Findings Citing § 200.303

Finding Number: 2025-005 Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Pass-through Entity: N/A- Direct Award Federal Agency: U.S. Department of Treasury Federal Award Year: July 1, 2024–June 30, 2025 Compliance Requirement: Subrecipient Monitoring Type of finding: Material weakness and material noncompliance Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have effective controls in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated and level of monitoring is determined. • Verification and review that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. • All required elements of the subrecipient contracts are included during execution. Cause The City’s lack of effective internal controls which caused the following noncompliance and control exceptions.Proper perspective During the audit, we noted that six of the nine subrecipient selections did not contain all the required elements of the contract. Additionally, for nine of the nine selections, the City did not complete a risk assessment or conclude on the subrecipient's risk of noncompliance. We also noted that for two of the subrecipients that required a single audit, there was no evidence to support the nature and extent of the City's review of those audit reports. Therefore, we were unable to determine, based on the subrecipient's risk assessment and single audit reports, the proper level of monitoring procedures to be performed. Possible asserted effect Lack of effective controls over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned costs None Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding Yes, 2024-009 Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining and reviewing the documentation. The City should then conclude on and document the subrecipient’s risk of noncompliance based on the checklist to ensure the proper level of monitoring occurs throughout the year. Views of responsible officials and corrective actions The city already established a well-designed internal control manual of policies and procedures over the ARPA grant's full cycle grant management, as well as various templates to evaluate the subrecipients' risks and monitoring their performances. In FY26, the city will implement its internal control by conducting timely subrecipient monitoring activities with signed documents

Finding 2025-001: The Corporation for National and Community Service – Foster Grandparent/Senior Companion Cluster – ALN 94.011 and 94.016 – Significant Deficiency – Controls over Stipend Allocations Criteria: AmeriCorps Foster Grandparent Program guidelines limit stipends charged to the grant to $4.00 per hour, with any excess required to be funded by non-Federal sources. Internal controls must ensure that costs charged to Federal awards are allowable and properly allocated (2 CFR 200.303, 200.403, 200.405). Condition: We noted that volunteer stipends of $5.00 per hour were initially allocated to the AmeriCorps program. The portion in excess of the allowable allocation was removed and funded with non-Federal sources. Cause: Controls were not sufficient to ensure stipend rates were reviewed for compliance before being charged to the grant. Effect: Without proper review, unallowable costs may be charged to the AmeriCorps program and go undetected. Context: For the 18 out of 26 stipends tested, the allocation rate was not correct. Recommendation: Strengthen controls to ensure stipend rates are reviewed for compliance with AmeriCorps limits before allocation to the Federal award. Views of Responsible Officials: Management acknowledges the finding and agrees with the recommendation. Once notified of the stipend rate issue, management immediately corrected the allocation and ensured the unallowable portion was funded with non-Federal resources. To prevent future occurrences, SoFIA Management has reinforced controls by (1) requiring a compliance review of stipend rates before charging costs to the AmeriCorps award, (2) updating written procedures to reflect stipend limits, and (3) providing further training to program and finance staff. These measures will ensure that only allowable stipend costs are charged to the Federal program going forward. We are committed to maintaining strong fiscal controls and ensuring full compliance with all federal grant requirements.

Federal Agency: United States Department of Education Federal Program Name: Special Education Cluster (IDEA programs) Assistance Listing Number: 84.027, 84.173 Federal Award Identification Number and Year: H027A240064-2024; H173A240070-2024 Pass-Through Agency: Wisconsin Department of Public Instruction Pass-Through Number(s): 2025 - 403619 - DPI - YIPPE – 342, 2025-403619-DPI-FLOW-341, 2025-403619-DPI-FLOW-341, 2025 - 403619 - DPI - FNC – 342, 2025-403619-DPI-ELIMG-348, 2025-403619-DPI-ELTAI-348, 2025-403619-DPI-PRESCH-347 Award Period: July 1, 2024 through June 30, 2025 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 2 CFR 200.303(a), the District must establish and maintain effective internal control over the federal award that provides reasonable assurance that the District is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. In accordance with 2 CFR 200.430(h), costs charged to federal awards must be incurred during the approved budget period as defined in the grant agreement. Condition: For one (1) of the 40 payments to vendors selected for testing, the District did not correctly allocate the cost to the proper grant period. This sample was not statistically valid. Questioned costs: Cost in the amount of $29,850 were identified as being related to periods outside the grants award period. Context: One instance of a payment to a vendor related to services that will provide benefit during the subsequent fiscal year were accrued to the fiscal year and grant period under audit. Cause: From 2023 through 2025, the District experienced substantial turnover within the finance department, including management positions. Individuals in these roles lacked the necessary skills, knowledge, and experience to oversee day-to-day operations, resulting in controls not operating effectively to ensure proper classification of vendor payments by applicable grant period and fiscal year. Effect: This resulted in amounts claimed for reimbursement that did not meet eligibility requirements for reimbursement from the grant award. Repeat Finding: No Recommendation: We recommend the District implement controls that allow for the identification and proper classification of vendor payments to applicable grant period. Views of responsible officials: There is no disagreement with this finding.

Federal Agency: United State Department of Education Federal Program Name: Title II, Part A – Supporting Effective Instruction State Grants Special Education Cluster (IDEA) Title I A – Grants to Local Educational Agencies Assistance Listing Number: 84.367 84.027, 84.173 84.010 Federal Award Identification Number and Year: S367A240047-2024 H027A240064-2024, H173A240070-2024 S010A240049-2024 Pass-Through Agency: Wisconsin Department of Public Instruction Pass-Through Number(s): 2025 - 403619 - DPI - YIPPE - 342, 2025-403619-DPI-FLOW-341, 2025-403619-DPI-FLOW-341, 2025 - 403619 - DPI - FNC - 342, 2025-403619-DPI-ELIMG-348, 2025-403619-DPI-ELTAI-348, 2025-403619-DPI-PRESCH-347, 2025-403619-DPI-TI-A-141 Award Period: July 1, 2024, through June 30, 2025 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 2 CFR 200.303(a), the District must establish and maintain effective internal control over the federal award that provides reasonable assurance that the District entity is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. In accordance with 2 CFR 200.430(i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. Additionally, 2 CFR 200.403(g) requires that costs are adequately documented to be allowable under federal awards. Condition: During testing, instances were identified in which the semi-annual certifications utilized by the District to support time charged to federal awards completed and approved prior to the final claims. Title II, Part A – Supporting Effective Instruction State Grants (ALN 84.367) Three (3) of the 40 individuals selected for testing time was supported by a semi-annual certification that was not approved timely. The semi-annual certification was approved after the submission of the final reimbursement claim. This was not a statistically valid sample. Special Education Cluster (IDEA) (ALN 84.027, 84.173) Two (2) of the 40 individuals selected for testing time was supported by a semi-annual certification that was not approved timely. The semi-annual certification was approved after the submission of the final reimbursement claim. This was not a statistically valid sample. Title I-A – Grants to Local Educational Agencies (ALN 84.010) Three (3) of the 60 individuals selected for testing time was supported by a semi-annual certification that was not approved timely. The semi-annual certification was approved after the submission of the final reimbursement claim. This was not a statistically valid sample. Questioned costs: None Context: The District supports time charged to federal awards via semi-annual certifications which are approved by the grant administrator or the building principal. In order for a cost to be supported at the time of the final reimbursement, the semi-annual certifications should be approved by the grant administrator or the building principal. During the fiscal year under audit the collection and review of these certifications were delayed, resulting in some being collected after the final claim dates. Cause: From 2023 through 2025, the District experienced substantial turnover within the finance department, including management positions. Individuals in these roles lacked the necessary skills, knowledge, and experience to oversee day-to-day operations, resulting in delays in execution of controls and collection of required supporting time and effort reporting. Effect: Lack of timely collection and review of approved semi-annual could result in unallowable costs may be submitted for reimbursement. Repeat Finding: This is a repeat of prior year finding 2024-009 Recommendation: We recommend the District design and implement controls to ensure semi-annual time and effort certification are obtained and reviewed timely. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: United State of Department of Health and Human Services Federal Program Name: Medicaid Cluster Assistance Listing Number: 93.778 Federal Award Identification Number and Year: 2405WI5MAP-2024, 2505WI5MAP-2025 Pass-Through Agency: Wisconsin Department of Health Services Pass-Through Number(s): Not Available Award Period: July 1, 2024, through June 30, 2025 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 2 CFR 200.303(a), the District must establish and maintain effective internal control over the federal award that provides reasonable assurance that the District is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award In accordance with Wisconsin Department of Public Instruction guidance, each local education agency (LEA) that is a Medicaid-certified SBS provider is required to have a signed and dated DPI Consent to Bill Wisconsin Medicaid for Health-Related Special Education and Related Services (Form M-5) from the parent or guardian of a student with an IEP before claims can be submitted to BadgerCare Plus. Condition: A not statistically valid sample of 40 individuals with Medicaid billings filed during the fiscal year was selected. 3 of the 40 tested individuals did not have a DPI Consent to Bill Wisconsin Medicaid for Health-Related Special Education and Related Services (Form M-5) available for review. Questioned costs: $279.47 Context: The District was not able to produce documentation of the required Authorization to Bill (Form M-5) three (3) individuals selected for testing. The third-party billing service provided included that records had been sighted previously for these individual, but were not available for review during testing. Cause: Internal controls in place at the District are not designed and implemented to ensure the required authorization to bill Medicare is obtained prior to initial billing and retained for future review. Effect: The District may bill for services that are not eligible for reimbursement under the state of Wisconsin administered Medicaid program. Repeat Finding: No. Recommendation: We recommend the District design and implement controls to ensure required authorization to bill Medicare (Form M-5) is obtained prior to initial billing. We also recommend the District design and implement controls to ensure a copy of this form is retained in accordance with federal and state requirements and is available for future required reviews. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: United State of Department of Health and Human Services Federal Program Name: Medicaid Cluster Assistance Listing Number: 93.778 Federal Award Identification Number and Year: 2405WI5MAP-2024, 2505WI5MAP-2025 Pass-Through Agency: Wisconsin Department of Health Services Pass-Through Number(s): Not Available Award Period: July 1, 2024, through June 30, 2025 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 2 CFR 200.303(a), the District must establish and maintain effective internal control over the federal award that provides reasonable assurance that the District is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award In accordance with Wisconsin Department of Public Instruction guidance, each school district’s salary and benefit information of direct medical service providers are required to be reported through quarterly financial submissions. These submissions automatically aggregate into the annual cost report and are utilized to calculate the Medicaid Administrative Claims (MAC) amounts. The salary and fringe benefits included in these reports are required to be supported by District payroll records and financial ledgers and be appropriately classified and identified. Condition: Three (3) of the 40 individuals selected for testing were reported on the Quarterly Report tested in Job Categories that are inconsistent with the role or duties that employee filled during the reporting period. In addition, the District’s reconciliation of the District’s payroll summary reports to the Quarterly Report for the period July 1, 2024 to September 30, 2024 was not documented and available for review during audit testing. Questioned costs: None Context: The three (3) reported in in Job Categories that are inconsistent with the role or duties, fulfilled role that would be eligible for reporting in the Quarterly Report, but were classified into incorrect Job Categories. The District generates a series of reports from internal payroll systems, general ledger and subledger systems, and third party claim systems to support each Quarterly Report. These reports are reviewed and reconciled to support the final Quarterly Reports submission. For the quarter covering July 1, 2024 through September 30, 2024, the District generated the reports and prepared the Quarterly Report, however, the reconciliations were not retained documenting the standard process of the District. Cause: The District did not design and implement controls to ensure amounts reported were supported by internal records of employees roles or positions at the time of the reporting and that all supporting records and reconciliations are maintained. Effect: Amounts reported as eligible expenditures utilized in calculations of award did not agree to available supporting District payroll and financial records. This could result in calculations of award being inaccurate. Repeat Finding: No. Recommendation: We recommend the District design and implement controls to ensure amounts reported are supported by employees current roles and positions. Views of responsible officials: There is no disagreement with the audit finding.

