S. Department of Veterans Affairs Federal Program Title: Veteran's State Nursing Home Care ALN: 64.015 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: N/A Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), The General Land Office (GLO) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During our assessment of access controls, we noted that while GLO performs user access reviews for accounts with privileged (elevated) access to the network. No periodic user access review is performed for all network users (non‑privileged/general users) within the audit period. As a result, there is no documented verification that standard user accounts retain only appropriate, job‑related access. Questioned costs: None. Context: See “Condition.” Cause: The condition appears to result from policy and process gaps that focus review efforts primarily on privileged accounts, coupled with the absence of a formalized, agency‑wide schedule and procedure for reviewing all network users’ access and retaining evidence of those reviews. Effect: Failure to conduct and document periodic access reviews for all network users increases the risk that: • Excessive or outdated access persists undetected; • Unauthorized access to systems or data may occur; • Potential security, operational, and compliance exposures are elevated. No instances of misuse were identified during our procedures; however, the lack of comprehensive reviews represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend that GLO: • Establish a formal, documented access review program that covers all network users (privileged and non‑privileged) on at least an annual cadence. • Implement standardized templates and a central repository to capture review date, reviewer, population, exceptions identified, and remediation actions taken. • Periodically monitor adherence to the review schedule and report completion status and exceptions to management governance (e.g., IT leadership or an information security committee). Views of responsible officials: Management of the Texas General Land Office (GLO), Information Technology Services (ITS) Department, concurs with the audit finding and agrees that formalizing and documenting a periodic user access review process for all non-privileged network users will further strengthen the agency’s internal control framework and cybersecurity posture in alignment with 2 CFR §200.303 and applicable federal internal control standards.

Procurement and Suspension and Debarment Federal Agency: U.S. Environmental Protection Agency Federal Program Title: Drinking Water State Revolving Fund (DWSRF) ALN: 66.468 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2521902915 September 1, 2024 - August 31, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: "Per 2 CFR §200.303(a), Texas Commission on Environmental Quality (TCEQ) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR §200.318, the recipient or subrecipient must maintain and use documented procedures for procurement transactions under a federal award or subaward, including for acquisition of property or services. These documented procurement procedures must be consistent with State, local, and tribal laws and regulations and the standards identified in §§ 200.317 through 200.327. Per 2 CFR §200.214, recipients and subrecipients are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, as well as 2 CFR part 180. The regulations in 2 CFR part 180 restrict making Federal awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from receiving or participating in Federal awards. Condition: Audit procedures included a review of five procurements conducted during the fiscal year to assess whether TCEQ adhered to required procurement procedures and performed vendor eligibility verifications prior to entering into covered transactions. For one procurement, totaling $16,175, the required procurement processes were not followed, and the necessary vendor compliance checks, including verification of suspension and debarment status, were not completed before executing the transaction. Questioned costs: None. Context: See “Condition.” Cause: The procurement was initiated directly by the program area without notifying or coordinating with the Procurement and Contracts Section. Program staff proceeded with the purchase under the assumption that procurement involvement was unnecessary because the selected vendor was the sole provider of the required item. As a result, established procurement procedures and vendor compliance verification processes were not followed. Effect: Failure to follow procurement procedures and complete proper vendor compliance checks prior to entering into a covered transaction may lead to entering contracts with suspended or debarred vendors that could result in noncompliance and questioned costs. Repeat Finding: No Recommendation: TCEQ should provide targeted training to program staff on federal procurement requirements, including the necessity of coordinating all purchases through the P&C Section and completing required vendor compliance checks. Training should emphasize procedures for sole‑source or limited‑source procurements and reinforce staff responsibilities under 2 CFR procurement and internal control standards. Regular refresher sessions and documented guidance will help ensure consistent understanding and adherence to required procurement practices across all program areas. Views of responsible officials: The Financial Administration Division (FAD) will implement the audit’s recommendations. FAD will reinforce the guidance provided through continuous training, documentation, and improved internal controls.

Cash Management, Eligibility, Level of Effort, Earmarking, Period of Performance, Subrecipient Monitoring – Information Technology – User Access Federal Agency: U.S. Department of Education (USDE) Federal Program Title: Career and Technical Education - Basic Grants to States ALN: 84.048 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: V048A220043, V048A230043, V048A240043 July 1, 2022 - September 30, 2023, July 1, 2023 - September 30, 2024, July 1, 2024 - September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Higher Education Coordinating Board (THECB) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of access controls, we noted that while THECB performs user access reviews for individuals with network access, the reviews were not documented. The absence of documented evidence prevents verification that the reviews were completed, who performed them, when they were performed, and whether identified issues were appropriately resolved. Questioned costs: None. Context: See “Condition.” Cause: The lack of documented access reviews appears to result from informal review processes and insufficient procedures requiring reviewers to maintain written evidence of the review. Additionally, there may be no standardized template or centralized repository for retention of such documentation. Effect: Without documentation of the network access review, THECB cannot demonstrate that: • Reviews were performed within the applicable audit period • Access rights were validated for appropriateness • Unauthorized or outdated access was identified and removed This lack of documentation increases the risk of unauthorized system access, potential misuse of systems or data, and noncompliance with federal internal control requirements. Repeat Finding: No Recommendation: We recommend that THECB: • Develop and implement a standardized documentation process for all user access reviews, including a required template documenting review date, reviewer identity, scope, results, and remediation actions. • Maintain all documentation in a centralized repository accessible to IT management and audit personnel. • Implement periodic monitoring to ensure reviews are performed timely and documentation is consistently retained. • Consider using automated access review tools to support completeness, timeliness, and auditability of reviews. Views of responsible officials: THECB ITS agrees with the finding.

Reporting – ACF-196R Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXTANF October 1, 2023 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR §265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. The ACF-204 report (Annual Report on State Maintenance-of-Effort Programs) must be completed and submitted in accordance with the requirements at 45 CFR §265.9(c). The report includes several line items that contain critical information, including “Total State MOE Expenditures.” Input for the Total State MOE expenditures line item is provided by the Texas Education Agency (TEA), the Texas Workforce Commission (TWC), and HHSC. The MOE amounts in the ACF-204 report are to agree to the amounts in the final ACF-196R report. For the FY2024 ACF-196R report, the contributing agencies reported State MOE expenditures on various line items including but not limited to: HHSC – Line 6a (Basic Assistance (excluding Relative Foster Care Maintenance Payments and Adoption and Guardianship Subsidies) TEA – Line 11b (Pre-Kindergarten/Head Start) Condition: All key line items in the FY 2024 ACF‑204 report were tested and agreed to supporting documentation without exception. However, the Total State Maintenance of Effort (MOE) Expenditures reported in the ACF‑204 by HHSC and the Texas Education Agency (TEA) did not reconcile to the amounts reported in the ACF‑196R as shown below: Amounts reported in the ACF‑204 were accurate and supported; the variances occurred because the ACF‑196R reflected higher MOE expenditures than those reported on the ACF‑204. Questioned costs: None. Context: See “Condition.” Cause: The variance in line 11b was due to miscommunication between the relevant HHSC personnel regarding revisions to an initial submission. The variance in line 6a was due to the HHSC Federal Reporting Team incorrectly including period 1 of 2025 in the MOE calculation. The agency did not perform a complete reconciliation between the ACF‑204 and ACF‑196R prior to submission, resulting in inconsistent MOE reporting across the required reports. Effect: Inaccurate or inconsistent reporting of MOE expenditures increases the risk of noncompliance with federal reporting requirements under 2 CFR §200.302 (financial management) and 2 CFR §200.329 (performance and financial reporting). These discrepancies may impair the federal awarding agency’s ability to evaluate program performance, assess State MOE compliance, and rely on the accuracy of reported financial information. Repeat Finding: No. Recommendation: HHSC should strengthen their financial reporting controls to ensure consistency between the ACF‑204 and ACF‑196R reports. Specifically, the agency should implement a formal reconciliation process that: • Compares all MOE expenditure amounts reported on the ACF‑204 to those reported on the ACF‑196R prior to submission; • Requires documented review and approval of the reconciliation by management; and • Ensures any discrepancies are researched, resolved, and corrected before the reports are finalized. Views of responsible officials: HHSC concurs with the recommendation.

Special Tests and Provisions – Child Support Non-Cooperation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXTANF, 2501TXTANF October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 U.S.C 608 (a)(2), if the agency responsible for administering the State plan approved under part D determines that an individual is not cooperating with the State in establishing paternity or in establishing, modifying, or enforcing a support order with respect to a child of the individual, and the individual does not qualify for any good cause or other exception established by the State pursuant to section 654(29) of this title, then the State: (1) shall deduct from the assistance that would otherwise be provided to the family of the individual under the State program funded under this part an amount equal to not less than 25 percent of the amount of such assistance; and (2) may deny the family any assistance under the State program. The State’s policy is to reduce benefits 100% for non-cooperation. HHSC policy requires that when the Office of the Attorney General (OAG) identifies a TANF recipient who has failed to cooperate with child support requirements, OAG must notify HHSC within seven days of the non‑cooperation date. Upon receipt, HHSC must apply the sanction within five working days. Condition: A sample of 40 TANF beneficiaries who were reported as non‑cooperating with program requirements during fiscal year 2025 was selected for testing. Two instances of untimely sanction application were identified: • One case in which HHSC reduced benefits one month late, resulting in an overpayment of $320. • One case in which HHSC reduced benefits two months late, resulting in an overpayment of $890. Questioned costs: $1,210 Context: See “Condition.” Cause: HHSC’s internal controls did not consistently ensure timely processing of sanctions upon receipt of non‑cooperation referrals from OAG. Existing monitoring and workflow procedures were insufficient to detect or prevent delays in applying benefit reductions. Effect: Failure to apply sanctions within required timeframes can lead to inaccurate benefit issuance, questioned costs, and weakened program integrity. Repeat Finding: No. Recommendation: HHSC should strengthen internal controls over the processing of TANF non‑cooperation sanctions to ensure timely application in accordance with program requirements. Specifically, HHSC should: • Implement an automated or workflow‑based tracking mechanism to monitor the timeliness of sanctions received from OAG. • Provide refresher training to eligibility staff on timely sanction procedures and the importance of preventing improper payments. Views of responsible officials: HHSC concurs with the recommendation.

Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXTANF, 2501TXTANF October 1, 2023 – September 30, 2024 and October 1, 2024 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Workforce Commission (TWC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §261.60(a)-(c), a State must report the actual hours that an individual participates in an activity. It is not sufficient to report the hours an individual is scheduled to participate in an activity. For unsubsidized employment, subsidized employment, and on-the-job training, the State may report projected actual hours of employment participation for up to six months based on current, documented actual hours of work. Any time the State receives information that the client's actual hours of work have changed, or no later than the end of any six-month period, the agency must re-verify the client's current actual average hours of work and may report these projected actual hours of participation for another six-month period. Condition: Audit procedures included independently recalculating average work participation hours for a sample of 40 TANF cases and comparing those results to the hours reported to the U.S. Department of Health and Human Services on the ACF‑199 report. For one of the 40 cases tested, the recalculated average work hours did not agree with the hours reported on the ACF‑199. This discrepancy resulted in a net overstatement of 9 hours on the ACF‑199 report. Questioned costs: No. Context: See “Condition.” Cause: The variance in reported hours for the affected case resulted from a system processing error by the third‑party vendor. During extraction from the WorkInTexas (WIT) system, TWC’s case management system, and file creation for transmission to HHSC, certain hour entries were inadvertently duplicated, leading to the double‑counting of participation hours and, consequently, an overstatement in the ACF‑199 reporting. Effect: Inaccurate reporting of work participation hours affects the reliability of the State’s TANF data submitted to the federal government and may compromise the accuracy of the State’s calculated work participation rates. Such reporting inaccuracies increase the risk of noncompliance with federal work verification requirements and may expose the State to potential penalties if similar errors are systemic or not promptly addressed. Repeat Finding: No. Recommendation: TWC, in coordination with the system vendor, should strengthen controls over the extraction, translation, and transmission of work participation hour data used in the ACF‑199 report. Specifically, TWC should: • Require the third-party vendor to implement system safeguards that prevent the duplication of hour entries during data extraction from the WIT system and subsequent file creation. • Establish automated validation checks to detect anomalies such as duplicate lines, unexpected variances, or irregular hour totals prior to ingesting vendor files into TWC systems. • Enhance supervisory review procedures to ensure that data received from third‑party vendors is reconciled to source records and verified for completeness and accuracy before inclusion in federal reporting. Views of responsible officials: TWC’s Divisions of Workforce Development, Information Technology, and Information, Innovation and Insight agree with the recommendations.

Cash Management – Cash Management Improvement Act Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Low-Income Home Energy Assistance Program (LIHEAP) ALN: 93.568 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2301TXLIEA, 2301TXLIEE, 2401TXLIEA, 2401TXLIEI, 2501TXLIEA, 2501TXLIEI October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 31 CFR §205.20, states use clearance patterns to project when funds are paid out, given a known dollar amount and a known date of disbursement. A state must ensure that clearance patterns meet the following standards: (a) A clearance pattern must be auditable. (b) A clearance pattern must accurately represent the flow of Federal funds under the Federal assistance programs to which it is applied. (c) A clearance pattern must include seasonal or other periodic variations in clearance activity. (d) A clearance pattern must be based on at least three consecutive months of disbursement data, unless additional data is required to accurately represent the flow of Federal funds. (e) If a State uses statistical sampling to develop a clearance pattern, the sample size must be sufficient to ensure a 96 percent confidence interval no more than plus or minus 0.25 weighted days above or below the estimated mean. (f) A clearance pattern must extend, at a minimum, until 99 percent of the dollars in a disbursement have been paid out for Federal assistance program purposes. (g) We and a State may agree to other procedures, such as estimates to project when funds are paid out when the dollar amount and/or the timing of disbursements are not known. Condition: The LIHEAP program is included in the Treasury-State Agreement effective for the fiscal year ending August 31, 2025, and it meets the threshold for inclusion under the Cash Management Improvement Act (CMIA). As such, TDHCA is required to prepare Period 1 clearance pattern calculations supported by verifiable disbursement data to ensure federal funds are drawn in accordance with the program’s required average clearance pattern of three days. TDHCA did not prepare a Period 1 clearance pattern calculation for LIHEAP based on at least three consecutive months of disbursement data as required. Although the Treasury-State Agreement specifies a three‑day average clearance pattern for the program, TDHCA did not maintain or provide documentation supporting how this clearance pattern was developed. As a result, the clearance pattern was not auditable, and we were unable to determine whether TDHCA’s practices for drawing federal funds aligned with the CMIA requirements. Questioned costs: None. Context: See “Condition.” Cause: Management noted their clearance pattern reflected their established funding techniques and prior reports; therefore, they overlooked the specific Treasury-State Agreement documentation requirements. Effect: Although we were able to perform testing over TDHCA’s cash management practices for LIHEAP and concluded that no federal interest was earned as a result of timing differences, the absence of a documented Period 1 clearance pattern calculation prevented us from validating the accuracy of the three‑day clearance pattern prescribed in the Treasury–State Agreement. Without an auditable calculation, TDHCA cannot demonstrate that the established clearance pattern is supported by actual disbursement data, which limits assurance that the methodology used for federal draws fully complies with CMIA requirements. Repeat Finding: No Recommendation: TDHCA should establish and implement procedures to ensure that a Period 1 clearance pattern calculation is completed and retained for LIHEAP in accordance with CMIA and Treasury–State Agreement requirements. This calculation should be based on at least three consecutive months of actual disbursement data and documented in a manner that is readily auditable. TDHCA should also provide training to staff responsible for CMIA compliance to ensure they are aware of the requirement to prepare and maintain this calculation. Views of responsible officials: The Texas Department of Housing and Community Affairs acknowledges and agrees with the finding.

Reporting – Quarterly Performance and Management Report Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Low-Income Home Energy Assistance Program (LIHEAP) ALN: 93.568 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2501TXLIEI October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §96.82(a), each grantee which is a State or an insular area which receives an annual allotment of at least $200,000 shall submit to the Department, as part of its LIHEAP grant application, the data required by section 2605(c)(1)(G) of Public Law 97-35 (42 U.S.C. 8624(c)(1)(G)) for the 12-month period corresponding to the Federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance. Key Line Items containing critical information include: 1. Section 1 – Total Households Assisted 2. Section 2 – Performance Management 3. Section 3 – Estimated Use of Funds 4. Section 4 – LIHEAP Program Implementation and Support Condition: As part of our testing of the Quarterly Performance and Management Report for award 2501TXLIEI, we selected 2 of the 4 reports submitted during the fiscal year. During our review, we identified a discrepancy in the quarter 1 report (October 1 – December 31). The report stated that $159,463,428 in LIHEAP funds had been obligated by funding source in Section 3 – Estimated Use of Funds; however, supporting documentation reflected obligated funds totaling $174,447,109, resulting in a variance of $(14,983,681). Questioned costs: None. Context: See “Condition.” Cause: An error was made when TDHCA staff entered the amount of funds obligated into the report, and existing internal controls did not detect the error before the report was submitted to U.S. Department of Health and Human Services (HHS) Effect: Inaccurate reporting may lead to misstated financial information at the federal level, hinder management’s ability to make informed decisions, and could affect federal oversight and monitoring of program activity. These discrepancies increase the risk of noncompliance with federal reporting requirements and may impact the integrity of cumulative statewide LIHEAP reporting. Repeat Finding: No Recommendation: We recommend that TDHCA strengthen its review and reconciliation procedures for quarterly LIHEAP reporting to ensure that amounts reported are fully supported by accurate and complete documentation. This should include implementing a formal review process that requires verification of reported obligation amounts against source records prior to submission, as well as enhanced training for staff responsible for report preparation. Views of responsible officials: The Texas Department of Housing and Community Affairs acknowledges and agrees with the finding.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Period of Performance, Reporting, Subrecipient Monitoring – Information Technology – User Access Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant ALN: 93.558 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Temporary Assistance for Needy Families 2401TXTANF, 2501TXTANF October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025 Social Services Block Grant 2301TXSOSR, 2401TXSOSR, 2501TXSOSR October 1, 2022 - September 30, 2024, October 1, 2023 - September 30, 2025, October 1, 2025 - September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), the Department of Family and Protective Services (DFPS) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of user access termination controls, we identified two instances, out of a sample of 25 terminated users, in which individuals were not removed from the Network and IMPACT in a timely manner. In both cases, the users’ accounts remained active well beyond their documented termination dates, resulting in unauthorized active credentials during the post‑termination period. The two exceptions were as follows: User A: Termination date 11/05/2024; access not removed until 11/22/2024. User B: Termination date 11/17/2024; access not removed until 02/20/2025. Questioned costs: None. Context: See “Condition.” Cause: The delays appear to be the result of breakdowns in the coordination between HR separation processes and IT access revocation procedures, including delays in communication or gaps in the automated termination workflow. Effect: Failure to remove user access promptly increases the risk of: • Unauthorized access to confidential or sensitive information; • Potential manipulation, loss, or misuse of program data; • Increased exposure to operational and security risks. Although no misuse of access was identified, the presence of active credentials after termination represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend DFPS: • Strengthen coordination between HR and IT functions to ensure immediate notification upon employee separation. • Implement automated workflows that disable all user access promptly upon termination. • Conduct periodic reconciliations of HR separation lists against active user accounts to detect and remove any lingering access. • Enhance monitoring controls, including reporting dashboards or alerts triggered when access is not removed within a defined timeframe. Views of responsible officials: Management agrees with the findings.