Finding No. 2025-047 Prior Year Finding: 2024-053 Federal Awarding Agency: U.S. Department of Agriculture (USDA) Impact: Material Weakness, Material Noncompliance AL Number and Title: 10.551, 10.561 Supplemental Nutrition Assistance Program (SNAP) Cluster Federal Award Number: 25AK35050292301, 24AK35050292301 Applicable Compliance Requirement: Allowable Costs/Cost Principles, Special Tests and Provisions Condition: The amount of FY 25 SNAP benefits reported to USDA as issued by the State’s Electronic Benefits Transfer (EBT) contractor, Fidelity National Information Services (FIS), was $1,235,577 more than the amount of authorized benefits reported in data from the Division of Public Assistance’s (DPA) Eligibility Information System (EIS). Furthermore, FIS could not provide a reliable audit trail of issuances. Context: DPA relies on its legacy eligibility system, EIS, to determine eligibility for SNAP and calculate monthly benefit amounts. Benefit amounts are calculated based on household size, income, and other financial resources of all qualifying members of a household, less specific allowable deductions. Each day EIS transmits an issuance batch file, including authorized beneficiaries and benefit amounts, to the State’s EBT contractor, FIS, which maintains accounts for each beneficiary. When an EBT card is utilized by a beneficiary, FIS functions as the intermediary between the State’s U.S. Treasury benefit account and the retailers by settling SNAP benefit transactions with retailers before drawing down federal reimbursement. The State is required to ensure its automated data processing systems accurately and completely process and store all case file information for eligibility determinations and benefit calculations, and provide the data necessary to meet federal issuance and reconciliation reporting requirements. A reconciliation of FIS issuance records with EIS authorized beneficiaries and benefit amounts demonstrates the completeness and accuracy of the EBT process. In FY 25, the EIS benefit data provided by DPA could not be reconciled to the amount of SNAP benefits issued per FIS data or the issuance amounts reported by DPA to USDA. Furthermore, FIS could not provide a detailed list of issuances to support the monthly amounts reconciled by DPA staff and reported to USDA. Cause: DPA management and FIS staff could not identify the cause of the variances. DPA’s outdated legacy eligibility system and the lack of daily reconciliations (see Finding No. 2025-049) contributed to the deficiencies. Criteria: Title 7 CFR 274.1(h) requires that the State agency create and maintain a master issuance file that consolidates records of all certified SNAP households, record participation activity for each household, and supply all information necessary to fulfill the reporting requirements outlined in Title 7 CFR 274.4. Title 7 CFR 274.4(a) requires the State to reconcile benefits posted to household accounts on the central computer against benefits on the issuance authorization file. Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the State is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the grant awards. Effect: Significant discrepancies between EIS benefit data and the EBT contractor’s issuance records undermine confidence in the eligibility system and may be indicative of significant unidentified processing errors. Inadequate system controls increase the risk of incorrect or ineligible benefits. Questioned Costs: AL 10.551: $1,235,577 Recommendation: DPA’s director should identify the cause of the discrepancies between EBT contractor issuance data and the State’s eligibility system and take action necessary to ensure SNAP benefit payments are supported by eligibility and benefit data. Views of Responsible Officials: The department agrees with the finding but does not concur with the questioned costs. The Division of Public Assistance completes reconciliations between FIS daily transaction records and EBT Account Management Agent (AMA) data to ensure issuance accuracy. Auditor’s Concluding Remarks: Management concurs with the finding, but not the questioned costs. Questioned costs are defined by Title 2 CFR 200.1, which states: Questioned cost means a cost that is questioned by the auditor because of an audit finding:  Which resulted from a violation or possible violation of a statute, regulation, or the terms and conditions of a federal award, including for funds used to match federal funds;  Where the costs, at the time of the audit, are not supported by adequate documentation; or  Where the costs incurred appear unreasonable and do not reflect the actions a prudent person would take in the circumstances. Based on Uniform Guidance, the SNAP benefits issued that were not supported by eligibility determinations were reported as questioned costs.

Finding No. 2025-048 Federal Awarding Agency: USDA Impact: Material Weakness, Material Noncompliance AL Number and Title: 10.551, 10.561 SNAP Cluster Federal Award Number: 25AK35050292301, 24AK35050292301 Applicable Compliance Requirement: Allowable Costs/Cost Principles, Special Tests and Provisions Condition: Testing of 72 FY 25 SNAP EBT issuances found two automated EIS benefit calculations that did not consider an increase in unearned income related to Alaska’s Senior Benefits Program. Context: SNAP benefits are calculated based on household size, income, and other financial resources of all qualifying members of a household, less specific allowable deductions. The State is required to ensure the SNAP system accurately and completely processes and stores all case file information for eligibility determinations and benefit calculations, automatically cuts off households at the end of a certification period unless recertified, and provides the data necessary to meet federal issuance and reconciliation reporting requirements. SNAP recipients aged 65 or older with low to moderate income are eligible to receive monthly payments from the Senior Benefits Program. Senior benefit amounts are based on available state funding and the number of eligible applicants. Beginning August 1, 2024, monthly benefits increased from $49 to $125. For SNAP purposes, senior benefits are classified as unearned income and the increase should have been incorporated into all SNAP recipient benefit calculations completed after August 1, 2024. Between September 2024 and June 2025, on average, 6,277 SNAP households included at least one member aged 65 or older. The EIS benefit calculation errors were systematic and potentially impacted all SNAP households that include a senior member. Likely questioned costs exceed $25,000. Cause: Management stated that the system change implemented to increase senior benefits in EIS failed to adequately include the increase on prospective SNAP benefit calculations. DPA’s information system change management and monitoring procedures were insufficient to prevent or detect the processing flaw. Criteria: Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the State is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the grant award. Title 7 CFR 272.10(b) requires the State to use an automated data processing system for SNAP. The system is to be used to determine eligibility and calculate benefits or validate eligibility workers’ calculations by processing and storing all case file information necessary for the eligibility determinations and benefit computations including, but not limited to, all household members’ names, addresses, dates of birth, social security numbers, individual household members earned and unearned income by source, deductions, resources, and household size. Also, the system must be used to redetermine or revalidate eligibility and benefits based on notices of change in households’ circumstances. Title 7 CFR 274.1(a) requires the State to establish issuance and accountability systems which ensure that only certified eligible households receive benefits; that program benefits are timely distributed in the correct amounts; and that benefit issuance and reconciliation activities are properly conducted and accurately reported to USDA Food and Nutrition Service (FNS). Effect: Inadequate SNAP automated data processing controls increases the risk of incorrect or ineligible benefits. Errors in SNAP benefit determinations could result in federal sanctions and/or penalties imposed on DOH. Questioned Costs: AL 10.551: $660 Recommendation: DPA’s director should strengthen SNAP automated data processing controls to ensure EIS system changes are adequately evaluated prior to implementation. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-049 Federal Awarding Agency: USDA Impact: Material Weakness, Material Noncompliance AL Number and Title: 10.551, 10.561 SNAP Cluster Federal Award Number: 25AK35050292301, 24AK35050292301 Applicable Compliance Requirement: Allowable Costs/Cost Principles, Special Tests and Provisions Condition: DOH’s information technology staff did not properly limit user access to EIS during FY 25. Context: EIS is used to determine eligibility for SNAP. The details related to this control weakness and the relevant audit criteria are being withheld from this report to prevent the weakness from being exploited. Pertinent details have been communicated to agency management in a separate confidential document. Cause: The control weakness was attributed to human error and competing priorities. Criteria: Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the State is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the grant award. State of Alaska Information Security Policies provide specific criteria related to the identified deficiency. Effect: The internal control weakness increases the risk of unauthorized system use, including risk of data manipulation, which may result in ineligible benefit recipients or unallowable costs. Questioned Costs: None Recommendation: DOH’s Division of Finance and Management Services director should strengthen monitoring procedures to address the control weakness. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-050 Prior Year Finding: 2024-055 Federal Awarding Agency: USDA Impact: Material Weakness, Material Noncompliance AL Number and Title: 10.551, 10.561 SNAP Cluster Federal Award Number: 25AK35050292301, 24AK35050292301 Applicable Compliance Requirement: Special Tests and Provisions Condition: Daily SNAP EBT reconciliations were not performed in FY 25. Context: A state must have a system in place to reconcile, on a daily basis, all of the funds entering into, exiting from, and remaining in the system each day with a state’s U.S. Treasury benefit account and FIS’s records. States must also have systems in place to reconcile retailer credit activity as reported into the banking system to client transactions maintained by the processor and to the funds drawn down from the EBT benefit account with the U.S. Treasury. The reconciliation process ensures that a state only draws federal funds for authorized transactions. In FY 25, required daily reconciliations were not performed. Cause: According to DPA management, daily reconciliations were not performed due to inadequate procedures, staff turnover, and the lack of trained staff. Implementation of corrective action was also delayed due to inadequate system access for new staff. Criteria: Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the State is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the grant award. Title 7 CFR 274.4(a) requires that State agencies account for all issuance through a reconciliation process. The EBT system must provide reports and documentation pertaining to reconciliation. Reconciliations must be conducted and records kept as follows: • Verification of retailer’s credits against deposit information entered into the automated clearinghouse network; and • Reconciliation of total funds entered into, exiting from, and remaining in the system each day. Effect: The lack of daily reconciliations increases the risk of unidentified processing errors and unallowable costs, including potential non-federal liabilities. States are responsible for efficiently and effectively administering SNAP in accordance with federal laws, regulations, and the FNS approved Plan of Operations. A determination by FNS that the State has failed to comply with any of these requirements may result in a suspension or disallowance of the federal share of the State’s administrative funds. Questioned Costs: None Recommendation: DPA’s director should develop and implement daily reconciliation and monitoring procedures and train staff to ensure daily reconciliations are conducted in accordance with federal regulations. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-072 Federal Awarding Agency: United States Department of Agriculture (USDA) Impact: Significant Deficiency AL Number and Title: 10.859 Assistance to High Energy Cost Rural Communities Federal Award Number: AK0031-E84 Applicable Compliance Requirement: Allowable Costs/Cost Principles, Special Tests and Provisions Condition: Alaska Energy Authority (AEA) did not have controls in place for review of progress reports for this program. During our testing of reports, we noted that two of the five reports sampled did not have evidence of a formal review before submission. Context: We tested a sample of five reports and found two exceptions as noted in the condition. This is a condition identified per review of AEA’s compliance with specified requirements not using a statistically valid sample. Cause: AEA did not have controls in place to ensure that progress reports were reviewed by personnel independent of the preparers prior to submission to the federal agency. Criteria: 2 CFR 200.303, Internal Controls, requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statues, regulations, and the terms and conditions of the federal award. Effect: Reports may contain inaccuracies, be incomplete, or fail to comply with the requirements outlined in 2 CFR 200.329 and the federal award. Questioned Costs: None Recommendation: AEA should establish procedures requiring all reports be reviewed and approved by personnel independent of the preparer prior to submission to federal agencies. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-076 Federal Awarding Agency: U.S. Department of Commerce Impact: Material Weakness, Noncompliance AL Number and Title: 11.307 – Economic Development Cluster – COVID-19 Federal Award Number: 2021 Applicable Compliance Requirement: Reporting Condition: The Alaska Industrial Development and Export Authority’s (AIDEA) controls were not designed to detect noncompliance in program income reported in AIDEA’s annual report. During our testing of reports, we noted that the annual report tested did not report interest earned on deposit accounts. The amount of interest income not included on the annual report totaled $167,023, which represents the cumulative interest income earned for the program from deposits since inception. Context: We tested the program's sole annual report and identified the exception as noted in the condition. This is a condition identified per review of AIDEA’s compliance with specified requirements not using a statistically valid sample. Cause: AIDEA had not reported program income in prior annual reports and the individual responsible for preparing the report was not aware of the program income reporting requirements. Criteria: Title 2 CFR 200.303, Internal Controls, requires the recipient or subrecipient establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effect: The annual report submitted did include program income as required by the program requirements. Questioned Costs: None Recommendation: AIDEA should establish procedures requiring all reports be reviewed by personnel knowledgeable of the program's requirements prior to submission to federal agencies. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-041 Federal Awarding Agency: U.S. Department of Commerce (USDOC) Impact: Significant Deficiency, Noncompliance AL Number and Title: 11.438 Pacific Coast Salmon Recovery Pacific Salmon Treaty (PCSRT) Federal Award Number: NA24NMFX438G0026 Applicable Compliance Requirement: Reporting Condition: One of six PCSRT Federal Funding Accountability and Transparency Act (FFATA) reports tested was not submitted timely. Context: FFATA requires information on federal awards to be made available to the public through USASpending.gov. The FFATA reporting tool is available for federal awardees, such as the State of Alaska, to report subaward and executive compensation data for first-tier subawards. In FY 25 there were 19 PCSRT subawards totaling $11,782,618 that were subject to FFATA reporting of which the audit tested six totaling $7,978,619. The FFATA report for one subaward totaling $5,079,825 was reported 24 days late. Cause: Competing priorities and a backlog of subawards requiring FFATA reporting resulted in the subaward not being filed timely. Supervisory review and submission procedures were insufficient to ensure FFATA reports were filed timely. Criteria: Title 2 CFR Part 170 requires federal award recipients to report subawards of $30,000 or more to SAM.gov by the end of the month following the subaward obligation. Title 2 CFR 200.303(a) requires the State to establish, document, and maintain effective internal controls over Federal awards that provide reasonable assurance that the State is managing Federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Effect: Failure to comply with FFATA reporting requirements reduces transparency and may jeopardize future federal funding. Questioned Costs: None Recommendation: DFG’s Division of Administrative Services (DAS) director should strengthen FFATA reporting review and submission procedures to ensure required reports are filed timely. Views of Responsible Officials: Alaska Department of Fish & Game (ADFG) disagrees with this finding. The FFATA report for the FY2025 NOAA subaward was submitted one month late due to resource constraints while our team was actively implementing a corrective action plan (CAP) for a prior Office of Inspector General (OIG) federal audit finding related to FFATA reporting timeliness. During this period, we prioritized fulfilling the CAP requirements, which included a comprehensive reconciliation of all subawards across federal programs to ensure accuracy and compliance. This intensive remediation effort temporarily impacted our ability to meet standard reporting timelines. The delay was not the result of a new or separate control failure, but rather a timing issue directly tied to the corrective work already underway. Importantly:  The NOAA FFATA report was completed accurately as part of the same remediation workflow.  The delay occurred while addressing the previously identified issue and was resolved within the corrective action period established with the OIG.  The root cause was the same issue identified in the existing finding, and not a new or systemic breakdown.  Updated internal controls and revised procedures were implemented during this period and now apply uniformly across all programs, including NOAA.  These corrective actions have resulted in timely, comprehensive, and fully implemented processes designed to prevent recurrence. Given that the late NOAA FFATA report occurred within the active corrective action window and was resolved through the same documented process, we view this as part of the previously identified issue rather than a separate instance of noncompliance. The corrective actions were completed as planned and have strengthened our reporting controls to ensure ongoing compliance. Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise the finding. DFG management is responsible for complying with federal reporting requirements. We reaffirm the finding.

Finding No. 2025-042 Federal Awarding Agency: USDOC Impact: Significant Deficiency, Noncompliance AL Number and Title: 11.438 PCSRT Federal Award Number: NA24NMF4380259, NA24NMFX438G0056 Applicable Compliance Requirement: Reporting Condition: Two of four randomly selected FY 25 PCSRT SF-425 federal financial reports tested did not include the recipient share of expenditures. Context: The SF-425 is a required semi-annual federal financial form used for reporting on the financial status of federal grant awards. Recipients of PCSRT grants must submit semi-annual SF-425 reports for all active federal awards. During FY 25, 20 grant awards were subject to SF-425 submission for a total of 37 required reports filed. Four reports were selected for testing. The audit identified that the recipient share of expenditures (line 10j) reported for two federal awards was not completed. Cause: The errors were due to DFG staff misunderstanding instructions for completing SF-425 reports. Federal guidance on whether the State must report the recipient share of expenditures changed prior to the fiscal year. DFG report preparation and review procedures were insufficient to identify the revised reporting requirements. Criteria: Per Title 2 CFR 200.328(c), the State must submit financial reports as required by the federal award. Title 2 CFR 200.303(a) requires the State to establish, document, and maintain effective internal controls over Federal awards that provide reasonable assurance that the State is managing Federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Effect: Inaccurate federal reporting may impair federal decision-making and may result in the federal awarding agency imposing additional conditions or taking corrective action, including additional reporting requirements or withholding/terminating funds. Questioned Costs: None Recommendation: DFG’s DAS director should strengthen procedures for the preparation and review of the SF-425 report to ensure submitted reports are accurate. Furthermore, the DAS director should work with the federal oversight agency to revise the incomplete SF-425 reports, as needed. Views of Responsible Officials: ADFG respectfully disagrees with the audit finding regarding SF-425 reporting and recipient share. During the audit period, the federal awarding agency transitioned to a new reporting system but did not issue updated written instructions, revised award terms, or formal guidance clarifying new SF-425 fields or reporting expectations. Under 2 CFR §200.328, recipients are required to submit financial reports as specified in the Federal award, and agencies may require only OMB-approved, government-wide data elements. No updated award terms or instructions were provided to ADFG during this transition. System behavior clearly indicated that certain fields were not applicable. In Grants Online, the fields were grayed out, signaling they were not required. In contrast, eRA Commons left these fields open without any explanation or guidance. NOAA now requires these fields, but this requirement was not communicated at the time of the transition. This inconsistency demonstrates that the agency had not finalized or communicated enforceable requirements for these fields during the reporting period. DFG acted reasonably and consistently based on the information available. It would be inappropriate to penalize DFG for continuing to report under prior requirements or omitting data in fields that were not previously required. The Uniform Guidance places responsibility on awarding agencies to provide clear written guidance, transition timelines, and clarification on new reporting requirements before they become enforceable. For these reasons, DFG requests that this finding be reconsidered. Our reporting complied with the award terms and the system instructions available at the time, and any changes introduced by the agency were not formally communicated or incorporated into our award during the relevant reporting period. Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise the finding. DFG management reports that the federal agency did not provide updated written instructions or reporting requirements when the federal awarding agency transitioned to a new reporting system. However, DFG management is responsible for complying with federal reporting requirements. We reaffirm the finding.

Finding No. 2025-043 Federal Awarding Agency: USDOC Impact: Significant Deficiency, Noncompliance AL Number and Title: 11.438 PCSRT Federal Award Number: NA24NMFX438G0056 Applicable Compliance Requirement: Subrecipient Monitoring Condition: A review of six FY 25 PCSRT subrecipients’ subaward agreements found that one did not include an accurate unique entity identifier (UEI) that matched the subrecipient’s name. Context: All federal award recipients are required to have a UEI. DFG enters into awards with subrecipients using a subaward agreement. The subaward agreement lists the federal requirements that pertain to the subaward and must identify the subrecipient’s UEI. The audit reviewed six subaward agreements, and found that one contained an incorrect UEI. Cause: The finding was caused by human error. In preparing the subaward agreement, staff copied and pasted the UEI from a different subrecipient’s information. Supervisory review procedures were insufficient to detect and correct the error. Criteria: Title 2 CFR 200.332 requires pass-through entities to ensure that every subaward includes the required information at the time of the subaward. Required information includes the subrecipient’s name, which must match the name associated with the subrecipient’s UEI. Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the State is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Effect: Not providing the correct UEI number hampers subaward reporting and may limit federal oversight of the PCSRT program. Questioned Costs: None Recommendation: DFG’s Commercial Fisheries Division director should strengthen supervisory review procedures to ensure federally required information is accurately identified in PCSRT subaward agreements. Views of Responsible Officials: ADFG disagrees with this finding. During the audit, it was noted that the UEI listed in the subaward agreement contained a copy-and-paste error. This discrepancy was promptly corrected once identified. Under 2 CFR 170, the official compliance requirement for subaward reporting is the Federal Funding Accountability and Transparency Act (FFATA) submission through SAM.gov. In this case:  The correct UEI was verified in SAM.gov.  The FFATA report contained the correct UEI and was submitted timely.  The correct subrecipient was paid, and supporting documentation confirmed the subrecipient’ s identity. These facts demonstrate that the federal reporting requirement was met and that the error was limited to the internal agreement. The issue did not result in improper payments, misreporting to federal systems, or a breakdown in internal controls. This was an isolated clerical error that was promptly corrected during the audit. It does not represent a significant deficiency or material weakness. This seems more appropriately categorized as a minor observation or management comment regarding document review processes. Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise the finding. DFG management asserts the unique entity identifier number incorrectly recorded in the subaward agreement was correctly reported to sam.gov. However, the reporting of the subaward to sam.gov is a reporting requirement. DFG management is responsible for complying with federalsubrecipient monitoring requirements. We reaffirm the finding.