Reporting – Post-Expenditure Report Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant ALN: 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXSOSR October 1, 2023 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The 42 USC 1397e requires states and territories to submit to the federal administering agency, the Office of Community Services, an annual Post Expenditure Report no later than six months following the close of the fiscal year. The report includes certain critical key line information including: • TANF Funds Transferred into SSBG –Amount reported on this line item should be consistent with the TANF federal financial report (ACF-196R). The Federal Funds Office (FFO) is responsible for the completeness, accuracy, and timely submission of the Post Expenditure Report. Federal Reporting Fiscal Management personnel are responsible for proper reporting and submission of the ACF-196R Report. Condition: During testing of key line items for the FY2024 Post Expenditure Report submitted in March 2025, we noted that TANF Funds Transferred into SSBG was reported as $41,623,634. However, the amount reported on the ACF-196R report was $38,778,521, resulting in a variance of $2,845,113. Questioned costs: None Context: See “Condition.” Cause: FFO did not properly coordinate efforts with the Federal Reporting personnel to ensure the amounts noted on the ACF-196R report were consistent with the amount on the Post Expenditure Report. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: 2023-013, 2024-008 Recommendation: We recommend the FFO coordinate with the appropriate Federal Reporting Team personnel regarding amounts noted for the TANF Funds Transferred into SSBG to ensure the amount in the Post Expenditure Report matches with the amount in the ACF-196R. Views of responsible officials: HHSC concurs with the recommendation.

Earmarking – Administrative Expenses Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1B09SM087322 October 17, 2022 – October 16, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 U.S.C 300x-5(b), a funding agreement for a grant under section 300x of this title is that the State involved will not expend more than 5 percent of the grant for administrative expenses with respect to the grant. Condition: HHSC expended $1,069,086 of the total grant award amount of $3,690,918 as of the end of the project period. Administrative expenditures for the grant totaled $54,672, which represents 5.11 percent of the federal funds expended, exceeding the allowable 5 percent threshold. Questioned costs: $1,217. Context: See “Condition.” Cause: The overage resulted from a delay in the grant’s start date, which subsequently postponed the initiation of related projects and led to lower overall expenditures. Effect: By exceeding the 5 percent administrative cap, HHSC did not comply with the statutory limitation on administrative costs, resulting in unallowable administrative expenditures charged to the grant. This noncompliance may require reimbursement to the federal agency and increases the risk of future questioned costs. Repeat Finding: No Recommendation: We recommend HHSC make necessary adjustments to federal expenditures in the event of program delays to ensure the agency stays within required percentage maximums. Views of responsible officials: HHSC concurs with the recommendation.

Subrecipient Monitoring – Missing Contract Elements Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Special Education – Grants for Infants and Families Temporary Assistance for Needy Families (TANF) Block Grants for Prevention and Treatment of Substance Abuse ALN: 84.181 93.558 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Special Education – Grants for Infants and Families H181A200171, H181A210171, H181A220171, H181A230171, H181A240171, H181A250171 July 1, 2020 – September 30, 2021, July 1, 2021 – September 30, 2022, July 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2024, July 1, 2024 – September 30, 2025, July 1, 2025 – September 30, 2026 TANF 2001TXTANF, 2101TXTANF, 2201TXTANF, 2301TXTANF, 2401TXTANF and 2501TXTANF October 1, 2019 – September 30, 2020, October 1, 2020 – September 30, 2021, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 and October 1, 2024 – September 30, 2025 Block Grants for Prevention and Treatment of Substance Abuse 1B08TI083969, 1B08TI084609, 1B08TI083054, 1B08TI083478, 1B08I084673, 1B08TI085835, 1B08TI087067, 1B08TI088134 September 1, 2021 – March 24, 2025, September 1, 2021 – March 24, 2025, October 1, 2019 – September 30, 2021, October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR §200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the certain required information provided. A pass-through entity must provide the best available information when some of the required information is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes the subrecipient’s unique entity identifier (UEI), assistance listings numbers (ALN), and title of the program. Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: Special Education – Grants for Infants and Families (SEGIF) –The UEI was not included in the base subaward agreement for seven of the eight agreements selected for testing. The last amendment to the original agreement included the UEI number, however, it did not reference the ALN and title of the program. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Temporary Assistance for Needy Families – The ALN and title of the program was not included in four of the seven subaward agreements selected for testing. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Block Grants for Prevention and Treatment of Substance Abuse –The UEI was not included in one of the 18 agreements selected for testing. The start and end dates for the agreement was September 1, 2020 – August 31, 2025. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR §200.332 prior to execution is not at the correct precision level. Effect: Because required subaward information was omitted, HHSC increased the risk that subrecipients were not fully informed of the federal award details necessary to properly administer the funds in compliance with the applicable statutes, regulations, and award terms. Missing UEI, ALN, and program titles may impede subrecipients’ ability to accurately identify the federal program, appropriately report activities, and meet federal requirements, including those related to financial management, performance, subrecipient monitoring, and audit preparation. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements noted in 2 CFR §200.332. Views of responsible officials: HHSC concurs with the recommendation.

Level of Effort - Supplement not Supplant Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster ALN: 93.044, 93.045, 93.053 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXOASS, 2201TXOANS, 2201TXOACM, 2201TXOAHD October 1, 2021 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §1321.9(c)(2)(xvi), funds awarded under Title III of the Older Americans Act for services provided under section 321(d) (42 U.S.C 3030d(d)) must be used to supplement, not supplant existing Federal, State, and local funds expended to support those activities. Condition: A comparison of supportive services and senior center funding between fiscal years 2023 and 2024 showed that total service levels increased by approximately 5 percent, rising from $40,354,713 in FY2023 to $42,267,130 in FY2024. During the same period, federal expenditures increased by 8 percent, from $31,170,863 to $33,755,005, while non‑federal expenditures decreased by 7 percent, from $9,183,850 to $8,512,125. Because the increase in federal funding outpaced the increase in total services, and was accompanied by a reduction in non‑federal contributions, federal funds effectively replaced rather than supplemented state or other non‑federal resources. Accordingly, HHSC supplanted non‑federal funds with federal funds for the 2024 grant. To quantify the financial impact, total services increased by 5 percent; therefore, the federal contribution would be expected to increase proportionally by 5 percent. Applying a 5 percent growth rate to the FY2023 federal amount of $31,170,863 yields an expected level of $32,729,406 for FY2024. However, actual federal expenditures totaled $33,755,005, resulting in excess federal funding of $1,025,599 beyond what would be needed to support the observed service increase. Questioned costs: $1,025,599. Context: See “Condition.” Cause: HHSC has followed supplement not supplant policies and procedures that were implemented based on compliance with total level of services (i.e., all services) and not specifically for supportive services and senior centers, as required. Effect: HHSC has supplanted non-federal funds used for supportive services and senior centers, resulting in questioned costs and noncompliance. Repeat Finding: No Recommendation: HHSC should revise existing policies and procedures to ensure they are not supplanting nonfederal funds specifically related to supportive services and senior centers. Views of responsible officials: HHSC concurs with the recommendation.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Block Grants for Community Mental Health Services Block Grants for Prevention and Treatment of Substance Abuse ALN: 93.044, 93.045, 93.053 93.558 93.667 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXSSC6, 2101TXCMC6, 2101TXHDC6, 2201TXOASS, 2201TXOANS, 2201TXOACM, 2201TXOAHD, 2201TXSTPH, 2301TXOAHD, 2301TXOACM, 2301TXOASS, 2301TXOANS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS, 2501TXOASS, 2501TXOAHD, 2501TXOACM, 2501TXOANS April 1, 2021 – September 30, 2025, October 1, 2021 – September 30, 2024, January 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 TANF 2401TXTANF and 2501TXTANF October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2025 Social Services Block Grant 2301TXSOSR, 2401TXSOSR, 2501TXSOSR October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Block Grants for Community Mental Health Services 1B09SM085913, 1B09SM085385, 1B09SM087345, 1B09SM087322, 1B09SM089380, 1B09SM089610, 1B09SM089984 September 1, 2021 – March 24, 2025, October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, September 30, 2023 – September 29, 2025, October 1, 2023 – September 30, 2025, September 30, 2024 – September 29, 2026 Block Grants for Prevention and Treatment of Substance Abuse 1B08TI083969, 1B08TI084609, 1B08TI085835, 1B08TI087067, 1B08TI088134 September 1, 2021 – March 24, 2025, September 1, 2021 – March 24, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Nonmajor programs Opioid STR 6H79TI083288, 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. As of March 8, 2025, fsrs.gov was retired, and all subaward reporting data and functionality are now on SAM.gov. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards on FSRS.gov or SAM.gov. A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligation at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS.gov or SAM.gov. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2024-005, 2023-010, 2022-013, 2021-007 Views of responsible officials: HHSC concurs with the recommendation.

Special Provisions- Fraud Detection and Repayment Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Cluster (CCDF) ALN: 93.489, 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXCDC6, 2201TXCCDD, 2201TXCCDF, 2301TXCCDF, 2301TXCCDD, 2501TXCCDF, 2401TXCCDM, 2401TXCCDF, 2401TXCCDD, 2501TXCCDD, 2501TXCCDM, 2501TXCCDY October 1, 2020 – September 30, 2024, October 1, 2021 – September 30, 2024, October 1, 2022 – September 30, 2025, October 1, 2023 – September 30, 2025, October 1, 2023 – September 30, 2026, October 1, 2024 – September 30, 2026, October 1, 2024 – September 30, 2027, and December 21, 2024 – September 30, 2028. Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Workforce Commission (TWC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §98.60(i), Lead Agencies shall recover childcare payments that are the result of fraud. These payments shall be recovered from the party responsible for committing fraud. In order to identify and recover payments, pursuant to TWC’s Childcare Services Guide (November 2024), section G.600: Recovery of Improper Payments, Local Workforce Development Boards (Boards) must attempt recovery of all improper payments. TWC must not pay for improper payments. Board recovery of improper payments must be managed in accordance with TWC policies and procedures. Condition: According to the TWC Division of Fraud Deterrence and Compliance Monitoring’s Standard Operating Procedures for Workforce Board PIRTS Audits, when a Workforce Development Board identifies an improper payment, the Board is required to issue a Notice of Determination informing the participant of their ineligibility, the amount and time period of the improper payment, and the reason for the determination. If the improper payment results from fraud, the Board must issue a first collection letter within 30 days of sending the determination notice to initiate recoupment of the ineligible amount. If repayment is not received or an active payment plan is not established, the Board must issue a final collection letter and refer the participant to TWC for a warrant hold, which restricts the individual from receiving future services until the outstanding amount is recovered. All correspondence is to be documented and maintained in the Program Integrity Reporting Tracking System (PIRTS), the system used by Boards to report and track childcare fact‑finding, fraud determinations, and recoupment activities. As part of our audit procedures, we tested 40 of the 297 closed cases reported to TWC in fiscal year 2025 to verify that TWC followed its procedures related to authenticating that a payment was fraudulent and subsequently recovered payment, if applicable. Of the 40 cases tested, 12 cases did not follow the prescribed procedures and lacked evidence that the Workforce Boards issued the required 1st collection letter within the 30‑day timeframe. Questioned costs: None. Context: See “Condition.” Cause: The exceptions identified occurred because TWC did not provide adequate oversight or monitoring of Workforce Board compliance with established PIRTS procedures. Without routine monitoring, follow‑up, or enforcement mechanisms to ensure Boards issued collection letters within required timeframes, lapses in adherence to the 30‑day requirement went undetected. This lack of oversight contributed to inconsistent application of required fraud‑recovery processes across Boards. Effect: Failure to ensure that Workforce Development Boards issued required first collection letters within the prescribed 30‑day timeframe impeded timely initiation of recoupment efforts for fraudulent childcare payments. This condition increases the risk that improper payments resulting from fraud may not be recovered in a timely manner and that individuals with outstanding fraudulent overpayments may continue to seek or receive services. Repeat Finding: No Recommendation: TWC should strengthen its oversight of Workforce Board compliance with PIRTS requirements by implementing routine monitoring procedures to verify that Boards issue first collection letters within the required 30‑day timeframe. This may include periodic reviews of PIRTS documentation, automated tracking or alerts for timeliness, and follow‑up with Boards when deadlines are missed. Additionally, TWC should provide guidance or refresher training to reinforce expectations and ensure consistent application of improper payment recovery procedures across all Boards. Strengthening these oversight mechanisms will help reduce the risk of delayed collection efforts and improve adherence to established fraud‑deterrence processes. Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding and concurs with the recommendation. TWC’s Division of Fraud Deterrence and Compliance Monitoring’s Office of Investigations (FDCM/OI) oversees all matters related to fraud, waste, and abuse with respect to Federal programs TWC passes to its subrecipients, primarily the 28 local workforce development boards (Board). This includes the subsidized childcare program provided for in the above-cited Federal awards. FDCM/OI has historically maintained rigorous internal controls to address fraud in all programs. Additionally, TWC’s Subrecipient Monitoring Department (SRM) tests Board compliance with respect to childcare improper payment reporting and recoupment. TWC currently conducts routine monitoring and follow-up to ensure Boards issue collections letters in a timely fashion. That being said, TWC does agree that our objectives would be better served with more robust measures. Currently, FDCM/OI investigators review a sample of PIRTS reports on a monthly basis to ensure that Boards are uploading all required documentation related to childcare improper payments and undertaking collection efforts. Investigators review two randomly selected cases for each Board per month on a rolling basis for the prior three months. FDCM/OI also conducts periodic PIRTS training and retraining with Board staff. Additionally, the PIRTS system sends automated reminder notifications for Board staff to issue collection letters. FDCM/OI realizes the importance of issuing collection letters in a timely matter. Doing so not only increases the likelihood that important child care funds are remitted, but also assists with additional enforcement activities including prosecution of substantiated fraud. FDCM/OI takes the integrity of child care funds very seriously and will aid prosecution where appropriate.

Special Tests and Provisions – ADP Risk Analysis and System Security Review Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster CFDA Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2405TXIMPL, 2405TX5000, 2505TXPACT, 2505TX5000, 2405TX5001, 2505TX5021, 2505TX5MAP, 2505TX5ADM October 1, 2023 – September 30, 2024, October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2024, October 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – December 31, 2024, October 1, 2024 – December 31, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §95.621, State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. Condition: HHSC maintains a total of 35 in-house and third-party systems that are used in the administration of Medicaid, which are required to be reviewed each biennial period. During the fiscal year 2024-2025 biennial, only 15 risk assessments were executed based on internal methodology or third-party assessments. HHSC did not perform risk assessments over the remaining 20 systems during the two-year period. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to it’s current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2024-012, 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the recommendation.

Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2405TXIMPL, 2405TX5000, 2505TXPACT, 2505TX5000, 2405TX5001, 2505TX5021, 2505TX5MAP, 2505TX5ADM October 1, 2023 – September 30, 2024, October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2024, October 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – December 31, 2024, October 1, 2024 – December 31, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HHSC policies require the completion of Form 2567 Statement of Deficiencies and Plan of Correction to include the prefix tag, the deficiency that contains the code of federal regulations (CFR) or life safety code (LSC) reference for each health and safety survey conducted. HHSC is required to mail a copy of the completed form to the provider within ten business days after the exit date of the survey to ensure any deficiencies noted are addressed timely. For one of 40 health surveys conducted during the fiscal year, Form 2567 was mailed out to the provider 162 business days after the exit date of the survey. While the form was mailed after the required timeline per HHSC policy, it did not include any cited deficiencies. Questioned costs: None. Context: See “Condition.” Cause: After the provider's exit date, HHSC regional staff subsequently determined, several months later, that the required notice had not been issued to the facility. This oversight occurred during a period of transition within the ICF team. Effect: Failure to notify a provider of identified deficiencies in a timely manner may prevent the provider from implementing corrective actions within the required timeframe to meet compliance deadlines. Such delays increase the risk of continued noncompliance and may result in inappropriate payments for new admissions before the provider agreement is terminated. Repeat Finding: No. Recommendation: HHSC should enhance and/or reinforce existing internal controls to ensure timely completion and mailing of Form 2567 to meet standards in 42 CFR Part 442 and related policy requirements. This could include developing automated tracking systems or checklists to monitor survey deadlines and/or providing refresher training for all regional staff involved in the survey and notification process. Views of responsible officials: HHSC concurs with the recommendation.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Equipment and Real Property Management, Matching, Level of Effort and Earmarking, Period of Performance, Procurement and Suspension and Debarment, Reporting, Subrecipient Monitoring, Special Tests and Provisions – Information Technology – User Access Federal Agency: U.S. Department of Agriculture (USDA) U.S. Department of Education (USDE) U.S. Department of Health and Human Services Social Security Administration Federal Program Title: SNAP Cluster Special Education Grants for Infants and Families Temporary Assistance for Needy Families Social Services Block Grant Block Grants Community Mental Health Services Block Grants for Prevention and Treatment of Substance Abuse Aging Cluster Medicaid Cluster Disability Insurance/ SSI Cluster ALN: 10.551, 10.561 84.181 93.558 93.667 93.958 93.959 93.044, 93.045, 93.053 93.775, 93.777, 93.778 96.001, 96.006 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SNAP Cluster 6TX400105, 6TX400106, USDA-FNS-SNAP-24-EVS-TX October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025, September 25, 2024 - September 30, 2025 Special Education Grants for Infants and Families H181A220171, H181A230171, H181A240171, H181A250171 July 1, 2022 - September 30, 2023, July 1, 2023 - September 30, 2024, July 1, 2024 - September 30, 2025, July 1, 2025 - September 30, 2025 Temporary Assistance for Needy Families 1601TXTANF, 1801TXTANF, 2101TXTANF, 2201TXTANF, 2301TXTANF, 2401TXTANF, 2501TXTANF October 1, 2015 - September 30, 2016, October 1, 2017 - September 30, 2018, October 1, 2020 - September 30, 2022, October 1, 2021 – September 30, 2022, October 1, 2022 - September 30, 2023, October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025 Social Services Block Grant 2301TXSOSR, 2401TXSOSR, 2501TXSOSR October 1, 2022 - September 30, 2024, October 1, 2023 - September 30, 2025, October 1, 2025 - September 30, 2026 Block Grants Community Mental Health Services B09SM089610, B09SM087322, B09SM087345, B09SM085385, B09SM089380, B09SM089984, B09SM085913 October 1, 2023 - September 30, 2025, October 17, 2022 - October 16, 2024, October 1, 2022 - September 30, 2024, September 1, 2021 - March 24, 2025, September 30, 2023 - September 29, 2025, September 30, 2024 - September 29, 2026, September 1, 2021 - March 24, 2025 Block Grants For Prevention and Treatment of Substance Abuse B08TI087067, B08TI085835, B08TI084609, B08TI088134, B08TI083969 October 1, 2023 - September 30, 2025, October 1, 2022 - September 30, 2024, September 1, 2021 - March 24, 2025, October 1, 2024 - September 30, 2026, September 1, 2021 - March 24, 2025 Aging Cluster 2101TXSSC6, 2101TXCMC6, 2101TXHDC6, 2201TXOASS, 2201TXOANS, 2201TXOACM, 2201TXOAHD, 2201TXSTPH, 2301TXOAHD, 2301TXOACM, 2301TXOASS, 2301TXOANS, 2401TXOASS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2501TXOASS, 2501TXOAHD, 2501TXOAHD, 2501TXOANS April 1, 2021 - September 30, 2025, October 1, 2021 - September 30, 2024, January 1, 2022 - September 30, 2024, October 1, 2022 – September 30, 2025, October 1, 2023 - September 30, 2025, October 1, 2024 - September 30, 2026 Medicaid Cluster 2405TXIMPL, 2405TX5000, 2505TXPACT, 2505TX5000, 2405TX5021, 2505TX5MAP, 2505TX5ADM October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2024, October 1, 2024 - September 30, 2024, October 1, 2024 – September 30, 2025, October 1, 2023 - September 30, 2025, October 1, 2024 - December 31, 2024 Disability Insurance/ SSI Cluster 2304TXDI00, 2404TXDI00, 2504TXDI00 October 1, 2023 - February 2, 2024, October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of user access within the CAPPS FIN (PeopleSoft Financials) system, we identified two user accounts, out of 17 tested, that had been granted inappropriate access to the PeopleSoft Administrator role. This role provides elevated privileges beyond those required for their job duties and should be limited to authorized system administrators. Management remediated the inappropriate access on November 10, 2025. Questioned costs: None. Context: See “Condition.” Cause: The inappropriate access assignments appear to result from gaps in privileged access provisioning and periodic re‑certification controls within the CAPPS FIN environment. Effect: Improper assignment of elevated PeopleSoft Administrator access in CAPPS FIN increases the risk of: • Unauthorized changes to system configuration, accounting rules, or financial data; • Data modification or exposure, including information related to federal program expenditures; • Bypassing of compensating controls intended to maintain data integrity and separation of duties; Although management removed access on 11/10/2025, the presence of improper administrator‑level access before remediation represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend HHSC: • Strengthen privileged access provisioning by requiring documented approval, business justification, and periodic revalidation for all elevated roles in CAPPS FIN. • Implement a formal, recurring privileged access review across all CAPPS FIN modules, with documented results and timely remediation of exceptions. • Utilize identity governance tools or CAPPS FIN security reporting to automatically flag unauthorized assignments of administrator roles. Views of responsible officials: HHSC concurs with the recommendation.