Finding No. 2025-044 Prior Year Finding: 2024-044 Federal Awarding Agency: U.S. Department of the Interior Impact: Material Weakness AL Number and Title: 15.605, 15.611 Fish and Wildlife Cluster (FWC) Federal Award Number: Multiple Applicable Compliance Requirement: Equipment and Real Property Management Condition: Auditors could not obtain sufficient appropriate evidence to verify compliance with FWC’s equipment and real property management requirements. Context: DFG is responsible for ensuring equipment, real property, and capital improvements, acquired with FWC funds, are used for an authorized purpose, sufficiently tracked, and appropriately disposed of in accordance with federal regulations. DFG began efforts in FY 25 to address equipment and real property management weaknesses found in the prior year audit. However, at the end of FY 25, corrective action was incomplete. In FY 25, DFG did not maintain sufficient evidence to demonstrate compliance with equipment and real property management requirements. DFG equipment and real property records did not reliably catalog the universe of equipment, real property, and capital improvements funded with FWC grant monies. Equipment records were incomplete and not trackable by funding source in the accounting system. As a result, the audit was unable to determine the extent of equipment purchased with FWC funds. Real property records had not been reconciled since 2019 and could not be matched with DFG site visit logs. The audit could not identify the FWC assets to be monitored and the extent of site visits conducted during the audit period, and whether the site visits included monitoring for authorized uses. Cause: DFG management attributed the deficiencies to a lack of department-wide procedures, staff turnover, and insufficient training. Criteria: Title 2 CFR 200.303 requires the State to establish and maintain effective internal controls over the federal award that provides reasonable assurance that the State is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal award. Title 2 CFR 200.311 and Title 50 CFR 80.134 requires the State to use real property for the purpose authorized in the grant for as long as it is needed for that purpose. When real property is no longer needed for the originally authorized purpose, property must be disposed of in accordance with federal requirements. Title 2 CFR 200.313 requires the State to use, manage and dispose of equipment acquired under a federal award in accordance with State laws and procedures. Such equipment must be used for the project or program for which it was acquired and for as long as needed. The State agency must maintain equipment property records, perform physical inventory of equipment, develop a control system, and perform regular maintenance of equipment. Title 50 CFR 80.133 requires the State to maintain acquired or completed capital improvements under FWC grants to ensure that each capital improvement continues to serve its authorized purpose during its useful life. Effect: The lack of department-wide procedures increased the risk that FWC funded assets were not used for authorized purposes and properly disposed of when no longer needed. Inadequate equipment tracking increased the risk of loss or theft. Further, noncompliance with federal regulations may result in the federal awarding agency imposing additional conditions or taking corrective action, including additional reporting requirements or withholding/terminating funding. Questioned Costs: Indeterminate Recommendation: DFG’s commissioner should continue efforts to ensure procedures are developed and training is implemented so that FWC funded equipment, real property, and capital improvements are fully identified and are managed in compliance with federal requirements. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-063 Federal Awarding Agency: U. S. Department of Transportation (USDOT) Impact: Significant Deficiency, Noncompliance AL Number and Title: 20.205 Highway Planning and Construction (HPC) Federal Award Number: 0956(036), 0A45(034), 0851(076), 0002(514), 0617(003), 0002(488), 0A43(024), 0A43(020) Applicable Compliance Requirement: Allowable Costs/Cost Principles Condition: Three of 40 timesheets tested (eight percent) were entered into the State’s accounting system with incorrect coding. Context: DOTPF’s staff allocated personal service costs to federal programs based on program, activity, and profile codes that identify specific federal highway projects. A supervisor reviews the coding and hours in the State’s accounting system to verify the accuracy of time entered by employees. A random sample of 40 timesheets that charged personal service costs to the HPC program in FY 25 was tested. Auditors found three timesheets were entered into the accounting system using incorrect program, activity, or profile codes, resulting in incorrect federal projects being charged. Cause: Human error resulted in timesheets being entered incorrectly. Additionally, supervisory review procedures were inadequate to identify and correct miscoded timesheets. Criteria: Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the State is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the grant awards. Title 2 CFR 200.430 requires that charges to federal awards for salaries and wages be based on records that accurately reflect the work performed. The records must be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Furthermore, the records must comply with the entity’s established accounting procedures. Effect: Incorrect coding of personal service expenditures may result in project managers relying on misclassified information to manage and report on the status of the project. The lack of adequate controls could result in unallowable personal services expenditures. Noncompliance with federal regulations may result in the federal awarding agency imposing additional conditions or taking corrective action including withholding/terminating funding. Questioned Costs: None Recommendation: DOTPF’s Division of Administrative Services (DAS) director should provide training to staff on timesheet processing procedures and strengthen supervisory review procedures to ensure personal service expenditures are accurately charged to federal projects. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-065 Federal Awarding Agency: USDOT Impact: Significant Deficiency, Noncompliance AL Number and Title: 20.205 HPC Federal Award Number: Various Applicable Compliance Requirement: Procurement and Suspension and Debarment Condition: The indirect cost rate in two of 11 FY 25 consultant contracts tested (18 percent) were incorrect. Context: If an indirect cost rate has not been established by a federal cognizant agency, DOTPF staff must evaluate a consultant’s indirect cost rate and calculate an appropriate rate. Consultants submit financial information to DOTPF’s Internal Review section staff that perform an audit to establish an audited indirect cost rate. The audited indirect cost rate is sent to the consultant. The consultant may either accept or reject the rate. Once a consultant accepts the rate, the signed certificate of indirect cost rate is forwarded to DOTPF’s regional procurement staff. Regional procurement staff send an email to project managers, who are also the contract managers for the professional service procurements, informing them of the consultant’s revised indirect cost rate. Of the 31 FY 25 engineering and design-related professional services procurements, the audit reviewed four randomly selected and four judgmentally selected procurements. Indirect rates were tested for all 11 consultant contracts related to the eight procurements. For the two errors noted, the consultant’s contracts were not updated with the approved FY 25 indirect cost rate. Cause: Although project managers received notification when a consultant’s indirect cost rate was revised, DOTPF lacked procedures to ensure revised indirect cost rates were accurately billed by consultants. A new procedure to record the indirect cost rate as “on file” in contracts rather than issuing an amendment to the contract contributed to the errors. Furthermore, project manager review procedures were insufficient to ensure consultant invoices billed the correct indirect cost rates. Criteria: Title 23 CFR 172.11(b)(1) requires indirect cost rates to be updated on an annual basis in accordance with the consultant’s annual accounting period and in compliance with the federal cost principles. Once an indirect cost rate is accepted, contracting agencies must apply such indirect cost rates for the purposes of contract estimation, negotiation, administration, reporting, and contractor payments. A consultant’s accepted indirect cost rate for its one-year applicable accounting period must be applied to contracts. The federally approved Professional Services Agreement manual, dated January 2018, requires that the contract manager review consultant billings and certify that invoices are “valid and accurate.” Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the State is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Effect: One consultant’s invoices included an indirect cost rate higher than the revised rate, resulting in the federal program being overcharged, whereas the other consultant submitted invoices that undercharged the federal program. Questioned Costs: None Recommendation: DOTPF’s regional directors should strengthen procedures to ensure project managers invoice review includes verification that the consultant’s indirect cost rate is accurate. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-066 Federal Awarding Agency: USDOT Impact: Significant Deficiency, Noncompliance AL Number and Title: 20.205 HPC Federal Award Number: 0A41(034), 0902(042), 0A31(035), 0772(001) Applicable Compliance Requirement: Special Tests and Provisions Condition: Contractor certified payrolls for four of 11 construction projects tested were not submitted during FY 25. Context: All laborers and mechanics employed by contractors or subcontractors that perform work on construction projects in excess of $2,000 financed by federal funds must be paid wages not less than the prevailing wage rates established by the Department of Labor and Workforce Development for a project’s locality. To ensure compliance with federal regulations, required provisions for federal-aid construction contracts are included in the contractors’ contract. The provision outlines the frequency and method for submission of certified payrolls to the contracting agency and requires contractors and subcontractors to submit a certified copy of payrolls for each week of contract work. Contractors and subcontractors submit payroll submissions electronically to DOTPF using AASHTOWare. Cause: DOTPF lacked adequate procedures for project staff to oversee contractors’ and subcontractors’ submission of certified payrolls to ensure federal requirements were met. According to DOTPF programming staff, AASHTOWare lacked the ability to automatically send notifications to contractors for missing certified payrolls. Although training was provided to project staff to help ensure certified payrolls were appropriately reviewed, approved, or rejected; due to competing priorities, project staff did not regularly generate payroll status reports and follow up on missing certified payrolls. Criteria: Title 29 CFR 3.4 requires that each certified payroll be delivered by the contractor or subcontractor within 7 days after the regular payment date of the payroll period. Title 2 CFR 200.318(b) requires that recipients and subrecipients maintain oversight to ensure contractors perform in accordance with the terms, conditions, and specifications of their contracts. Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the State is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Effect: Federal agencies may suspend future payments, advances, or guarantee of future funds if a state does not comply with prevailing wage rate requirements. Questioned Costs: None Recommendation: DOTPF’s Division of Statewide Design and Engineering Services director should implement procedures and continue to provide training to ensure project staff perform timely review of contractors’ and subcontractors’ payroll submission to comply with federal requirements. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-067 Federal Awarding Agency: USDOT Impact: Significant Deficiency, Noncompliance AL Number and Title: 20.205 HPC Federal Award Number: 0711(076) Applicable Compliance Requirement: Special Tests and Provisions Condition: DOTPF’s statewide value engineering (VE) coordinator omitted one project with a VE analysis in the FFY 2025 annual VE summary report submitted to the Federal Highway Administration (FHWA). Context: State transportation departments are required to ensure that a VE analysis is performed on projects that are located on the National Highway System (NHS) with an estimated total project cost of $50 million or more that utilize federal highway funding; bridge projects located on the NHS with an estimated total cost of $40 million or more that utilize federal highway funding; and any other projects that the FHWA determined to be appropriate. DOTPF’s VE program is overseen by the State VE coordinator; however, identifying, tracking, and monitoring the VE analysis of projects is a coordinated effort between regional VE coordinators and project managers. VE data is forwarded to the State VE coordinator who prepares an annual report of projects with VE analysis, including the number of approved project recommendations. The report is forwarded to the chief engineer who signs and submits the report to FHWA. Cause: Although procedures were in place for the State VE coordinator to independently monitor projects requiring a VE analysis, human error resulted in the omission of one VE project on the annual report to FHWA. Additionally, supervisory review of the annual VE report was insufficient to identify and correct the omission. Criteria: Title 23 CFR 627.5(a) requires a VE analysis be conducted prior to the completion of final design on each applicable project that utilizes Federal-aid highway funds. Title 23 CFR 627.7(a)(5) requires the State’s VE program establish and document policies, procedures, and controls to ensure a VE analysis is conducted and the results of these analyses are included in the VE program monitoring and reporting. Title 23 CFR 627.7(c) requires the State to designate a VE program coordinator to promote and advance VE program activities and functions. The VE coordinator's responsibilities should include establishing and maintaining the State’s VE policies and procedures; ensuring VE analyses are conducted on applicable projects; monitoring, assessing, and reporting on the VE analyses conducted and VE program; submitting the required annual VE report to the FHWA; and supporting the other elements of the VE program. Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal controls over federal awards that provide assurance that the State is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Effect: Incomplete and/or inaccurate reporting reduces transparency, impairs decision-making, and may impair the federal oversight agency’s ability to properly oversee the program. Questioned Costs: None Recommendation: DOTPF’s Statewide Design and Engineering Services director should strengthen review procedures to ensure the annual VE report includes all projects with a VE analysis. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-068 Federal Awarding Agency: USDOT Impact: Significant Deficiency, Noncompliance AL Number and Title: 20.532 Passenger Ferry Grant Program, Electric or Low-Emitting Ferry Pilot Program, and Ferry Service for Rural Communities Program (PFG) Federal Award Number: AK-2024-005 Applicable Compliance Requirement: Allowable Costs/Cost Principles Condition: For two out of 40 timesheets tested (five percent), the employee’s hours were inaccurately recorded in the State’s accounting system. Context: Alaska Marine Highway System (AMHS) payroll costs are calculated based on regular hours worked, overtime hours worked, hazardous activities performed, and the type of work completed. These details are recorded on employee timesheets via various coding. For two AMHS employees, the amounts entered into the State accounting system did not accurately reflect overtime or the correct pay associated with the activities performed, resulting in incorrect employee compensation. Cause: Human error resulted in the incorrect entries into the State accounting system. Review procedures were insufficient to detect and correct the data entry errors. Criteria: Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the State is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the grant awards. Title 2 CFR 200.430 requires that charges to federal awards for salaries and wages be based on records that accurately reflect the work performed. The records must be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Furthermore, the records must comply with the entity’s established accounting procedures. Effect: Incorrect recording of employee time in the accounting system can result in unallowable compensation. Inadequate controls increase the risk of noncompliance. Noncompliance with federal regulations may lead the federal awarding agency to impose additional conditions or take corrective actions, including withholding or terminating funding. Questioned Costs: None Recommendation: DOTPF’s DAS director should provide staff training on timesheet processing and strengthen supervisory review procedures to ensure employee hours are properly input into the State’s accounting system. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-026 Federal Awarding Agency: U.S. Department of Treasury (US Treasury) Impact: Significant Deficiency AL Number and Title: 21.029 Coronavirus Capital Projects Fund (CCPF) – COVID-19 Federal Award Number: CPFFN0180 Applicable Compliance Requirement: Reporting Condition: During FY 25, DCCED did not have procedures for the preparation and submission of reports under the Federal Funding Accountability and Transparency Act (FFATA) for CCPF subrecipients. Context: FFATA mandates that information on federal awards be publicly accessible through a single, searchable website: www.usaspending.gov. The reporting process implemented by DCCED was completed by a single individual without procedures to ensure accurate reporting. Cause: DCCED staff were unsure as to why procedures were not created for FFATA reporting and stated that staff turnover was a contributing factor. Criteria: Per 2 CFR 200.303(a), the State is required to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the State is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the grant awards. Effect: Without procedures, inaccurate reports may be submitted thereby reducing the federal oversight agency’s ability to adequately manage the program. Questioned Costs: None Recommendation: DCCED’s Division of Community and Regional Affairs (DCRA) director should develop and implement procedures for the preparation and submission of FFATA reports. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-027 Federal Awarding Agency: US Treasury Impact: Significant Deficiency, Noncompliance AL Number and Title: 21.029 CCPF – COVID-19 Federal Award Number: CPFFN0180 Applicable Compliance Requirement: Reporting Condition: For two of two CCPF 2025 Quarterly Obligations and Expenditure Reports reviewed, key line items for current period obligation and current period expenditures were inaccurate, and actual square footage of completed projects was unsupported. Context: CCPF reporting requirements mandate that subrecipients submit Quarterly Obligations and Expenditure Reports. These reports must be supported by adequate documentation. Support was not available for the reported actual square footage of completed projects on both quarterly reports. In addition, current period obligations and current period expenditures were inaccurate for multiple projects on both quarterly reports. Cause: Due to human error and staff turnover, DCCED lacked written procedures on CCPF reporting and documentation requirements. Criteria: Per 31 CFR 35.4, recipients must provide periodic reports to the Secretary or her delegate detailing the use of funds and other requested information necessary for program administration. Per 2 CFR 200.303(a), the State is required to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the State is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the grant awards. Effect: Inaccurate reporting may reduce the federal oversight agency’s ability to adequately manage the program. Questioned Costs: None Recommendation: DCRA’s director should implement procedures to ensure the accurate reporting of Quarterly Obligations and Expenditure Reports and submit corrected reports. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-010 Federal Awarding Agency: General Services Administration (GSA) Impact: Significant Deficiency AL Number and Title: 39.003 Donation of Federal Surplus Personal Property Federal Award Number: Not Applicable Applicable Compliance Requirement: Eligibility Condition: Internal controls to ensure applicants were eligible to receive donations of federal surplus personal property were not consistently applied. Context: Testing a random sample of seven out of 35 donee applications received during FY 25 identified two for which Alaska State Agency for Surplus Property (AKSASP) staff did not follow established application approval procedures. The approval procedures required one employee process and review an application with a different employee responsible for secondary review and approval, both signing the application accordingly. One of the errored applications was not signed by AKSASP staff. The other errored application was signed by the AKSASP secondary reviewer; however, the secondary reviewer’s signature and the approval letter issued to the applicant were both dated prior to the signature of the initial AKSASP application processor and reviewer. Cause: The audit found a lack of AKSASP training regarding the importance of implementing and following internal control processes for managing the Donation of Federal Surplus Personal Property program. Criteria: Title 41 CFR 102-37.385 gives AKSASP the responsibility for determining applicant eligibility to participate in the program. Title 2 CFR 200.303 requires the State to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the State is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the grant awards. These internal controls should be in compliance with guidance in “Standards for Internal Control in Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Effect: Without proper controls, ineligible applicants may be approved to participate in the program and receive federal surplus property. Questioned Costs: None Recommendation: DOA’s State Property Manager should provide training to AKSASP staff regarding the importance of, and requirements for, maintaining a proper system of internal control over processing applications for program eligibility. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-011 Federal Awarding Agency: GSA Impact: Significant Deficiency AL Number and Title: 39.003 Donation of Federal Surplus Personal Property Federal Award Number: Not Applicable Applicable Compliance Requirement: Reporting Condition: AKSASP lacked internal controls for the preparation and submission of the quarterly GSA 3040 State Agency Monthly Donation Report of Surplus Personal Property. Context: The GSA 3040 report is required to be submitted on a quarterly basis reporting federal receipts and donated surplus property amounts. The report provides information on what types of donees received federal surplus property. The reporting process implemented by AKSASP is completed by a single individual with no oversight or secondary review to ensure accurate reporting. Cause: AKSASP staff had not received training on the requirements to implement effective internal controls over federal program operations to ensure compliance with program requirements. Criteria: Title 2 CFR 200.303 requires the State to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the State is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the grant awards. These internal controls should be in compliance with guidance in “Standards for Internal Control in Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by COSO. Effect: Without adequate internal controls, inaccurate reports may be submitted thereby reducing the federal oversight agency’s ability to adequately manage the program. Questioned Costs: None Recommendation: DOA’s State Property Manager should develop and implement internal controls over the preparation and submission of GSA 3040 reports. Furthermore, management should provide training to AKSASP staff on the importance of, and requirements for, maintaining a proper system of internal control over federal reporting requirements. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-028 Federal Awarding Agency: U.S. Environmental Protection Agency (EPA) Impact: Significant Deficiency, Noncompliance AL Number and Title: 66.202 Congressionally Mandated Projects (CMP) Federal Award Number: 02J80201 Applicable Compliance Requirement: Allowable Costs/Cost Principles Condition: One of 10 employee timesheets tested did not support the charges billed to the CMP program. Context: DCCED staff log work hours on timesheets, which includes coding personal service costs to the Rural Utility Business Advisor (RUBA) program . Of the 10 timesheets tested, one timesheet indicated that only a portion of time worked was chargeable to RUBA; however, 100 percent of the employee's time was erroneously charged to the program. Cause: According to DCCED management, the unsupported charges were due to a data entry error. The data entry error was not detected by payroll processing staff due to insufficient review procedures. Criteria: Title 2 CFR 200.303 requires the State to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the State is managing federal awards in compliance with federal statutes, regulations, and terms and conditions of the grant awards. Title 2 CFR 200.430(g)(1) states that charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated; and support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one federal award; a federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Effect: Insufficient payroll processing controls increase the risk of noncompliance and unallowable costs. Noncompliance with federal regulations may result in the federal awarding agency imposing additional conditions or taking corrective action, including reducing/terminating federal funding. Questioned Costs: $2,273 Recommendation: DCCED’s DCRA director should strengthen timesheet processing, review, and approval procedures to ensure personal service costs charged to CMP are accurate and allowable. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-059 Federal Awarding Agency: U.S. Environmental Protection Agency (EPA) Impact: Significant Deficiency, Noncompliance AL Number and Title: 66.202 Congressionally Mandated Projects (CMP) Federal Award Number: 01J83401, 02J14601 Applicable Compliance Requirement: Reporting Condition: Unliquidated obligations as reported in two of three tested SF-425 Federal Financial Reports were inaccurate. Context: Recipients of EPA grants must submit annual SF-425 Federal Financial Reports for all active federal awards. During FY 25, five grant awards were subject to SF-425 submission of which three were tested. The audit identified that the federal share of unliquidated obligations (line 10f) reported for two federal awards were overstated by $543,052 and $523,069, respectively. DEC staff inadvertently included the State’s share of unliquidated obligations in the report. Cause: The errors were due to insufficient procedures over the preparation and review of SF-425 reports. Criteria: Title 2 CFR 200.328(c) requires the State to submit financial reports as required by the federal award. Title 2 CFR 200.303(a) requires the State to establish, document, and maintain effective internal controls over Federal awards that provide reasonable assurance that the State is managing Federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Effect: Inaccurate federal reporting may impair federal decision-making and may result in the federal awarding agency imposing additional conditions or taking corrective action, including additional requirements or withholding/terminating funds. Questioned Costs: None Recommendation: DEC’s DAS director should strengthen procedures for the preparation and review of the SF-425 report to ensure reports submitted to EPA are accurate. Furthermore, the DAS director should work with the federal oversight agency to revise the inaccurate SF-425 reports, as needed. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-060 Federal Awarding Agency: EPA Impact: Significant Deficiency, Noncompliance AL Number and Title: 66.202 CMP Federal Award Number: 02J40501, 02J76901, 02J80901 Applicable Compliance Requirement: Reporting Condition: DEC did not fully comply with Federal Funding Accountability and Transparency Act (FFATA) reporting requirements applicable to FY 25 CMP subawards. Context: FFATA requires information on federal awards to be made available to the public through USASpending.gov. SAM.gov is the reporting tool federal awardees, such as the State of Alaska, use to report subaward and executive compensation data for first-tier subawards. In FY 25 there were 11 CMP subawards subject to FFATA reporting of which the audit tested seven totaling $8,965,396. One subaward totaling $4,665,000 was not reported. In addition, the reported subaward action date for three subawards did not agree with the date the subaward agreement was signed. The three subawards with the inaccurate data element totaled $763,279. Cause: According to DEC management, staff turnover, legacy system (FSRS.gov) limitations, and insufficient review procedures contributed to the errors and omissions. According to DEC management, the $4.7 million subaward was not reported due to the submission inadvertently being left in draft status in SAM.gov. Once identified by auditors, management subsequently completed the reporting. Criteria: Title 2 CFR Part 170 requires recipients of federal grants or cooperative agreements to report subawards of $30,000 or more to SAM.gov by the end of the month following the subaward obligation. Title 2 CFR 200.303(a) requires the State to establish, document, and maintain effective internal controls over Federal awards that provide reasonable assurance that the State is managing Federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards Effect: Failure to comply with FFATA reporting requirements reduces transparency and may jeopardize future federal funding. Questioned Costs: None Recommendation: DEC’s DAS director should strengthen FFATA reporting review and submission procedures to ensure required reports are filed timely and key data elements comply with federal reporting requirements. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-023 Federal Awarding Agency U.S. Department of Education Impact: Significant Deficiency AL Number and Title: 84.027, 84.173 Special Education Cluster Federal Award Number: H173A240019, H027A240016 Applicable Compliance Requirement: Matching, Level of Effort, Earmarking Condition: The Coordinated Early Intervening Services (CEIS) budgets for two Local Education Agencies (LEA) exceeded the allowable federal limit. Context: The federal Individuals with Disabilities Education Act allows LEAs to use Special Education Cluster funds to provide CEIS services to K-12 students to reduce the need for special education services. LEAs identified by DEED as having significant disproportionality in the identification, placement, or discipline of students with disabilities are required to reserve the maximum allowable amount of funds to provide CEIS services to address factors contributing to the significant disproportionality. The maximum allowable amount for CEIS services is 15 percent of the Special Education allocation. In accordance with Title 34 CFR 300.646, DEED staff conducts an annual review of LEA data to determine whether significant disproportionality exists. Two LEAs were identified as having significant disproportionality in FY 25. DEED management has implemented budgetary controls in the Grant Management System (GMS) to ensure compliance with Special Education Cluster earmarking requirements. DEED program staff perform an initial review of the LEA’s requested CEIS amounts. A separate individual performs a final review and approves the LEA budget in GMS. LEA reimbursement requests are approved by DEED grant staff based on the budget established in GMS. The audit found that both LEAs with significant disproportionality in FY 25 had GMS budgets that exceeded 15 percent of the Special Education allocation; one by $876 and one by $34,358. Cause: For the two LEAs in question, DEED grant staff incorrectly used FY 24 budget data to calculate the FY 25 CEIS budget 15 percent limit which caused the CEIS budgets in GMS to exceed the maximum allowable amounts. DEED management’s review procedures over the setup of LEA CEIS budgets were not sufficient to prevent or detect the errors. Criteria: Title 34 CFR 300.226 requires an LEA to reserve no more than 15 percent of their Special Education Cluster allocation to provide CEIS services. Per 2 CFR 200.303(a), the State is required to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the State is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the grant awards. Per 34 CFR 300.646(d) the State shall require any LEA identified with significant disproportionality to reserve the maximum amount of funds to provide CEIS services to address factors contributing to the significant disproportionality. Effect: Inadequate internal controls increase the risk that expenditures may be unallowable due to LEAs exceeding the federally set CEIS limit, or may result in LEAs identified as having significant disproportionality to budget for the wrong CEIS amount. Furthermore, noncompliance with federal regulations may result in the federal awarding agency imposing additional conditions or taking corrective action including adding reporting requirements or withholding/terminating funding. Questioned Costs: None Recommendation: DEED's Innovation and Education Excellence director should update procedures to ensure LEA CEIS budgets comply with federal earmarking requirements. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-032 Prior Audit Finding: 2024-038 Federal Awarding Agency: USDHS Impact: Material Weakness, Material Noncompliance AL Number and Title: 97.036 Disaster Grants Federal Award Number: 4413DRAKP00000001 Applicable Compliance Requirement: Subrecipient Monitoring Condition: DMVA management did not issue a management decision for a finding relating to one Disaster Grants subrecipient’s single audit. Context: Under federal regulations, pass-through entities are responsible for issuing a management decision for audit findings relating to federal awards provided to subrecipients. The management decisions must clearly state whether or not the audit finding is substantiated, the reason for the decision, and the adequacy of the recipient’s proposed corrective actions to address the findings. If the subrecipient has not completed corrective action, a timetable for follow-up should be given. One Disaster Grants subrecipients single audit contained a finding and DMVA management did not issue a management decision. The finding related to a subrecipient lacking evidence that a secondary review was conducted by an individual other than the preparer for required reports. Cause: DMVA had controls to ensure a management decision was issued on a subrecipient's single audit finding. However, DMVA’s procedures were insufficient to identify subrecipient’s findings requiring follow-up. DMVA staff stated that information reported on the Summary of Items for Follow-up document, provided by the Department of Administration, Division of Finance, did not specify that DMVA should follow up on the finding; therefore, no management decision was issued. However, the audit determined DMVA misinterpreted the information provided by the Division of Finance. Criteria: Title 2 CFR 200.521 requires the State to issue a management decision for audit findings that affect subawards it issues to subrecipients under a federal award. Title 2 CFR 200.1 defines a management decision as a pass-through entity’s written determination, provided to the auditee, of the adequacy of the auditee’s proposed corrective actions to address the findings, based on its evaluation of the audit findings and proposed corrective actions. Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal control over the federal award that provides reasonable assurance that the State is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the grant awards. Effect: The lack of a management decision may result in a subrecipient not taking appropriate corrective action on findings. Noncompliance with federal regulations may result in the federal awarding agency imposing additional conditions or taking corrective action, including additional reporting requirements or withholding/terminating funding. Questioned Costs: None Recommendation: DMVA’s DAS director should strengthen procedures to ensure findings requiring follow-up are identified and management decisions are issued within six months of a subrecipient audit report’s acceptance by the federal audit clearinghouse. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-035 Prior Audit Finding: 2024-040 Federal Awarding Agency: USDHS Impact: Material Weakness, Material Noncompliance AL Number and Title: 97.036 Disaster Grants Federal Award Number: 4585DRAKP00000001, 4646DRAK000000001, 4672DRAKP00000001, 4730DRAKP00000001 Applicable Compliance Requirement: Reporting Condition: Eight of 70 FY 25 subawards tested were not filed timely in the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System . An additional 32 subawards requiring FFATA reporting were not filed. Context: FFATA requires information on federal awards be made available to the public through a single searchable website (www.usaspending.gov). The FFATA reporting tool is available for federal awardees, such as the State of Alaska, to report first-tier subawards. To comply with FFATA requirements, DHSEM staff responsible for Disaster Grants management obtain subawardee information from the OAD. The OAD is sent to DAS staff for data entry into the FFATA reporting tool. There were 70 Disaster Grants subawards totaling $54,169,139 that were subject to FFATA reporting during FY 25. The audit reviewed eight randomly selected subawards, totaling $1,813,371, for compliance and internal controls testing of FFATA reporting requirements. FFATA reports for all eight subawards were not filed timely. Further, the audit reviewed all 70 subawards and found 32 totaling $28,396,662 were not reported at all Cause: Staff turnover and vacancies contributed to the untimely filing of reports and reports not being filed. Supervisory review procedures were inadequate to ensure reports were filed as required. Criteria: Title 2 CFR 170 states federal award recipients are required to report each subaward that obligates $30,000 or more in federal funds. This information must be reported no later than the end of the month following the month in which the obligation was made and include information about each obligating action in accordance with submission instructions. Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal control over the federal award that provides reasonable assurance that the State is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the grant awards. Effect: Failure to comply with FFATA reporting requirements reduces transparency and may jeopardize future federal funding. Questioned Costs: None Recommendation: DMVA's DAS director should allocate the resources necessary to comply with FFATA reporting requirements and strengthen supervisory review procedures. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-030 Prior Audit Finding: 2024-036 Federal Awarding Agency: U.S. Department of Homeland Security (USDHS) Impact: Material Weakness, Material Noncompliance AL Number and Title: 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disaster) (Disaster Grants) 97.036 Disaster Grants – COVID-19 Federal Award Number: 4413DRAKP00000001, 4533DRAKP00000001, 4585DRAKP00000001, 4672DRAKP00000001 Applicable Compliance Requirement: Allowable Costs/Cost Principles Condition: A review of 17 FY 25 Disaster Grants payments found that 15 payments (88 percent) lacked adequate supporting documentation. Context: FEMA provides public assistance funding to states for federally declared disaster mitigation and response. To be allowable under the Disaster Grants program, costs must be directly tied to the performance of eligible work, adequately documented, and necessary and reasonable to accomplish the work properly and efficiently. DMVA issues subawards to eligible applicants, including not-for-profits and local governments, and transfers funds to other State departments for disaster response. The State (DMVA) and Disaster Grants subrecipients may contract for services but must meet state and federal procurement requirements when doing so. Contracts must include the procurement provisions detailed in Title 2 CFR 200.327. Furthermore, contractors’ performance must be monitored to ensure compliance with the contract conditions. According to management within DMVA’s Division of Homeland Security and Emergency Management (DHSEM), due to the high number of State disasters and a lack of staff resources, DMVA hired contractors to help oversee the federal disaster projects by performing administrative duties typically conducted by DHSEM staff, including reviewing and approving subrecipient applications for funding, obtaining the required documents to ensure projects were administered in accordance with FEMA requirements, and processing subrecipient payment requests. There were 327 Disaster Grants payments totaling $325,318,285 during FY 25. The audit tested 17 Disaster Grant payments totaling $188,888,098, of which 15 were inadequately unsupported. Specifically, 11 payments were partially supported by procurement contracts that did not include all federal requirements and four were not fully supported by complete or signed contracts. Other errors included: one payment contained amounts for an unrelated project; five payments were not fully supported by invoices; one payment included a markup on a subcontractor’s work; one included an advance payment that lacked required supporting documentation; one payment included a completion bonus; and several payments were not identified as allowable costs in the approved project worksheets. Cause: Due to competing priorities and inadequate supervisory review procedures, DHSEM staff and contractors did not verify that the contracts issued by subrecipients included federal requirements and that documentation for the reimbursement of subrecipient costs was received. Furthermore, contracts for interagency projects were not obtained by DMVA staff or contractors to verify that the costs were within the contract scope or that the contracts included all federal requirements. The audit noted that Department of Health and Social Services (DHSS) submitted a signed Contract/Procurement Review Waiver declining to submit documentation to DMVA for review with the understanding that DHSS would assume all responsibility for the procurement and contracts. DHSEM contractors accepted the waiver and did no monitoring to ensure contracts complied with appropriate procurement processes and included all federally required clauses. Lack of adequate review of the payment requests and supporting documentation, including supervisory review, resulted in payments without adequate invoices or other source documentation. Lack of adequate project oversight resulted in a subrecipient not providing supporting documentation within the 60-day timeline for advance payments. Criteria: Title 2 CFR 200.403(g) requires costs to be adequately documented. FEMA’s guidance for administering the program is detailed in the Public Assistance Program and Policy Guide (PAPPG), which requires Disaster Grants contracts to include the procurement related provisions of Title 2 CFR 200.327 and Homeland Security Acquisition Regulation Class Deviation 15-01 clauses. PAPPG also requires costs to be adequately documented and directly tied to the performance of eligible work. Further, the PAPPG states that FEMA does not reimburse costs incurred under a cost plus a percent of cost contract. Annually, DHSEM management updates the State Administrative Plan for the federal disaster assistance program, which is a required document in each federally approved FEMA-State Agreement for presidentially declared disasters. The purpose of the plan is to identify the State’s roles, responsibilities, processes and procedures for administering FEMA’s Disaster Grants program. The plan requires DHSEM staff to obtain documentation to support all costs claimed and to perform a thorough review to ensure compliance with programmatic and eligibility requirements. The plan also outlines the requirements for advancing FEMA funds to a subrecipient; specifically, the subrecipient must report on the status of advance funds within 30 days of receipt and has up to 60 days to provide the appropriate summary forms and support cost documentation, i.e, invoices, timesheets, etc. If the summary forms and supporting documentation are not received within the time limits, the Plan requires that the State de-obligate remaining funds, recoup advance funds, and close the subrecipient’s project file. Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the State is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Effect: Inadequate documentation may result in unallowable costs. Noncompliance with federal regulations may result in the federal awarding agency imposing additional conditions or taking corrective action, including additional reporting requirements or withholding/terminating funding. Questioned Costs: Indeterminate Recommendation: DMVA’s DHSEM director should strengthen written procedures to ensure Disaster Grants contracts are obtained and reviewed for compliance with federal requirements. Furthermore, supervisory review procedures should be strengthened to ensure DHSEM staff and contractors obtain and review cost documentation to ensure subrecipient payment requests are allowable for the project and adequately supported. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-031 Prior Audit Finding: 2024-037 Federal Awarding Agency: USDHS Impact: Material Weakness, Material Noncompliance AL Number and Title: 97.036 Disaster Grants 97.036 Disaster Grants – COVID-19 Federal Award Number: 4533DRAKP00000001, 4730DRAKP00000001 Applicable Compliance Requirement: Subrecipient Monitoring Condition: A review of 21 FY 25 Disaster Grants subrecipient obligating award documents (OAD) found that three did not include an accurate unique entity identifier (UEI) that matched the subrecipient’s name and one did not provide a UEI. Context: DMVA enters into awards with subrecipients using the OAD as the subgrant agreement. The subrecipient’s name and UEI are recorded on the OAD. An assurances and agreement form accompanies the OAD that includes additional federal requirements not included in the OAD. Subrecipients sign the OAD and the assurances and agreement forms certifying and agreeing to the federal requirements. According to DHSEM management, due to the high number of State disasters and a lack of staff resources, contractors were hired to help evaluate applicant eligibility, make subawards, conduct risk assessments, and monitor accordingly. The audit reviewed a random sample of 20 of 100 subrecipient OADs and one judgmentally selected OAD, including assurances and agreement forms, and found two OADs for one subrecipient in which the subrecipient’s name did not match the name associated with the UEI number provided; one OAD reported a UEI number that did not match the name and address when verified with the federal reporting website; and one OAD did not include a UEI number. Cause: According to DHSEM management, due to competing priorities and inadequate supervisory review procedures, DHSEM staff and contractors did not ensure subrecipient’s OADs included a UEI number or an accurate UEI number. Criteria: Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal control over the federal award that provides reasonable assurance that the State is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the grant awards. Title 2 CFR 200.332 requires pass-through entities ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the required information at the time of the subaward. Required information includes the subrecipient’s name, which must match the name associated with the subrecipient’s UEI. Effect: Not providing the UEI number or correct UEI number hampers subaward reporting and may impact federal oversight of the Disaster Grants program. Questioned Costs: None Recommendation: DMVA’s DHSEM director should strengthen review procedures to adequately monitor contractors to ensure subrecipient information in award documents is accurate. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-033 Federal Awarding Agency: USDHS Impact: Material Weakness, Material Noncompliance AL Number and Title: 97.036 Disaster Grants 97.036 Disaster Grants – COVID-19 Federal Award Number: 4533DRAKP00000001, 4730DRAKP00000001 Applicable Compliance Requirement: Subrecipient Monitoring Condition: DMVA staff did not document a risk assessment for two Disaster Grants subrecipients. Context: DMVA receives funding applications from state, local, tribal, and private not-for-profit entities once a disaster has been presidentially declared. Prior to entering into an agreement with an applicant, DHSEM staff perform a risk assessment of the applicant to determine the extent of subrecipient monitoring. DHSEM staff evaluate the applicant by completing a risk assessment checklist, and apply safeguards if the subrecipient is considered high risk. DHSEM staff also complete a payment request checklist, prior to making subrecipient payments to confirm that risk assessments have been performed. According to DHSEM management, due to the high number of State disasters and a lack of staff resources, contractors were hired to help evaluate applicant eligibility, make subawards, conduct risk assessments, and monitor accordingly. The audit reviewed a random sample of eight of 47 subrecipients. One of the eight subrecipients did not have a risk assessment. During allowable cost testing, one additional subrecipient was identified that did not have risk assessment performed. Cause: Due to competing priorities and inadequate supervisory review procedures, DHSEM staff and contractors did not consistently obtain risk assessments and DHSEM management did not adequately monitor contractors to ensure risk assessments were performed. Criteria: Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal control over the federal award that provides reasonable assurance that the State is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the grant awards. Title 2 CFR 200.332(c) requires the State to assess each subrecipient’s risk of noncompliance to determine the appropriate subrecipient monitoring. Effect: The lack of risk assessments may lead to inadequate monitoring of subrecipients increasing the risk of unallowable use of federal funds. Questioned Costs: None Recommendation: DMVA’s DHSEM director should strengthen supervisory review procedures to adequately monitor contractors and ensure risk assessments are performed. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-034 Prior Audit Finding 2024-039 Federal Awarding Agency: USDHS Impact: Material Weakness, Material Noncompliance AL Number and Title: 97.036 Disaster Grants 97.036 Disaster Grants – COVID-19 Federal Award Number: 4351DRAKP00000001, 4533DRAKP00000001, 4585DRAKP00000001 Applicable Compliance Requirement: Reporting Condition: Three of seven randomly selected FY 25 Disaster Grants SF-425 reports tested had the following errors: one reported incorrect recipient share required and two reported incorrect federal share of expenditures and incorrect recipient share of expenditures. Context: The SF-425 is a required quarterly federal financial form used for reporting on the financial status of federal grant awards. During FY 25, 16 disasters required quarterly SF-425 reports for a total of 64 reports filed. Seven of the 64 were selected for testing. The federal share and matching amounts for two reports were overstated and one understated total recipient share required as shown below. Cause: During FY 25, FEMA transitioned to a new grants management system. According to DMVA management, DMVA staff followed procedures to use the data in the old FEMA management system without performing any follow-up on discrepancies in previously reported amounts. Furthermore, DMVA reporting procedures were not updated to incorporate FEMA’s new grants management system for preparation and review of SF-425 reports. Criteria: Title 44 CFR 206.120(f)(2) prescribes the State shall provide financial status reports. Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal control over federal awards that provide reasonable assurance that the State is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Effect: Inaccurate federal reporting may impair federal decision-making and may result in the federal awarding agency imposing additional conditions or taking corrective action, including additional reporting requirements or withholding/terminating funds. Questioned Costs: None Recommendation: DMVA's DAS director should update written procedures for the preparation and review of the SF-425 report to ensure the reports submitted to FEMA are accurate. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-079 Prior Year Finding: 2024-081 Federal Awarding Agency: U.S. National Science Foundation, U.S. Department of the Interior and U.S. Department of Agriculture (USDA) Impact: Significant Deficiency, Noncompliance AL Number and Title: 10.237 From Learning to Leading: Cultivating the Next Generation of Diverse Food and Agriculture Professionals 15.423, 47.050, 47.074, 47.078 Research and Development Cluster (RDC) Federal Award Number: 2040541-2025, 2224776-2025, 2322806-2025, M24AC00008-2025, 20237044040222-2025 Applicable Compliance Requirement: Cash Management Condition: The University did not make payments to subrecipients within 30 days after receipt of invoices. Context: During our testing we identified 11 out of 40 subrecipient payments related to four grants from the University of Alaska Fairbanks (UAF) under RDC, that did not process payment requests from the subrecipients timely. During our testing we identified two out of eight subrecipient payments related to one grant from UAF under the From Learning to Leading: Cultivating the Next Generation of Diverse Food and Agriculture Professionals Program, did not process payment requests from the subrecipients timely. Cause: UAF did not process payment requests from the subrecipients timely. Criteria: Uniform Grant Guidance (2 CFR section 200.305(b)(3)) requires that when the reimbursement method is used, the Federal awarding agency or pass-through entity must make payment within 30 calendar days after receipt of the billing, unless the Federal awarding agency or pass-through entity reasonably believes the request to be improper. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Effect: Subrecipients on federal awards do not receive timely payment for federal contract work. Questioned Costs: None Recommendation: We recommend the University review and update policies and procedures to allow for more timely payment to subrecipients for work the University contracts them to perform. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-080 Federal Awarding Agency: USDA Impact: Significant Deficiency, Noncompliance AL Number and Title: 10.237 From Learning to Leading: Cultivating the Next Generation of Diverse Food and Agriculture Professionals Federal Award Number: 20237044040222 - 2025 Applicable Compliance Requirement: Reporting Condition: The University did not have documentation of the Federal Funding Accountability and Transparency Act (FFATA) reports submitted in a timely manner. Context: During our testing of two subawards from UAF that were reported to SAM.gov, we identified both reports did not have documentation of the reports being submitted by the required due date. Cause: UAF did not create a new report for the subaward amendments and replaced the information from the original subaward submission. Since the information was overwritten, there was no documentation of original submission date for the report during the fiscal year. Criteria: Uniform Grant Guidance (2 CFR 170 Appendix A(l)(2)(ii)) requires subaward information be reported no later than the end of the month following the month in which the obligation was made. Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Effect: The University was not in compliance with FFATA reporting requirements. Questioned Costs: None Recommendation: We recommend that the University review and update current procedures to ensure the program reporting requirements are completed timely. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-081 Federal Awarding Agency: US Department of Education (USED) Impact: Significant Deficiency, Noncompliance AL Number and Title: 84.063, 84.268, 84.007, 84.033 Student Financial Assistance Cluster (SFAC) Federal Award Number: P063P240010-2025, P268K250010-2025, P007A240090-2025, P033A240090-2025 Applicable Compliance Requirement: Allowable Costs/Cost Principles, Eligibility Condition: During inquiries with management, the University of Alaska identified multiple students during enrollment verification process that they determined were fictious. Context: During inquiries with management, the University identified multiple students that were awarded and disbursed Pell, Supplemental Educational Opportunity Grant (SEOG), and Direct Loans, who were subsequently determined to be ineligible for the programs. Cause: The University's internal control policies were not effectively designed to ensure funds are disbursed to eligible students. Criteria: The Code of Federal Regulation, 34 CFR 668.16(f), states the University is required to develop and apply an adequate system to identify and resolve discrepancies in the information that the institution receives from different sources with respect to a student's application for financial aid under Title IV, HEA programs. Uniform Guidance 2 CFR 200.303, non-federal entities receiving federal awards are required to establish and maintain internal controls designed to reasonable ensure compliance with federal laws, regulations, and program compliance requirements. Effect: The University disbursed Title IV funds to ineligible students, resulting in questioned costs. Questioned Costs: AL 84.007: $4,947 AL 84.063: $27,059 AL 84.268: $158,554 Recommendation: We recommend the University review their internal control procedures to ensure that students are eligible prior to funds being disbursed. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-082 Federal Awarding Agency: USED Impact: Significant Deficiency, Noncompliance AL Number and Title: 84.063, 84.268, 84.007, 84.033 SFAC Federal Award Number: P063P240010 - 2025, P268K250010 - 2025, P007A240090 - 2025, P033A240090-2025 Applicable Compliance Requirement: Special Tests and Provisions Condition: The University did not pay student's Title IV credit balance within 14 days. Context: During our testing of 40 students, we identified one student from UAF that had a credit balance refund returned later than 14 days after the credit balance occurred in student account. The refund issued after the 14 day deadline was issued on the 15th day, with only one day past the deadline. Cause: UAF was experiencing processing delays due to personnel issues. Criteria: Per 34 CFR 668.164 (h)(2), if a federal credit balance occurs (i.e., when the total Title IV aid credited to a student's account exceeds allowable charges), the institution must pay the credit balance to the student or parent no later than 14 calendar days after the date the balance occurred. Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Effect: The student did not have access to their credit balance refund timely. Questioned Costs: None Recommendation: We recommend the University review and update procedures around disbursements of credit balances and implement controls to ensure credit balances are being returned timely. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-083 Federal Awarding Agency: USED Impact: Significant Deficiency, Noncompliance AL Number and Title: 84.063, 84.268, 84.007, 84.033 SFAC Federal Award Number: P063P240010 - 2025, P268K250010 - 2025, P007A240090 - 2025, P033A240090-2025 Applicable Compliance Requirement: Special Tests and Provisions Condition: The University did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 40 students, we identified from UAF one student that the student's enrollment status was reported after the 60-day reporting requirement and one student with effective date reported to NSLDS that did not align with institutional records. Cause: The University did not have proper procedures in place to verify students' status in NSLDS matched the institutions records accurately. Criteria: Per 34 CFR 682.610, institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. Uniform Guidance 2 CFR 200.303, non-federal entities receiving federal awards are required to establish and maintain internal controls designed to reasonable ensure compliance with federal laws, regulations, and program compliance requirements. Effect: The University was not in compliance with the requirements to properly report student enrollment data correctly. Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Questioned Costs: None Recommendation: We recommend the University review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely and accurately. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-084 Federal Awarding Agency: USED Impact: Significant Deficiency, Noncompliance AL Number and Title: 84.044 TRIO Cluster Federal Award Number: P044A210918 - 2024 Applicable Compliance Requirement: Eligibility Condition: The University did not properly maintain documentation to demonstrate a student's intent to become a permanent resident. Context: During our testing of 40 students, we identified one student from the Talent Search program from the University of Alaska Anchorage (UAA) that did not have proper documentation of their intent to become a permanent resident. Cause: UAA did not maintain eligibility documentation prior to allowing the student to participate in TRIO Talent Search services. Criteria: Per 34 CFR 643.3(a)(1)(iii), an individual is eligible to participate in a Talent Search project if the individual is in the United States for other than a temporary purpose and provides evidence from the Immigration and Naturalization Service of his or her intent to become a permanent resident. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Effect: Failure to properly maintain documentation for eligibility requirements may result in noncompliance of federal regulations. Questioned Costs: None Recommendation: We recommend the University review and update current procedures to ensure all eligibility documentation is maintained prior to TRIO services being provided. Views of Responsible Officials: Management agrees with this finding.