Assistance Listing, Federal Agency, and Program Name - 93.088, U.S. Department of Health and Human Services, Advancing System Improvements for Key Issues in Women's Health 93.323, U.S. Department of Health and Human Services, Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) 93.592, U.S. Department of Health and Human Services, Family Violence Prevention and Services/Discretionary and COVID - 19 Family Violence Prevention and Services/Discretionary 93.837, U.S. Department of Health and Human Services, Cardiovascular Disease Research (Research and Development Cluster) Federal Award Identification Number and Year - 93.088 ASTWH220110 (2023 and 2024) 93.323 - 32680012K (2024) 93.592 - 90EV0516 (2021); 90EV0530 (2023); ; 90EV0544 (2024) 93.837 - U01HL146245 (2024) Pass through Entity - 93.088 N/A 93.323 - Illinois Department of Public Health 93.592 - N/A 93.837 - N/A Finding Type - Material weakness and material noncompliance with laws and regulations Repeat Finding - Yes 2024-001 Criteria - Per 2 CFR 200.303(a), nonfederal entities must establish and maintain effective internal controls over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States, or the Internal Control Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.318(a), the nonfederal entity must have and use documented procedures, consistent with state, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or services required under a federal award or subaward. The nonfederal entity's documented procurement procedures must conform to the procurement standards identified in §§200.317 through 200.327. The LLC has established in its internal procurement policies and procedures that a minimum of 3 quotes must be obtained for purchases made under informal, simplified acquisition procedures. Per 2 CFR 200.318(i), the nonfederal entity must maintain records sufficient to detail the history of procurement. These records will include, but are not necessarily limited to, the following: rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. Condition - Controls were not sufficient to ensure that the history of procurement decisions was documented, as required by 2 CFR 200. Additionally, controls were not sufficient to ensure checks for suspension and debarment were documented before entering into covered transactions with third parties. Questioned Costs - unknown If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported We are unable to predictably quantify, had federal procurement standards been followed, which portion of activity presented on the SEFA under these contracts would be in question. Identification of How Questioned Costs Were Computed N/A Context - 93.088 - Management was unable to provide evidence that three out of three contractors tested was checked for suspension and debarment in advance of entering into a covered transaction. 93.323 - Management was unable to provide evidence that three out of three contractors tested was checked for suspension and debarment in advance of entering into a covered transaction. 93.592 - Management was unable to provide evidence that four out of four contractors tested was checked for suspension and debarment in advance of entering into a covered transaction. 93.837 - Of the four contracts tested, management was unable to produce records sufficient to detail the history of procurement for one contract. Additionally, for that same contractor, management was unable to provide evidence that the third party was checked for suspension and debarment in advance of entering into a covered transaction. Because we were able to confirm via a check of the Excluded Parties Listing that the contractors noted above were not suspended or debarred, no questioned costs related to this noncompliance were identified. Cause and Effect - Newly revised procurement policies and procedures implemented during the last month of the fiscal period under audit were not in place during the time of the contract acquisitions noted above, and therefore a lack of internally established procurement documentation practices resulted in material noncompliance with federal procurement standards. Recommendation - We recommend that management continue to follow and formalize its procurement policies and procedures to demonstrate how the LLC will achieve compliance with federal procurement standards identified in §§200.317 through 200.327. Additionally, we recommend management retain documented evidence that its policies and procedures were followed to ensure compliance with federal procurement standards. Views of Responsible Officials and Corrective Action Plan - Management will continue to strengthen internal controls through the revised Procurement Policy, enhanced documentation requirements, and clarified approval procedures. A centralized tracking database has been implemented to document sanctions, suspension, and debarment checks, as well as other required verifications based on the nature of each purchase or service. These procedures are required prior to entering into covered transactions and are monitored through dual staff reviews. Management believes that ongoing monitoring and consistent enforcement of these procedures will ensure compliance and prevent recurrence.

Assistance Listing, Federal Agency, and Program Name - 93.837, U.S. Department of Health and Human Services, Cardiovascular Disease Research (Research and Development Cluster) Federal Award Identification Number and Year - 93.837 - U01HL146245 (2024) Pass through Entity - N/A Finding Type - Material weakness and material noncompliance with laws and regulations Repeat Finding - No Criteria - Per 2 CFR 200.303(a), nonfederal entities must establish and maintain effective internal controls over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States, or the Internal Control Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.305(b)(3), when the reimbursement method is used, the Federal agency or pass through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass through entity reasonably believes the request to be improper. Condition - Controls in place were not sufficient to ensure subrecipients were paid consistently within 30 days of a request for reimbursement. Questioned Costs - N/A If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported - N/A Identification of How Questioned Costs Were Computed - N/A Context - Out of a sample of 29 subrecipient disbursements tested, we noted 6 were not paid within 30 days of the LLC receiving the request for reimbursement. Cause and Effect - A lack of effective internal controls resulted in material noncompliance with this requirement. Recommendation - We recommend management establish robust controls over subrecipient activity to ensure the 30 day requirement is met. Views of Responsible Officials and Planned Corrective Actions - Management acknowledges the finding. Delays in approvals may occur due to multiple internal and external parties involved. To prevent recurrence, management will monitor all parties, issue email reminders with clear deadlines, and enforce timely processing to ensure compliance with the 30 day requirement.

Finding No. 2025-001 Special Tests and Provisions – NSLDS Reporting U.S. Department of Education: Student Financial Assistance Cluster: Federal Pell Grant (ALN 84.063) Federal Grant Number: P063P241851 Statistically Valid Sample: No and it was intended to be. Prior Year Finding: Not a repeat finding. Finding Type: Significant Deficiency and Noncompliance Criteria: Institutions are required to report enrollment information under the Pell Grant and the Direct Loan programs via the National Student Loan Data System (NSLDS) (OMB No. 1845-0035). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and certify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. Institutions are responsible for accurately reporting all Campus-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number, Enrollment Effective Date, Enrollment Status, Certification Date Institutions are responsible for accurately reporting all Program-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number, CIP Code, CIP Year, Credential Level, Published Program Length Measurement, Published Program Length, Program Begin Date, Program Enrollment Effective Date Institutions are responsible for timely reporting, whether they report directly or via a third-party servicer. Institutions must complete and return within 15 days the Enrollment Reporting roster file placed in their Student Aid Internet Gateway (SAIG) (OMB No. 1845-0002) mailboxes sent by ED via NSLDS. An institution determines how often it receives the Enrollment Reporting roster file with the default set at a minimum of every 60 days. Once received, the institution must update for changes in the data elements for the Campus Record and the Program Record identified above, and submit the changes electronically through the batch method, spreadsheet submittal, or the NSLDS website (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309: Perkins 34 CFR 674.19(f)). Additionally, in accordance with 2 CFR 200.303, the University shall maintain internal controls over federal programs designed to provide reasonable assurance that transactions are executed in compliance with federal statutes, regulations, and the terms and conditions of the federal award that could have a direct and material effect on a federal program. Condition and Context: The University utilizes the National Student Clearinghouse (the Clearinghouse) as a service provider for transmission of its enrollment reporting changes including, but not limited to withdrawals and graduate status to the NSLDS. The University receives the Enrollment Reporting Roster and makes necessary updates for changes in student status. A final file is then sent to the Clearinghouse who transmits information or corrections to NSLDS. For 1 student in our sample of 40, the effective status of graduation was not accurately reported to NSLDS within 60 days of the status change. The status change was submitted and certified by NSLDS 228 days late. This student received an error code of 253 or 290, which represents an error in the student’s social security number (SSN). Upon further review, the University identified 10 other students that had this same error code during fiscal year 2025. One of these students had a status change which was not reported to NSLDS timely, and it was submitted and certified by NSLDS 494 days late. Cause: This error was caused by an incorrect assumption in the Registrar’s procedures that students who returned this error from the Clearinghouse were non-Title IV aid students. While the Registrar worked to rectify these errors with the Clearinghouse, the Registrar’s Office did not update the student’s status in NSLDS independently because management believed these students did not receive Title IV aid. Effect: Student status changes not reported in a timely or accurate manner may cause the student to not enter repayment status for Federal Direct Student Loans on a timely basis. A change in status for a student receiving a Pell Grant will impact the amount they are eligible to receive Question Costs: None. Recommendation: We recommend that management incorporate procedures in their process to review the error reports received from the Clearinghouse specifically for this error code, which should include the determination of whether these students had received Title IV aid. View of Responsible Officials: Management agrees with the finding. Students on the reject detail from the Clearinghouse enrollment submission who receive a 253 or 290 error will be reviewed using a Financial Aid provided report to determine if any have been awarded aid. Financial Aid will provide the FAFSA support to correct the Clearinghouse error for students who have received aid. We will also manually report those student statuses to the NSLDS while the errors are being corrected by the Clearinghouse for anyone receiving aid so status changes are reported timely. For students that do not have FAFSA information with Financial Aid, we will contact those students directly for documentation to correct or affirm their SSN information to try and resolve any future 253 or 290 errors.