1. FINDING NUMBER: 2025 - 004 2. THIS FINDING IS: New X Repeat from Prior year? Year originally reported? 3. Federal Program Name and Year: Child Nutrition Cluster - 2024 and 2025 4. Project No.: 2024-4210, 2024-4210-SC, 2025-4210, 2025-4211, 2024-4220, 2025-4220, 2025-4999 5. AL No.: 10.533; 10.555 6. Passed Through: Illinois State Board of Education 7. Federal Agency: U.S. Department of Agriculture 8. Criteria or specific requirement (including statutory, regulatory, or other citation): Per 2 CFR 200.303a, "The recipient and subrecipient establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." 9. Condition: The District is required to submit monthly claim information for the Child Nutrition Cluster to the Illinois State Board of Education (ISBE). The District was unable to produce support that the monthly claims were reviewed and internally approved prior to transmission to ISBE. This is deemed to be a material weakness in internal control over compliance for reporting requirements. 10. Questioned Costs: None 11. Contex: No instances of noncompliance were noted and the District indicated that the reports were informally reviewed prior to transmission to ISBE. 12. Effect: The lack of documentation is an indicator that the control structure implemented by the District is not effectively designed. Improperly designed internal controls can lead to instances of noncompliance with applicable requirements. 13. Cause: The District's internal control structure is missing the documentation of review and approval prior to transmission to ISBE. 14. Recommendation: We recommend that the District review the design of its internal control over compliance to ensure that documentation requirements are incorporated into the control design. 15. Management's response: To enhance internal controls and ensure the segregation of duties, the Assistant Director of Food Services will be responsible for the initial preparation and completion of all claims. Subsequently, a secondary review and final approval will be performed by either the Director or the Chief School Business Official (CSBO) prior to submission.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063, 84.268 Award Period: June 1, 2024 to May 31, 2025 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or Specific Requirement: The 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition: During our testing, we noted the College did not have a formal review of their monthly reconciliations of Common Origination and Disbursement (COD) data with student account records, federal aid packaging by financial aid staff, and monitoring of the G5 system to ensure timely return of undisbursed funds after 240 days. Questioned Costs: N/A Context: The College did not have proper internal controls in place during the 2024-25 academic year to ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Cause: The lack of documentation appears to stem from limited administrative capacity, particularly in the wake of operational disruptions and regulatory changes such as FAFSA Simplification. Effect: The College is not following the compliance with federal statutes, regulations, and the terms and conditions of the federal award. Repeat Finding: No Recommendation: We recommend the College review its procedures to ensure controls are in place to ensure to catch any inconsistencies that occur during the year. Views of Responsible Officials: There is no disagreement with the audit finding.