Reference Number: 2025-004 No secondary review of meal claim reimbursements prior to submission Child Nutrition Cluster ALN’s: 10.553, 10.555, and 10.582 Pass through identifying number: NT4XL1YGLGC5 Award Year: 2024-2025 Federal Agency: U.S. Department of Agriculture Passed through State Department of Agriculture Criteria: 2 CFR §200.303 requires non-Federal entities to establish and maintain effective internal control over Federal awards that provides reasonable assurance that the entity is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. Program regulations for the Child Nutrition Cluster require reimbursement claims to be accurate and supported by appropriate documentation prior to submission. Effective internal controls over reporting include supervisory review of reimbursement claims to ensure accuracy and completeness before submission. Condition Found: During testing of reimbursement claims submitted under the Child Nutrition Cluster, we noted the School District did not perform a documented secondary review of monthly meal reimbursement claims prior to submission to the pass-through agency. Claims were prepared and submitted by the same individual without evidence of supervisory review or approval. Cause: Management indicated the control requiring a second review was informal and not consistently performed due to staffing limitations and turnover within the food service department. Additionally, the control was not formally documented in written procedures. Effect: Without a secondary review, there is an increased risk that reimbursement claims may contain errors, including inaccurate meal counts or calculation errors, which could result in over- or underreimbursement and potential noncompliance with Federal reporting requirements. Questioned Cost: $0. The District’s claims tested were mathematically accurate and supported, however, the control was not properly documented. Recommendation: We recommend the District implement and document a formal secondary review control over all Child Nutrition reimbursement claims prior to submission. Views of Responsible Officials: Management agrees with the findings. See corrective action plan

C. Findings and Questioned Costs – Major Federal Award Program Audit 2025-001: Significant Deficiency in Internal Control over Activities Allowed or Unallowed and Allowable Costs/Cost Principles Federal Agency: U.S. Department of Education Assistance Listing Number: 84.287 Federal Program Name: Twenty-First Century Community Learning Centers Pass-through Entity: Office of Superintendent of Public Instruction Pass-through Award Number: S287C240048, S287C230048 Criteria: Under 2 CFR 200.303(a), the non-federal entity must establish and maintain effective internal control over compliance with the requirements of federal awards. Additionally, in accordance with 2 CFR 200.403, costs must “be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles” and “be adequately documented.” Condition: In our testing of compliance with the requirements for activities allowed or unallowed and allowable costs/cost principles, we identified one exception where estimated costs were charged to the major program for allowable programmatic activities; however, this estimate included costs that were not ultimately incurred by Washington Alliance for Better Schools (WABS). Cause: Internal controls over the review and reconciliation of actual costs incurred by WABS and amounts charged to the major program did not detect certain unallowable costs. Effect: Reimbursements in excess of actual costs incurred were requested through the major program. Questioned Costs: Known questioned costs arising from this finding total $30,102. Context: No similar estimated costs were charged to the major program, nor were any other unallowable costs identified in our testing of a statistically valid sample of forty payroll and general cash disbursement transactions. As such, we believe this finding represents an isolated incidence and not a systemic problem. Management is currently proceeding with corrective action at the pass-through agency’s direction and has adjusted the reported amounts in the financial statements and schedule of expenditures of federal awards accordingly. Repeat Finding: This is not a repeat finding. Recommendation: We recommend that management performs a periodic reconciliation of expenditures charged to federal awards to actual costs incurred. Views of Responsible Officials: There is no disagreement with the finding.

Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Numbers: 84.063 and 84.268 Federal Award Identification Number and Year: P268K241902, P268K251902, P063P231902, P063P241902, grants were awarded within the 2023-24 and 2024-25 award years. Award Period: September 1, 2024, through August 31, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance and Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309(b) states that: 1) Schools must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless if they receive aid from the institution or not. 2.) Schools must have some arrangements to report student program enrollment effective date and status to NSLDS. The Code of Federal Regulations, 2 CFR 200.303, non-Federal entities receiving Federal awards are required to establish and maintain internal controls designed to ensure compliance with federal laws, regulations and program compliance requirements. Condition and Context: During our testing of NSLDS Enrollment Reporting, we noted that 1.) the incorrect enrollment effective date was reported to NSLDS for one out of the 40 students tested 2.) the incorrect program enrollment effective date was reported to NSLDS for two out of the 40 students tested 3.) the incorrect enrollment status was reported to NSLDS for one out of 40 students tested. Questioned Costs: N/A Cause: The College policies and procedures did not ensure that the enrollment effective dates were accurately reported to NSLDS. Effect: 1) The enrollment effective date reported to NSLDS is used to determine when the student’s grace period should begin. By not reporting a correct effective date, the grace period begin date for the student will be incorrect. 2) The program enrollment effective date reported to NSLDS is used to determine the student’s 150% limit for direct loans as well as when grace period should begin. By not reporting the correct status, the calculation of the 150% would be incorrect and the grace period begin date would be incorrect. Repeat Finding: Yes – 2024-002. Recommendation: The College should evaluate their procedures and review policies surrounding reporting enrollment effective dates and program enrollment effective dates NSLDS. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.

SECTION III – FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS Repeat Finding: No Program Name and Assistance Listing Number: Federal Pell Grant Program – 84.063 Federal Agency: U.S. Department of Education Pass-through Entities: N/A Questioned Costs: N/A FINDING: 2025:001: Noncompliance with NSLDS Enrollment Reporting Requirements Criteria The OMB Compliance Supplement for the Student Financial Assistance Cluster requires that institutions… “accurately notify ED of changes in student enrollment information at the Campus Level and Program Level.” Additionally, Federal Regulation 2 CFR §200.303(a) requires that the Organization… “must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition The Organization did not register for or establish participation in the National Student Loan Data System (NSLDS) during the fiscal year and, as a result, did not implement procedures or controls to report changes in student enrollment information at the Campus Level and Program Level as required. Cause The Organization did not establish policies and procedures to ensure compliance with NSLDS enrollment reporting requirements, as this was the first year of the program and management was not aware that such reporting was required in the absence of Direct Loan activity. Effect The Organization was not in compliance with NSLDS enrollment reporting requirements, which may limit the Department of Education’s ability to monitor student enrollment status and oversee Title IV program activity. Recommendation To address the issue of noncompliance with NSLDS enrollment reporting requirements, the Organization should register with the National Student Loan Data System (NSLDS) and implement policies and procedures to ensure compliance with enrollment reporting requirements, including assigning responsibility for monitoring compliance and maintaining documentation of such reporting. This was fixed after year end. Views of Responsible Officials Management agreed with the assessment and subsequent to year end, steps were taken to correct the matter.

Condition: During testing of 91 Low-Income Home Energy Assistance Program (LIHEAP) participant files, we identified 11 files for which internal controls over compliance with major program requirements were not operating effectively, as follows: Nine (9) files did not include evidence of management review (i.e., a management signature or initials on the application). One (1) file was missing the utility bill from the hard-copy file maintained at the Agency; however, the Agency had submitted the eligibility documentation in FACSPro. One (1) file was missing income verification for the head of household and a social security card for one household member from the hard-copy file maintained at the Agency; however, the Agency had submitted the eligibility documentation in FACSPro. Criteria: In accordance with 2 CFR 200.303 and LIHEAP program requirements, recipients must establish and maintain effective internal controls to provide reasonable assurance that assistance is awarded only to eligible households. Eligibility determinations must be supported by complete and adequate documentation. The Agency’s policies require that each LIHEAP applicant folder include a hard copy of the documents used to determine eligibility that is maintained at the Agency. In addition, all applications must receive a secondary review by management. This review must be documented by the reviewer’s initials or signature on the application. Cause: The exceptions noted resulted from management not consistently adhering to the Agency’s established policies regarding documentation retention and documented management review of LIHEAP applications. Effect: Failure to consistently document and review LIHEAP applications increases the risk that assistance may be awarded to ineligible households. This could result in questioned costs and noncompliance with applicable federal requirements. Recommendation: We recommend that management consistently follow Agency policy by ensuring that (1) all LIHEAP applicant files maintained at the Agency are complete and include the documentation used to support eligibility and (2) all applications receive a management review that is clearly documented through reviewer initials or signatures. View of Responsible Officials: See auditee prepared Corrective Action Plan

2025-002 The District did not have adequate internal controls for ensuring compliance with federal eligibility requirements. Assistance Listing Number and Title: 10.553 – School Breakfast Program 10.555 – National School Lunch Program Federal Grantor Name: U.S. Department of Agriculture (USDA) Federal Award/Contract Number: N/A Pass-through Entity Name: Office of the Superintendent of Public Instruction (OSPI) Pass-through Award/Contract Number: 227WAWA3N1199 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Background The District participates in the Child Nutrition Cluster, which includes the School Breakfast Program and National School Lunch Program. These programs provide free and reduced-price meals to students from low-income families. In the 2024-25 school year, the District received $2,078,919 in federal funding to administer these programs. Federal regulations require recipients to establish, document and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls including eligibility requirements. Districts providing free and reduced priced meals to students must verify students’ eligibility for these programs by either obtaining applications at the beginning of each school year or through the direct certification process, which is used for categorically eligible children for free meals without further application. Description of Condition The District did not have adequate internal controls to ensure it only provided free and reduced-price meals to eligible students. We consider this deficiency in internal controls to be a significant deficiency. Cause of Condition The District experienced staffing changes during the audit period and the staff responsible for managing eligibility for the program lacked adequate training over the requirements and were not aware of the requirement to retain all applications to support the free- and reduced-meal status. Effect of Condition Using a statistical sample, we found two out of 29 students tested (6.9%) were not supported by documentation evidencing their eligibility. Without documentation showing the students were eligible for free and reduced-price meals, the District cannot demonstrate compliance with the awarding agency’s eligibility requirements. These errors resulted in the District receiving $1,350 in excess federal funds. Based on the projection of our sample, we identified an additional $108,745 in estimated overpayments for free and reduced meal costs. Recommendation We recommend the District establish and follow internal controls to ensure it complies with federal and OSPI requirements for verifying eligibility for free or reduced-price meals and maintain documentation of this verification process. District’s Response Mandatory Staff Training & Professional Development: • Food Services staff responsible for processing and managing student meal applications using Qmlativ will undergo training provided by ESD113 in August and online OSPI CNEEB Application and Direct Certification Training. • Training will explicitly cover federal regulations under 7 CFR Part 245.6 (Application, Eligibility, and Certification) and 2 CFR Part 200.303 (Internal Controls over federal programs). Implementation of Dual-Review Internal Controls: • The District will establish written protocols for processing online and paper applications. • In collaboration with ESD 113, a report will be developed which will be run monthly reviewing any application that have not been validated for income eligibility or direct certification provided by the state. Auditor’s Remarks We thank the District for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the District’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 7 CFR Part 245, Section 245.6 – Application, eligibility and certification of children for free and reduced price meals and free milk.

Findings and Questioned Costs Relating to Federal Awards: Finding 2025 001 Timeliness of Subrecipient Monitoring Federal Agency: National Science Foundation U.S. Department of Defense U.S. Department of Health and Human Services Program Name: Research and Development (R&D) Cluster ALN #: 12.910/47.041/47.049/93.213/93.286/93.399/93.837/93.838/93.865 Federal Award Numbers: FA8650 21 2 7119 P00014/EEC 2330040 001/CHE 2221346/ 5R01AT010413 04/5U54EB027049 08/5UG1CA242643 06/ 5UH3HL165065 04/5U01HL146240 07 Revised/ 5U01HL146408 06 Revised Federal Award Year: September 1, 2024 – August 31, 2025 Compliance Requirement: Subrecipient Monitoring Criteria According to 2 CFR 200.332(d), a pass through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations and the terms and conditions of the subawards, and that the subaward performance goals are achieved. According to 2 CFR 200.332(d)(3) and 2 CFR 200.521, a pass through entity is required to issue a management decision on federal awards audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure subrecipient single audit reports are reviewed and completed in a timely manner and management decisions are issued within required timeframes. Condition Found The University is required to review the single audit reports received from its subrecipients and issue management decision letters (MDL) within six months of the date of acceptance of the single audit report by the Federal Audit Clearinghouse (FAC). During our testwork over 40 subrecipients, we noted the following: For 3 subrecipients, the University did not issue an MDL in a timely manner. The delay in issuing this MDL was 42 to 167 days beyond the required timeframe. For 11 subrecipients, while the University did review the subrecipient’s single audit report, the review did not occur within the prescribed six month timeframe. The delay in reviewing the subrecipient's single audit reports was 2 to 140 days beyond the required timeframe. Cause The management review controls implemented by the University were not operating at a level of precision to ensure the University completed and documented the monitoring procedures timely primarily due to turnover. The delay occurred during the University’s corrective action period related to a similar finding from the previous year. Possible Asserted Effect Failure to complete and perform reviews of subrecipient single audit reports and issue MDLs in a timely manner may result in subrecipients not administering the federal programs in accordance with laws, regulations, and the grant agreement. Questioned Costs None Repeat Finding A similar finding was reported in the prior year audit as finding 2024 001. Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Recommendation We recommend the University establish procedures to ensure subrecipient single audit report reviews are completed and documented in a timely manner. Views of University Officials The University agrees with this finding. Delays occurred during the corrective action period associated with the prior year findings. The University has implemented additional monitoring and tracking procedures indented to strengthen the timeliness of subrecipient reviews and management decision issuance going forward

Finding 2025 002 Expenditure Charged Outside of the Period of Performance Federal Agency: U.S. Department of Health and Human Services Program Name: Research and Development (R&D) Cluster ALN #: 93.310 Federal Award Numbers: 5U54CA272163 03 Federal Award Year: September 1, 2024 – August 31, 2025 Compliance Requirement: Equipment Criteria According to 2 CFR § 200.1, the period of performance is the time during which the non Federal entity may incur new obligations to carry out the work authorized under the Federal award. For a cost to be allowable, it must be incurred during the approved budget period, as stated in the terms and conditions of the award. During fiscal year 2025, certain grants were terminated resulting in a shorter period of performance than the grant agreement originally stated. 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure that expenditures charged to a federal award were incurred within that award’s specified period of performance. Condition Found During our testing of 25 expenditures totaling $277,862 charged to federal awards with performance period ending dates during the audit period, we identified one expenditure and its related indirect cost charge that were not incurred within the grant's shortened period of performance. That period of performance had been shortened by an early termination notice. Additionally, we noted that controls were not operating effectively to prevent or detect the charging of expenditures to a federal award after the period of performance had concluded. Cause While adjustments were made to the University’s controls to respond to the shortened timeframe related to terminated grants, the control did not operate at a level of precision to identify that the expenditure in question was outside of the termination period. Possible Asserted Effect Charging expenditures outside of the authorized period of performance results in non compliance with federal regulations and the terms of the grant agreement. Questioned Costs $1,994 Repeat Finding A similar finding was not reported in the prior year audit. Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Recommendation We recommend the University review its procedures to ensure that all expenditures are reviewed for allowability and are incurred within the active period of performance before being charged to a federal award. Views of University Officials The University agrees with the finding and will implement corrective actions related to awards subject to shortened periods of performance. The university will continue to assess and strengthen its controls and review procedures to reduce the likelihood of similar occurrences in the future.

Department of Health and Human Services Federal Assistance Listing #93.912 Rural Healthcare Services Programs Activities Allowed or Unallowed and Allowable Costs/Cost Principles Significant Deficiency in Internal Control Over Compliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: For a portion of the year, BHD, LLC calculated their indirect cost rate based on the total grant budget and took an equal amount of that per month instead of calculating the indirect cost rate per direct expenditures for each month. When they started to calculate the indirect cost rate per direct expenditures for each month, they used the wrong cost pool per the budget and award. Cause: BHD, LLC did not have an internal control process in place to ensure the correct amounts of indirect costs were requested based on the direct costs for the same period. Effect: Without an effective internal control process in place, improper costs could be chargedto the program. Questioned Costs: None reported. Context: A nonstatistical sample of 5 out of 10 indirect expenditures were selected for testing. In addition, the indirect expenditures were tested in total for the year. Repeat Finding from Prior Years: Yes Recommendation: We recommend BHD, LLC enhance internal control procedures to ensure the indirect cost rate is applied against the monthly direct costs when requesting program reimbursements. Views of Responsible Officials: Management agrees with the finding.

Department of Health and Human Services Federal Assistance Listing #93.912 Rural Healthcare Services Programs Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance Significant Deficiency in Internal Control Over Compliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: BHD, LLC did not retain documentation of the review and approval of all direct expenditures allocated to the program. Cause: BHD, LLC did not have an adequate internal control process in place to ensure review and approval of all expenditures were documented. Effect: The lack of adequate policies governing the recording of expenditures to the program increases the risk that employees participating in the federal award administration may not be able to detect and correct noncompliance in a timely manner. Questioned Costs: None reported. Context: A nonstatistical sample of 60 direct expenditures were selected for testing. Of these, 6 did not show evidence of proper review and approval prior to being allocated to the federal program. Repeat Finding from Prior Years: No Recommendation: We recommend BHD, LLC enhance internal control procedures to ensure all direct expenditures recorded to the program have documented review and approval. Views of Responsible Officials: Management agrees with the finding.