Finding 2025-001 – Procurement (Material Weakness) Repeat Finding: No Federal Agency – National Science Foundation; National Institute of Health Research and Development Cluster Social, Behavioral, and Economic Sciences – Passed through New York University: 47.075, Mathematical and Physical Sciences – Passed through Loyola University of Chicago: 47.049, Biological Sciences: 47.074, Allergy and Infectious Disease Research: 93.855 Federal Award Years: Year Ended May 31, 2025 Condition The College's procurement policy does not reflect all applicable state and local laws and federal regulations. For two out of three (67%) small purchase procurements, there was not sufficient evidence to support that documentation of the noncompetitive procurement method selected was provided at the time of purchase. Criteria Non-federal entities other than states, including those operating federal programs as subrecipients of states, must follow the procurement standards set out at 2 CFR sections 200.318 through 200.327. They must use their own documented procurement procedures, which reflect applicable state and local laws and regulations, provided that the procurements conform to applicable federal statutes and the procurement requirements identified in 2 CFR Part 200. In accordance with 2 CFR sections 200.319 and 200.320(f), price quotations should be obtained from an adequate number of qualified sources for procurements that meet the small purchase procurement threshold or require documentation in support of the rationale to limit competition in those cases where competition was limited. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure the College has a procurement policy that meets the all applicable state and local laws and regulations. Questioned Costs There were no questioned costs related to this finding. Cause The College does not have a procurement policy that follows the procurement standards set out at 2 CFR sections 200.318 through 200.327. Context Two out of three vendors tested. Expenditures totaled $100,553. Effect Lack of a documented procurement policy that meets applicable state and local laws and federal regulations can result in improper procurement of goods and services which can lead to loss of future funding. Recommendation We recommend the College implement a procurement policy that conforms to federal regulations. We also recommend that the College implement policies and procedures around documentation of noncompetitive bidding. Views of Responsible Officials We agree with this finding. See corrective action plan.

Finding 2025-002 – Suspension and Debarment (Material Weakness) Repeat Finding: No Federal Agency – National Science Foundation; National Institute of Health Research and Development Cluster Biological Sciences: 47.074, Allergy and Infectious Disease Research: 93.855 Federal Award Years: Year Ended May 31, 2025 Condition For two out two vendors (100%) tested, the College did not provide sufficient documentation that a suspension and debarment check was performed prior to entering into a contract with the vendor. Criteria Non-federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. “Covered transactions” include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria as specified in 2 CFR section 180.220 Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure suspension and debarment checks are performed and documented. Questioned Costs There were no questioned costs related to this finding. Cause The College did not have controls in place to reasonably ensure compliance with suspension and debarment requirements of the Uniform Guidance. Context Two out of two vendors tested. A subsequent check was confirmed that these vendors were not suspended or debarred. Effect If the College does not obtain documentation confirming a vendor for a procurement transaction was not suspended or debarred, the College could enter into a transaction with a suspended or debarred vendor causing unallowable costs and as a result represent noncompliance and result in a loss of federal funding. Recommendation We recommend the College review current processes for suspension and debarment to ensure that documentation is included to support the suspension and debarment check prior to entering into a contract with a vendor. Views of Responsible Officials We agree with this finding. See corrective action plan.