Finding 2025-001: NSLDS Reporting Federal Program: Student Financial Assistance Cluster U.S. Department of Education: Federal Pell Grant Program – ALN 84.063 Federal Direct Loan Program – ALN 84.268 Statistically valid sample: No and it was not intended to be. Prior year finding: Not a repeat finding Finding Type: Significant Deficiency and Noncompliance Criteria: Institutions are required to report enrollment information under the Pell grant and the Direct loan program via the NSLDS (OMB no, 1845-0035). Institutions must review, update, and certify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page. Enrollment information includes both, “Campus Level” and “Program Level” record types, both of which need to be reported accurately. Institutions are responsible for timely reporting, whether they report directly or via a third-party servicer; roster files must be completed and returned within 15 days or receipt. (Pell, 34 CFR 690.83(b)(2); Direct Loan 34 CFR 685.309) In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure enrollment information is reported accurately, at both the Campus Level and Program Level. Condition and Context: The University submits enrollment information to the NSLDS, through the National Student Clearinghouse (NSC), several times throughout the year. While the University submitted the enrollment information timely, there were certain students whereby the Campus Level record did not match the Program Level record. We selected a sample of forty students who received a Federal Direct Loan or a Pell Grant and whose enrollment status changed during the year and noted the following exceptions: - For nine students, the effective date of the student withdrawal at the Campus Level record did not match the effective date at the Program Level record. We noted that the nine students with discrepancies were students who withdrew during the semester, not students who graduated. There were a total of 80 students who withdrew during the fiscal year. Cause: The University uses the National Student Clearinghouse (NSC) to process enrollment status changes in NSLDS. For the students where the effective dates were not accurately reported at both the Campus Level and the Program Level, there was a processing error during the submission to the NSC which was not timely identified by the University. While management had a control in place to ensure accurate enrollment information was submitted on a timely basis, the control did not include a post-submission review to ensure the Campus Level record and Program Level record matched. Effect: The effective dates of withdrawal for certain students who withdrew during the semester did not match between the Campus Level record and Program Level record. This inaccuracy could impact the student repayment status. However, this discrepancy did not have an impact on the timeliness of the selected student entering repayment on their loans. Questioned Costs: There were no questioned costs related to this finding. Recommendation: We recommend that the University strengthen its policies and procedures to ensure that student enrollment changes are accurately reported to NSLDS between Campus Level and Program Level records. The University should enhance their post-submission review to include a periodic review of the accuracy of the student status change reporting. View of Responsible Officials: Management agrees with the finding. Management performed a review of all students reported to the NSLDS for the fiscal year. Management identified a total of 61 students who withdrew, out of a total population of 80 students who withdrew during the fiscal year, where the effective date of the withdrawal did not match the Campus Level record and Program Level record. The University understands the importance of accurate and timely reporting of enrollment status and has corrected the student Campus Level and Program Level records in the NSLDS system for all 61 students. In addition, management instituted a control whereby they will periodically perform a post-submission review of the data submitted to the NSLDS and correct any discrepancies prior to the end of the fiscal year. This review will be documented by the student Financial Services office and then reviewed by the Controller or Chief Financial Officer.

Criteria or specific requirement: Per 2 CFR 200.303, requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures in place to ensure the required certifications for covered contracts and subawards are received, documented, and contracts are not made with a debarred or suspended party. Condition: During our testing of three covered transactions, we noted one vendor did not have proper supporting documentation for suspension and debarment procedures for vendors. Questioned costs: None. Context: One covered transaction tested did not have proper supporting documentation for suspension and debarment procedures. Cause: Lack of sufficient controls in place to ensure that suspension and debarment checks were performed prior to entering into contracts. Effect: Failure to obtain the required certifications or perform verification procedures with the SAM could result in the payment of federal funds to vendors that are suspended or debarred from participation in federal assistance programs. Repeat Finding: No Recommendation: We recommend the District obtain certifications from vendors stating their organization is not suspended, debarred, or otherwise excluded from participation in federal assistance programs or document the procedures performed to verify the vendor is not identified as suspended or debarred on SAM.gov. Views of responsible officials: [There is no disagreement with the audit finding.]

Criteria or specific requirement: 2 CFR §200.302(b)(3) and §200.303 require non-Federal entities to maintain effective internal control over Federal awards, including written documentation supporting the review and approval of transactions prior to submission for reimbursement. Condition: During our testing over reimbursement requests, we noted the review and approval was not formally documented before submission of the requests. Questioned costs: None Context: There was no formal documentation for review and approval of reimbursement requests before submission. Cause: The District does not have a formalized process requiring documented evidence of review and approval of reimbursement requests before submission. Effect: Without documented review and approval, the District increases the risk that reimbursement requests may include unallowable, inaccurate, or unsupported costs, resulting in potential noncompliance with Federal requirements. Repeat Finding: No Recommendation: We recommend the District implement a formal process requiring documented evidence of review and approval of all reimbursement requests prior to submission, such as dated sign-offs or electronic approval records, to strengthen internal controls and ensure compliance with Federal requirements. Views of responsible officials: [There is no disagreement with the audit finding.] Action taken in response to finding: The District will provide formal documentation by reviewing and signing the claims for approval of reimbursement requests before submission to the state. Name of the contact person responsible for corrective action: Stacy Rodriguez Director of Finance Planned completion date for corrective action plan: September 2025

Finding 2025-002: Payroll Costs Not Supported by Actual Time and Effort - Material Weakness Federal Agency: Department of Education Federal Program Title: Education Innovation and Research Federal Assistance Listing Number: 84.411 Compliance Requirement: Allowable Costs/Cost Principles Criteria 2 CFR §§ 200.403 and 200.405 require that costs charged to a federal award be adequately documented and allocable to the award. Under 2 CFR § 200.430(i), charges for salaries and wages must be based on records that accurately reflect the work performed, supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Where an employee works on multiple awards or activities, the records must support the distribution of the employee's salary or wages among those activities. Budget estimates alone are not sufficient to support charges to a federal award. Additionally, 2 CFR § 200.303 requires the Organization to establish and maintain effective internal control over federal awards. Condition We tested 60 payroll transactions totaling approximately $589,000 charged to the Education Innovation and Research Program and identified 12 exceptions totaling approximately $6,600. The exceptions were related to payroll costs allocated among multiple funding sources that were not supported by documentation accurately reflecting actual time and effort performed. Specifically, the Organization allocated payroll costs using methodologies that were not supported by after-the-fact records demonstrating the actual work performed, as required by federal regulations. Context Payroll costs charged to the program were approximately $589,000, or 60% of total federal expenditures of $981,559. Exceptions were identified in 12 of 60 payroll transactions tested, with known questioned costs of approximately $6,600. Cause Management did not establish, implement, and maintain an effective system of internal control over payroll expenditures charged to federal awards. Specifically, management did not ensure that payroll allocation methodologies were adequately documented, consistently reviewed, or verified against actual work performed. Supervisory review procedures designed to validate payroll distributions and supporting documentation were either not established or were not performed consistently throughout the audit period. In addition, periodic reconciliations between payroll records, general ledger activity, and amounts charged to federal programs were not performed in a timely manner. Management also did not implement sufficient monitoring activities to identify, investigate, and correct payroll allocation errors before costs were charged to federal awards. As a result, control deficiencies were not detected or corrected timely, increasing the risk that unallowable, unsupported, or inaccurately allocated payroll costs would be charged to federal programs. Effect As a result of the control deficiencies, payroll costs charged to the federal program could not be relied upon to be accurate, allowable, or adequately supported. The deficiencies resulted in material noncompliance with federal requirements governing allowable costs and cost principles. Questioned costs Known questioned costs of $6,600 were identified through audit testing. Identification of a repeat finding This is not a repeat finding. Recommendation The Organization should establish and implement formal policies and procedures governing payroll costs charged to federal awards. The procedures should identify the required supporting documentation, payroll allocation methodologies, review and approval responsibilities, reconciliation requirements, and monitoring activities necessary to ensure compliance with federal requirements. Management should require periodic supervisory review of payroll distributions and reconciliations between payroll records and amounts charged to federal programs. In addition, management should promptly investigate and correct identified discrepancies and provide ongoing training to personnel responsible for payroll processing and grant administration to ensure payroll costs charged to federal awards are accurate, allowable, and adequately supported. Views of responsible officials Management agrees with the finding and acknowledges that improvements are needed in the design and operation of internal controls over payroll costs charged to federal awards. The Organization will establish formal written procedures for payroll allocations, documentation requirements, supervisory review, reconciliation processes, and compliance monitoring activities. Management will assign responsibility for reviewing payroll costs charged to federal programs and performing periodic reconciliations between payroll records, accounting records, and federal reimbursement requests. The Organization will also provide training to personnel responsible for payroll processing and grant administration to strengthen understanding of Uniform Guidance requirements.

Criteria Under 34 CFR 668.162(b)(1) and (b)(3), an institution participating in the Title IV programs under the advance payment method may request only the amount of federal funds needed for immediate disbursement to eligible students and parents, and must disburse those funds as soon as administratively feasible, but no later than three business days after receipt. Additionally, under 34 CFR 668.24(b)(2)(i)-(ii) and 668.24(d)(1), institutions are required to establish and maintain financial records, including general ledger control accounts and related subsidiary accounts, that accurately reflect each Title IV transaction and are systematically organized to support compliance and examination. Finally, pursuant to 2 CFR 200.303, institutions must establish, document, and maintain effective internal controls over federal awards to provide reasonable assurance of compliance with applicable federal statutes, regulations, and award terms, including monitoring compliance and taking prompt corrective action when instances of noncompliance are identified. Condition The University does not maintain sufficient supporting documentation to directly reconcile G5 drawdowns to specific Title IV student-level disbursements. Although reconciliations are performed on an overall basis, they do not provide sufficient detail to establish a direct correlation between individual student disbursements and related drawdowns. Therefore, the three-business day requirement could not be tested. Cause The condition resulted from internal controls over Title IV cash management that were not fully defined or implemented following the recent ERP transition to Ellucian Banner. Specifically, the University lacks a system-generated report that provides student-level disbursement detail segregated by Title IV program (e.g. Pell Grant, FSEOG, Direct Loans) needed to reconcile disbursement activity on a per-student basis to the G5 drawdown activity. During the transition, the University relied on manual, undocumented procedures and unreconciled reports to request funds. Effect The absence of detailed reconciliation documentation limits the University’s ability to clearly demonstrate compliance with federal Cash Management requirements under 34 CFR Part 668 Subpart K - Cash Management. This condition increases the risk that cash management discrepancies may not be identified on a timely basis. Questioned Costs None. Recommendation We recommend the University formalize and implement a Title IV cash management reconciliation process in accordance with 34 CFR 668.162, 668.166, 668.24, and 2 CFR 200.303. This process should require timely reconciliation of each G5 drawdown to specific Title IV disbursements at the student level, with clearly defined roles, responsibilities, and documentation requirements. The University should enhance system or supplemental reporting to support student-level linkage of drawdowns to disbursements and implement controls to monitor excess cash, including compliance with the three-business-day rule and applicable tolerance thresholds. Additionally, supporting documentation should be retained in an organized manner, and supervisory review, periodic monitoring, and staff training should be established to ensure ongoing compliance. Views of Responsible Officials Refer to Management's unaudited corrective action plan.