Finding 2025-003 – Student Financial Aid - Excess Cash (Significant Deficiency) Repeat Finding: No Federal Agency – U.S. Department of Education (ED) Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Award Years: Year Ended May 31, 2025 Condition During our cash management testing, we identified that Lake Forest College had excess cash for the FDL program ranging from $24,903 to $3,683,698 during the period of January 30, 2025 through February 7, 2025. In this situation, the excess cash exceeded one percent of total prior year drawdowns, and the amount was not returned within a seven-day period. Criteria Uniform Grant Guidance (34 CFR 668.166) states the Secretary considers excess cash to be any amount of Title IV, HEA program funds, other than Federal Perkins Loan program funds, that an institution does not disburse to students by the end of the third business day following the date the institution (1) received those funds from the Secretary; or (2) deposited or transferred to its depository account previously disbursed Title IV, HEA program funds, such as those resulting from awards adjustments, recoveries, or cancellations. An institution may maintain for up to seven days an amount of excess cash that does not exceed one percent of the total amount of funds the institution drew down in the prior award year. The institution must return immediately to the Secretary any amount of excess cash over the one-percent tolerance and any amount of excess cash remaining in its account after the seven-day tolerance period. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure excess cash is properly handled. Questioned Costs Questioned costs is the amount that exceeded one percent of total prior year drawdowns. Excess cash ranged from $24,903 to $3,683,698. Cause The College drew down funds in advance of the Spring semester which is allowed based on the College’s cash management method. However, due to timing differences, the funds were not ultimately disbursed to students until 8 days after the drawdown was made. Context One instance of excess cash during the fiscal year. Effect Excess cash is noncompliance with Federal regulation and could result in the loss of future funding. Untimely reconciliation of federal awards can result in over or under awarding of funding and result in heightened monitoring by the Department of Education. Recommendation We recommend the College review current processes for monitoring cash management and implement procedures that eliminate excess cash. Views of Responsible Officials We agree with this finding. See corrective action plan.

Finding 2025-004 – Enrollment Reporting (Significant Deficiency) Repeat Finding: No Federal Agency – U.S. Department of Education (ED) Student Financial Assistance Cluster Federal Pell Grant Program: 84.063 Federal Direct Student Loans: 84.268 Federal Work Study Program: 84.033 Federal Supplemental Educational Opportunity Grants 84.007 Federal Award Years: Year Ended May 31, 2025 Condition For three out of forty (7.5%) student enrollment reporting selections, the student's status change at the campus level and program was not properly reported to NSLDS with the required timeframe. Criteria CFR section 685.309 and 690.83(b)(2) requires the College to notify the NSLDS within 30 days of a change in student status or include the change in status in a response to an enrollment reporting roster within 60 days of the student’s date of determination of withdrawal. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure accurate and timely enrollment reporting Questioned Costs There were no questioned costs related to testing of enrollment reporting. Cause The student's status change was after the last scheduled reporting transmission file of the semester, therefore their status change was not captured in the NSLDS reporting submission. Context Three out of forty students selected for testing. Effect Failure to report status changes accurately is noncompliance with Federal regulation and could result in heightened monitoring by the Department of Education. Recommendation We recommend the College implement review procedures to ensure that the proper effective date is being reported to the NSLDS when a student withdraws or has an enrollment status change. A system of review procedures and/or controls will ensure the College is reporting status changes accurately. Views of responsible officials We agree with this finding. See corrective action plan.

Special Tests and Provisions – Enrollment Reporting U.S. Department of Education, Student Financial Assistance Cluster, Assistance Listing Number 84.268 Federal Direct Student Loans, Assistance Listing Number 84.063 Federal Pell Grant Program Program Year 2024–2025 Type of Finding: Other Instance of Noncompliance and Deficiency Criteria: Per 2 CFR §200.303, 34 CFR 685.309, OMB No. 1845-0035 and the Federal Student Aid Handbook, institutions are required to report accurate and timely enrollment status changes, including graduation, to the NSLDS via the National Student Clearinghouse or other reporting mechanisms. Accurate reporting ensures proper administration of Title IV funds and prevents inappropriate loan deferments or repayments. Condition: The University did not ensure that all graduation data was accurately transmitted and reflected in the National Student Loan Data System (NSLDS). Questioned Costs: $0 Context: Out of the population of 167 students subject to enrollment reporting, a sample of 17 students were selected for testing. For 1 of the 17 students tested, NSLDS did not reflect the student’s graduation status on campus or program students in which the University’s records reported graduated. Effect: Failure to report accurate enrollment status may result in incorrect deferment or repayment statuses for student borrowers, potentially impacting loan servicing and compliance with federal regulations. Cause: The errors appear to be the result of a lapse in control by the University to ensure all graduation data was accurately transmitted and reflected in the NSLDS. Recommendation: We recommend the University enhance its controls over the enrollment reporting process to ensure that all graduation data is accurately and timely reported to the NSLDS. This may include periodic reconciliations between internal records and NSLDS data and follow-up procedures for discrepancies. Views of Responsible Officials: Management concurs with the finding and recommendation. Further information on the corrective action plan will be provided by management.

Finding 2025-001: Excess Cash – Student Financial Aid Federal Agency: U.S. Department of Education Program Name: Student Financial Assistance Cluster, Federal Direct Student Loans Assistance Listing Number: 84.268 Award Year: June 1, 2024 – May 31, 2025 Program Expenditures: $26,594,632 Questioned Costs: None Criteria: Uniform Grant Guidance (34 CFR 668.166) states the Secretary considers excess cash to be any amount of Title IV, Higher Education Act (HEA) program funds, other than Federal Perkins Loan program funds, that an institution does not disburse to students by the end of the third business day following the date the institution (1) received those funds from the Secretary; or (2) deposited or transferred to its depository account previously disbursed Title IV, HEA program funds, such as those resulting from awards adjustments, recoveries, or cancellations. An institution may maintain for up to seven days an amount of excess cash that does not exceed one percent of the total amount of funds the institution drew down in the prior award year. The institution must return immediately to the Secretary any amount of excess cash over the one-percent tolerance and any amount of excess cash remaining in its account after the seven-day tolerance period. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure excess cash is properly handled. Condition: The Kansas Health Science University (KHSU) had one instance of excess cash for the Federal Direct Student Loan program. During our cash management testing, we identified KHSU had excess cash for the Direct Loan program ranging from $94,646 to $190,735 for the period from March 21, 2025 to April 3, 2025. For the period of March 21, 2025 to April 3, 2025, the excess cash exceeded one percent of total prior year drawdowns and amounts were not returned within the seven-day period. Cause: University officials stated the excess cash issues were due to time needed to reconcile refunds with the Common Origination and Disbursement system. Effect: Excess cash is noncompliance with Federal regulations and could result in heightened monitoring by the U.S. Department of Education. Questioned Costs: None Context: For the period of March 21, 2025 to April 3, 2025, KHSU had excess cash ranging from $94,646 to $190,735. KHSU held excess cash for a period of 9 business days and 14 calendar days, respectively. Repeat Finding: Yes. (Finding 2024-001) Recommendation: We recommend KHSU strengthen internal controls around the determination of amounts to be drawn and refunded to the Secretary during the fiscal year. Views of Responsible Officials: Management agrees with the finding. Please see corrective action plan attached.

Item 2025-006 - Special Tests and Provisions - U.S. Department of Health and Human Services, Health Center Program Cluster (Assistance Listing Number 93.224/93.527) Notice of Award Number 6 H80CS00505-23-04, 6 H2ECS45602-02-04, 1 H8LCS50772-01-00 and 6 H8HCS46163-03-01 - (Significant Deficiency) Criteria: Per 2 CFR §200.303(d), non-Federal entities must take prompt action when instances of noncompliance are identified, including those found in audits and monitoring reviews. Entities are also required to establish and maintain effective internal control over federal awards, including monitoring and corrective action systems. Statement of Condition: During our audit, we noted that LBUCC conducted quarterly internal audit reviews of fifty (50) samples self-pay patients to review for sliding fee discount determination. However, we noted that the findings or exceptions identified in the quarterly internal audit review remained uncorrected. Cause: LBUCC did not have a formal tracking and follow-up procedure to ensure that internal audit findings are remediated in a timely and effective manner. Effect: Lack of procedures to track and follow up the remediation of detected errors increases the risk that errors may persist and may lead to noncompliance and/or financial reporting errors. Questioned Costs: None Context: LBUCC’s Operating Data Analyst haphazardly selects 50 samples from the sliding fee visits each quarter, inspects the supporting documentations and reviews the annual income calculation and sliding fee determination. The Operating Data Analyst noted 16 and 25 exceptions during the 3rd and 4th quarter internal reviews and none of these exceptions were communicated to the respective department and therefore all exceptions remained uncorrected. Identification as a Repeat Finding: This is not a repeat finding. Recommendation: We recommend that LBUCC establish a process for communicating, investigating and correcting all internal audit findings or exceptions on a timely manner. Additionally, we recommend that management identify the potential cause of such findings or exceptions and that necessary corrective actions be taken to address such cause. For example, LBUCC may conduct periodic training of all employees involved in the patient intake and screening process. Management Response: Management agrees with the finding and will implement these steps to strengthen our internal controls particularly the monitoring component as this is essential for sustaining compliance